Exam NSE7_EFW-7.0 topic 1 question 14 discussion

Actual exam question from Fortinet's NSE7_EFW-7.0

Question #: 14
Topic #: 1

An administrator has configured two FortiGate devices for an HA cluster. While testing HA failover, the administrator notices that some of the switches in the network continue to send traffic to the former primary device.
What can the administrator do to fix this problem?

A. Configure remote link monitoring to detect an issue in the forwarding path.
B. Configure set send-garp-on-failover enable under config system ha on both cluster members.
C. Verify that the speed and duplex settings match between the FortiGate interfaces and the connected switch ports.
D. Configure set link-failed-signal enable under config system ha on both cluster members.

Show Suggested Answer

Suggested Answer: D 🗳️

by Alaba at Jan. 3, 2023, 11:28 a.m.

Comments

Submit Cancel

LiliRose

Highly Voted 1 year, 10 months ago

Selected Answer: D

Virtual MAC Address and Failover - The new primary broadcasts Gratuitous ARP packets to notify the network that each virtual MAC is now reachable through a different switch port. - Some high-end switches might not clear their MAC table correctly after a failover - Solution: Force former primary to shut down all its interfaces for one second when the failover happens (excluding heartbeat and reserved management interfaces): #Config system ha set link-failed-signal enable end - This simulates a link failure that clears the related entries from MAC table of the switches.

upvoted 7 times

...

myrmidon3

Most Recent 4 months, 2 weeks ago

Selected Answer: D

After an HA failover, Gratuitous ARP (GARP) packets are sent by the new primary FortiGate to update the switches' MAC forwarding tables. However, some switches, especially high-end ones, might not update their MAC tables correctly, even after receiving GARPs. To address this, you can use the command: config system ha set link-failed-signal enable end This command forces the former primary FortiGate to shut down its interfaces for one second (except heartbeat and reserved management interfaces). This simulates a link failure, causing the switches to clear their MAC table entries and correctly redirect traffic to the new primary.

upvoted 1 times

...