Exam NSE4_FGT-7.2 topic 1 question 65 discussion

Actual exam question from Fortinet's NSE4_FGT-7.2

Question #: 65
Topic #: 1

Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

A. On both FortiGate devices, set Dead Peer Detection to On Demand.
B. On HQ-FortiGate, set IKE mode to Main (ID protection).
C. On HO-FortiGate, disable Diffie-Helman group 2.
D. On Remote-FortiGate, set port2 as Interface.

Show Suggested Answer

Suggested Answer: BD 🗳️

by Takumi at July 16, 2023, 4:31 a.m.

Comments

Submit Cancel

AMK2ENG

1 year, 7 months ago

B. On HQ-FortiGate, set IKE mode to Main (ID protection). D. On Remote-FortiGate, set port2 as Interface.

upvoted 2 times

...

Jumpy007

1 year, 10 months ago

Selected Answer: BD

FortiGate Infrastructure 7.2 study guide page 250 last paragraph.

upvoted 2 times

Mocix

1 year, 4 months ago

Settings on both ends must agree; otherwise, phase 1 negotiation fails and both IPsec peers are not able to establish a secure channel.

upvoted 1 times

...

raydel92

1 year, 10 months ago

Selected Answer: BD

B. On HQ-FortiGate, set IKE mode to Main (ID protection). D. On Remote-FortiGate, set port2 as Interface. "In IKEv1, there are two possible modes in which the IKE SA negotiation can take place: main, and aggressive mode. Settings on both ends must agree; otherwise, phase 1 negotiation fails and both IPsec peers are not able to establish a secure channel." Reference and download study guide: https://ebin.pub/fortinet-fortigate-infrastructure-study-guide-for-fortios-72.html

upvoted 3 times

...

e359166

1 year, 12 months ago

Selected Answer: BD

FortiGate Security 7.2 study guide page 250 In IKEv1, there are two possible modes in which the IKE SA negotiation can take place: mail and aggressive mode. The settings on both ends must agree; otherwise, phase 1 negotiation fails and both IPsec peers are not able to establish a secure channel. Note: on the network diagram, port 2 is used on the remote Fortigate so the answer is B & D

upvoted 4 times

cyberfriends

1 year, 11 months ago

It is page 250 for Infrastructure study guide 7.2

upvoted 2 times

...

Takumi

2 years ago

Selected Answer: BD

The answer are B and D

upvoted 2 times

...