Exam NSE7_NST-7.2 topic 1 question 2 discussion

Actual exam question from Fortinet's NSE7_NST-7.2

Question #: 2
Topic #: 1

Refer to the exhibit.

FortiGate has already been configured with a firewall policy that allows all ICMP traffic to flow from port1 to port3.
Which changes must the administrator perform to ensure the server at 10.4.0.1/24 receives the echo reply from the laptop at 10.1.0.1/24?

A. Enable asymmetric routing under config system settings.
B. Modify the default gateway on the laptop from 10.1.0.2 to 10.2.0.2.
C. A firewall policy that allows all ICMP traffic from port3 to port1.
D. Change the configuration from strict RPF check mode to feasible RPF check mode.

Show Suggested Answer

Suggested Answer: A 🗳️

by tuky88 at Dec. 9, 2024, 7:17 p.m.

Comments

Submit Cancel

evdw

5 months, 2 weeks ago

Selected Answer: A

If a FortiGate recognizes the response packets, but not the requests, it blocks the packets as invalid. This is asymmetric routing. By default, a FortiGate blocks packets or drops the session when this happens. FortiGate can be configured to permit asymmetric routing

upvoted 2 times

...

tuky88

5 months, 3 weeks ago

Selected Answer: A

See page 371 in the Network Support Engineer Study Guide - By default - if an echo request does not pass through Fortigate but the response does, the packet is dropped. There are scenarios where this might be needed, you can then use the "set asymroute enable" in "config system settings".

upvoted 2 times

...