NSE4 · Question #96
You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using route- based mode. Users from either side must be able to initiate new sessions. There is only 1 subnet at…
The correct answer is B. Create two firewall policies. C. Add a route to the remote subnet. The question asks for two required configuration steps for a route-based IPsec VPN to allow bidirectional traffic initiation between two subnets, given a default route already exists.
Question
You are the administrator in charge of a FortiGate acting as an IPsec VPN gateway using route- based mode. Users from either side must be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate already has a default route. Which two configuration steps are required to achieve these objectives? (Choose two.)
Options
- ACreate one firewall policy.
- BCreate two firewall policies.
- CAdd a route to the remote subnet.
- DAdd two IPsec phases 2.
How the community answered
(45 responses)- A18% (8)
- B73% (33)
- D9% (4)
Why each option
The question asks for two required configuration steps for a route-based IPsec VPN to allow bidirectional traffic initiation between two subnets, given a default route already exists.
Creating only one firewall policy would restrict traffic flow to a single direction, preventing users from initiating sessions from both sides.
For bidirectional traffic to flow through a route-based IPsec VPN, separate firewall policies are typically required for each direction: one from the local LAN to the VPN tunnel interface and another from the VPN tunnel interface to the local LAN, enabling traffic initiation from both sides.
For the FortiGate to know how to reach the specific remote subnet through the IPsec tunnel interface, a static route pointing to the remote subnet via the virtual IPsec tunnel interface must be explicitly added, ensuring traffic is correctly directed into the VPN tunnel.
A single Phase 2 configuration is typically sufficient for a basic route-based VPN between two subnets, defining the encryption and authentication for the traffic traversing the tunnel.
Concept tested: Route-based IPsec VPN configuration (policies, routing)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/52643/example-configuring-a-route-based-vpn
Topics
Community Discussion
No community discussion yet for this question.