Exam NSE7_EFW-7.0 topic 1 question 29 discussion

Actual exam question from Fortinet's NSE7_EFW-7.0

Question #: 29
Topic #: 1

Refer to the exhibit, which contains a screenshot of some phase 1 settings.

The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands to an SSH session on FortiGate: diagnose vpn ike log-filter dst-addr4 10.0.10.1 diagnose debug application ike -1
However, the IKE real-time debug does not show any output. Why?

A. The administrator must also run the command diagnose debug enable.
B. The administrator must enable the following real-time debug: diagnose debug application ipsec -1.
C. The log-filter setting is incorrect. The VPN traffic does not match this filter.
D. The debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.

Show Suggested Answer

Suggested Answer: A 🗳️

by Nappel at Jan. 12, 2023, 5:47 p.m.

Comments

Submit Cancel

Nappel

Highly Voted 1 year, 1 month ago

Selected Answer: A

Seems like A is the correct answer. diag vpn ike log-filter dst-addr4 is correct. https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPSec-VPN-Diagnostics-Possible-reasons/ta-p/192006

upvoted 8 times

...