NSE4 · Question #240
A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP…
The correct answer is D. The FortiGate unit does not have the HTTPS service configured on the VLAN1 interface. Despite successful pings indicating basic Layer 3 connectivity, the failed HTTPS connection implies the FortiGate unit does not have the HTTPS administrative access service explicitly enabled on its VLAN1 interface.
Question
A network administrator connects his PC to the INTERNAL interface on a FortiGate unit. The administrator attempts to make an HTTPS connection to the FortiGate unit on the VLAN1 interface at the IP address of 10.0.1.1, but gets no connectivity. The following troubleshooting commands are executed from the DOS prompt on the PC and from the CLI. C:>ping 10.0.1.1 Pinging 10.0.1.1 with 32 bytes of data:
Reply from 10.0.1.1: bytes=32 time=1ms TTL=255 Reply from 10.0.1.1: bytes=32 time<1ms TTL=255 Reply from 10.0.1.1: bytes=32 time<1ms TTL=255 Reply from 10.0.1.1: bytes=32 time<1ms TTL=255 user1 # get system interface == [ internal ] name. internal mode. static ip: 10.0.1.254 255.255.255.128 status: up netbios-forwarD. disable type. physical mtu-override. disable == [ vlan1 ] name. vlan1 mode. static ip: 10.0.1.1 255.255.255.128 status: up netb ios-forward. disable type. vlan mtu-override. disable user1 # diagnose debug flow trace start 100 user1 # diagnose debug ena user1 # diagnose debug flow filter daddr 10.0.1.1 10.0.1.1 id=20085 trace_id=274 msg="vd-root received a packet(proto=6, 10.0.1.130:47927- >10.0.1.1:443) from internal." id=20085 trace_id=274 msg="allocate a new session-00000b1b" id=20085 trace_id=274 msg="find SNAT: IP-10.0.1.1, port-43798" id=20085 trace_id=274 msg="iprope_in_check() check failed, drop" Based on the output from these commands, which of the following explanations is a possible cause of the problem?
Options
- AThe Fortigate unit has no route back to the PC.
- BThe PC has an IP address in the wrong subnet.
- CThe PC is using an incorrect default gateway IP address.
- DThe FortiGate unit does not have the HTTPS service configured on the VLAN1 interface.
- EThere is no firewall policy allowing traffic from INTERNAL-> VLAN1.
How the community answered
(24 responses)- A4% (1)
- B13% (3)
- C21% (5)
- D58% (14)
- E4% (1)
Why each option
Despite successful pings indicating basic Layer 3 connectivity, the failed HTTPS connection implies the FortiGate unit does not have the HTTPS administrative access service explicitly enabled on its VLAN1 interface.
Successful ping replies indicate that the FortiGate unit has a route back to the PC, otherwise the replies would not reach the PC.
Successful pings imply the PC's IP address is correctly configured within a reachable subnet to communicate with 10.0.1.1.
Successful pings demonstrate that the PC can correctly communicate with the target IP, negating an issue with an incorrect default gateway for this specific communication.
Successful ping confirms basic Layer 3 connectivity to the VLAN1 interface (10.0.1.1), but a failed HTTPS connection suggests that the administrative HTTPS service has not been explicitly configured or enabled on that specific FortiGate interface for management access.
Administrative access to the FortiGate itself (e.g., HTTPS management) does not require a firewall policy; firewall policies govern traffic passing *through* the FortiGate, not traffic destined *for* its own management plane.
Concept tested: FortiGate administrative access configuration on interfaces
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/553555/configuring-basic-network-settings
Topics
Community Discussion
No community discussion yet for this question.