NSE4 Question #423: Real Exam Question with Answer & Explanation

Question

The exhibit shows a part output of the diagnostic command 'diagnose debug application ike 255', taken during establishment of a VPN. Which of the following statement are correct concerning this output? (choose two)

Options

• AThe quick mode selectors negotiated between both IPsec VPN peers is 0.0.0.0/32 for both
• BThe output corresponds to a phase 2 negotiation
• CNAT-T enabled and there is third device in the path performing NAT of the traffic between both
• DThe IP address of the remote IPsec VPN peer is 172.20.187.114

Explanation

The diagnostic output from 'diagnose debug application ike 255' reveals details about the IPSec Phase 2 negotiation and identifies the remote peer's IP address.

Common mistakes.

• A. Quick mode selectors like 0.0.0.0/32 for both ends would imply specific host-to-host tunnels and are not always the negotiated selectors; the actual selectors would need to be visible in the exhibit.
• C. Determining if NAT-T is enabled and if a third device is performing NAT requires specific NAT-T negotiation messages and address translation details in the debug output, which is not stated to be present.

Concept tested. FortiGate IPSec IKE Debug Output Analysis

Reference. https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/603403/troubleshooting-ipsec-vpns

No community discussion yet for this question.