NSE4_FGT-7.0 · Question #15
An administrator is configuring an Ipsec between site A and site B. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is…
The correct answer is B. 192.168.2.0/24. In an IPSec VPN, the local quick mode selector on one site must match the remote quick mode selector on the peer site.
Question
An administrator is configuring an Ipsec between site A and site B. The Remotes Gateway setting in both sites has been configured as Static IP Address. For site A, the local quick mode selector is 192.16.1.0/24 and the remote quick mode selector is 192.16.2.0/24. How must the administrator configure the local quick mode selector for site B?
Options
- A192.168.3.0/24
- B192.168.2.0/24
- C192.168.1.0/24
- D192.168.0.0/8
How the community answered
(19 responses)- A5% (1)
- B79% (15)
- C5% (1)
- D11% (2)
Why each option
In an IPSec VPN, the local quick mode selector on one site must match the remote quick mode selector on the peer site.
192.168.3.0/24 is an arbitrary network not identified as either Site A's or Site B's network in the provided configuration.
For an IPSec VPN tunnel, the network defined as the 'remote quick mode selector' on Site A (192.16.2.0/24) represents the network behind Site B. Therefore, Site B's 'local quick mode selector' must be configured as 192.16.2.0/24 to correctly define its local subnet for the VPN tunnel.
192.168.1.0/24 is the local quick mode selector for Site A, and would be Site B's remote quick mode selector, not its local one.
192.168.0.0/8 is a very broad network range that does not specifically identify Site B's local network based on the provided selectors.
Concept tested: IPSec VPN Quick Mode Selectors configuration
Source: https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/133095/vpn-ipsec-tunnels
Topics
Community Discussion
No community discussion yet for this question.