NSE4_FGT-7.0 · Question #38
View the exhibit. Which of the following statements are correct? (Choose two.)
The correct answer is C. The TunnelB route is the primary route for reaching the remote site. The TunnelA route is used D. This is a redundant IPsec setup. This IPsec configuration represents a redundant setup where multiple tunnels provide high availability, with TunnelB designated as the primary route for traffic to the remote site.
Question
View the exhibit. Which of the following statements are correct? (Choose two.)
Exhibit
Options
- AThis setup requires at least two firewall policies with the action set to IPsec.
- BDead peer detection must be disabled to support this type of IPsec setup.
- CThe TunnelB route is the primary route for reaching the remote site. The TunnelA route is used
- DThis is a redundant IPsec setup.
How the community answered
(18 responses)- A33% (6)
- B17% (3)
- C50% (9)
Why each option
This IPsec configuration represents a redundant setup where multiple tunnels provide high availability, with TunnelB designated as the primary route for traffic to the remote site.
Firewall policies for route-based IPsec VPNs typically use an 'ACCEPT' action to allow traffic through the tunnel interface, not an 'IPsec' action, and the specific number of policies can vary.
Dead Peer Detection (DPD) is crucial for redundant IPsec setups as it quickly detects when a peer is unreachable, enabling faster failover to a secondary tunnel rather than being disabled.
In a redundant IPsec setup, multiple tunnels connect to the same remote destination. Designating TunnelB as the primary route means it has a better metric (e.g., lower administrative distance or cost) and is preferred for traffic, with TunnelA serving as a backup.
A redundant IPsec setup involves configuring multiple IPsec tunnels to the same destination to provide fault tolerance and high availability. If one tunnel fails, traffic automatically switches to the other, ensuring continuous connectivity.
Concept tested: IPsec VPN redundancy and failover
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/464810/redundant-ipsec-vpn
Topics
Community Discussion
No community discussion yet for this question.
