B. FortiGate automatically brings up the IPsec tunnel...
FortiGate Infrastructure 7.2 Study Guide (p.264):
"...then FortiGate might drop interesting traffic because of the absence of active SAs. To prevent this, you can enable Auto-negotiate. When you do this, FortiGate not only negotiates new SAs before the current SAs expire, but it also starts using the new SAs right away."
"Another benefit of enabling Auto-negotiate is that the tunnel comes up and stays up automatically, even when there is no interesting traffic. When you enable Autokey Keep Alive and keep Auto-negotiate disabled, the tunnel does not come up automatically unless there is interesting traffic. However, after the tunnel is up, it stays that way because FortiGate periodically sends keep alive packets over the tunnel. Note that when you enable Auto-negotiate, Autokey Keep Alive is implicitly enabled."
Reference and download study guide:
https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html
Looking at this document:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepalive/ta-p/189536
it sounds like "B" is directed at the keep-alive feature, which (AFAIK) doesn't re-establish the P2 if it is down, while D appears to be the correct answer in this case ... also that document references the fact that enabling auto-neg also implicitly activates the keep-alive feature for the tunnel ...
La respuesta correcta es B:
Another benefit of enabling Auto-negotiate is that the tunnel comes up and stays up automatically, even when there is no interesting traffic.
If the tunnel goes down, the auto-negotiate feature (when enabled) attempts to re-establish the tunnel. Auto-negotiate initiates the phase 2 SA negotiation automatically, repeating every five seconds until the SA is established.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
raydel92
Highly Voted 1 year, 10 months agoGeniusA
Most Recent 1 year, 7 months agoitzuy06
1 year, 9 months agoGarry_G
1 year, 10 months agoJumpy007
1 year, 10 months agodarkstar15
1 year, 11 months agoHalmonte0780
2 years agoexiled2019
2 years agoNiciExam
2 years agoccnax2
2 years agoDave304409
2 years agoTakumi
2 years agoLapegues
2 years agoitmaxuser
2 years agolupnoob
2 years agonambomm
2 years ago