NSE4 · Question #448
Which of the following combinations of two FortiGate device configurations (side A and side B), can be used to successfully establish an IPsec VPN between them? (choose two)
The correct answer is B. Side A:main mode, remote gateway as static IP address, policy based VPN. Side B: C. Side A:main mode, remote gateway as static IP address, policy based VPN. Side B:. Successful IPsec VPN establishment requires compatible configurations on both FortiGate devices regarding VPN mode, remote gateway type, and VPN type (policy-based or route-based).
Question
Which of the following combinations of two FortiGate device configurations (side A and side B), can be used to successfully establish an IPsec VPN between them? (choose two)
Options
- ASide A:main mode, remote gateway as static IP address, policy based VPN. Side B:
- BSide A:main mode, remote gateway as static IP address, policy based VPN. Side B:
- CSide A:main mode, remote gateway as static IP address, policy based VPN. Side B:
- DSide A: main mode, remote gateway as dialup policy based VPN, Side B: main mode, remote
How the community answered
(39 responses)- A8% (3)
- B79% (31)
- D13% (5)
Why each option
Successful IPsec VPN establishment requires compatible configurations on both FortiGate devices regarding VPN mode, remote gateway type, and VPN type (policy-based or route-based).
The Side B configuration provided is incomplete, making it impossible to determine if the combination would be successful for IPsec VPN establishment.
This combination allows a static IP gateway on Side A to establish a policy-based VPN with a dialup user on Side B, as both sides are configured for main mode and policy-based VPN, ensuring compatible settings.
This combination also allows a static IP gateway on Side A to establish a route-based VPN with a dialup user on Side B, as both sides are configured for main mode and route-based VPN, ensuring compatible settings for tunnel establishment.
Side A's configuration as a 'dialup policy based VPN' when also defining a 'remote gateway as dialup policy based VPN' is contradictory, as dialup VPNs typically await connections, and the description is malformed for a peer definition.
Concept tested: IPsec VPN configuration compatibility (FortiGate)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/453198/ipsec-vpn
Topics
Community Discussion
No community discussion yet for this question.