nerdexam
Fortinet

NSE4_FGT-7.0 · Question #38

View the exhibit. Which of the following statements are correct? (Choose two.)

The correct answer is C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used D. This is a redundant IPsec setup. This IPsec configuration represents a redundant setup where multiple tunnels provide high availability, with TunnelB designated as the primary route for traffic to the remote site.

VPN

Question

View the exhibit. Which of the following statements are correct? (Choose two.)

Exhibit

NSE4_FGT-7.0 question #38 exhibit

Options

  • AThis setup requires at least two firewall policies with the action set to IPsec.
  • BDead peer detection must be disabled to support this type of IPsec setup.
  • CThe TunnelB route is the primary route for reaching the remote site. The TunnelA route is used
  • DThis is a redundant IPsec setup.

How the community answered

(18 responses)
  • A
    33% (6)
  • B
    17% (3)
  • C
    50% (9)

Why each option

This IPsec configuration represents a redundant setup where multiple tunnels provide high availability, with TunnelB designated as the primary route for traffic to the remote site.

AThis setup requires at least two firewall policies with the action set to IPsec.

Firewall policies for route-based IPsec VPNs typically use an 'ACCEPT' action to allow traffic through the tunnel interface, not an 'IPsec' action, and the specific number of policies can vary.

BDead peer detection must be disabled to support this type of IPsec setup.

Dead Peer Detection (DPD) is crucial for redundant IPsec setups as it quickly detects when a peer is unreachable, enabling faster failover to a secondary tunnel rather than being disabled.

CThe TunnelB route is the primary route for reaching the remote site. The TunnelA route is usedCorrect

In a redundant IPsec setup, multiple tunnels connect to the same remote destination. Designating TunnelB as the primary route means it has a better metric (e.g., lower administrative distance or cost) and is preferred for traffic, with TunnelA serving as a backup.

DThis is a redundant IPsec setup.Correct

A redundant IPsec setup involves configuring multiple IPsec tunnels to the same destination to provide fault tolerance and high availability. If one tunnel fails, traffic automatically switches to the other, ensuring continuous connectivity.

Concept tested: IPsec VPN redundancy and failover

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/464810/redundant-ipsec-vpn

Topics

#Redundant IPsec#VPN#Static routes#Failover routing

Community Discussion

No community discussion yet for this question.

Full NSE4_FGT-7.0 Practice