NSE4 · Question #448
Which of the following combinations of two FortiGate device configurations (side A and side B), can be used to successfully establish an IPsec VPN between them? (choose two)
The correct answer is B. Side A:main mode, remote gateway as static IP address, policy based VPN. Side B: C. Side A:main mode, remote gateway as static IP address, policy based VPN. Side B. Successful IPsec VPN establishment requires compatible configurations on both FortiGate devices regarding VPN mode, remote gateway type, and VPN type (policy-based or route-based).
Question
Which of the following combinations of two FortiGate device configurations (side A and side B), can be used to successfully establish an IPsec VPN between them? (choose two)
Options
- ASide A:main mode, remote gateway as static IP address, policy based VPN. Side B:
- BSide A:main mode, remote gateway as static IP address, policy based VPN. Side B:
- CSide A:main mode, remote gateway as static IP address, policy based VPN. Side B:
- DSide A: main mode, remote gateway as dialup policy based VPN, Side B: main mode, remote
How the community answered
(39 responses)- A8% (3)
- B79% (31)
- D13% (5)
Why each option
Successful IPsec VPN establishment requires compatible configurations on both FortiGate devices regarding VPN mode, remote gateway type, and VPN type (policy-based or route-based).
The Side B configuration provided is incomplete, making it impossible to determine if the combination would be successful for IPsec VPN establishment.
This combination allows a static IP gateway on Side A to establish a policy-based VPN with a dialup user on Side B, as both sides are configured for main mode and policy-based VPN, ensuring compatible settings.
This combination also allows a static IP gateway on Side A to establish a route-based VPN with a dialup user on Side B, as both sides are configured for main mode and route-based VPN, ensuring compatible settings for tunnel establishment.
Side A's configuration as a 'dialup policy based VPN' when also defining a 'remote gateway as dialup policy based VPN' is contradictory, as dialup VPNs typically await connections, and the description is malformed for a peer definition.
Concept tested: IPsec VPN configuration compatibility (FortiGate)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/453198/ipsec-vpn
Topics
Community Discussion
No community discussion yet for this question.