ExamGecko
Search Search Login
Home Home / Fortinet / NSE7_NST-7.2
Question list
Search
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Which exchange lakes care of DoS protection in IKEv2?
Refer to the exhibit, which shows the omitted output of a real-time OSPF debug Which statement is false?
Exhibit. Refer to the exhibit, which shows partial outputs from two routing debug commands. Why is the port 2 default route not in the second command output?
Refer to the exhibit, which shows the omitted output of FortiOS kernel slabs. Which statement is true?
Which two conditions would prevent a static route from being added to the routing table? (Choose two.)
Refer to the exhibit, which shows a truncated output of a real-time LDAP debug. What two conclusions can you draw from the output? (Choose two.)
There are four exchanges during IKEv2 negotiation. Which sequence is correct?
Refer to the exhibits, which show the configuration on FortiGate and partial session information for internet traffic from a user on the internal network. If the priority on route ID _ were changed from 10 to 0, what would happen to traffic matching that user session?
Exhibit. Refer to the exhibit, which shows the omitted output of diagnose npu np6 port-list on a FortiGate1500D. An administrator is unable to analyze traffic flowing between port1 and port7 using the diagnose sniffer command. Which two commands allow the administrator to view the traffic? (Choose two.) A) B) C) D)
Which three conditions are required for two FortiGate devices to form an OSPF adjacency? (Choose three.)

Question 36 - NSE7_NST-7.2 discussion

Report
Export

Exhibit.

Refer to the exhibit, which contains partial output from an IKE real-time debug.

The administrator does not have access to the remote gateway.

Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

A.
In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.
Answers
A.
In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.
B.
In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.
Answers
B.
In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.
C.
In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.
Answers
C.
In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.
D.
In the phase 1 network configuration, set the IKE version to 2.
Answers
D.
In the phase 1 network configuration, set the IKE version to 2.
Suggested answer: B

Explanation:

Analyzing Debug Output:

The debug output shows multiple proposals with encryption algorithms like AES CBC and hashing algorithms like SHA256.

The negotiation failure (no SA proposal chosen) suggests that there is a mismatch in the encryption or hashing algorithms between the local and remote gateways.

Configuration Change:

To resolve the phase 1 negotiation error, the local gateway needs to include a compatible proposal.

Adding AES256-SHA256 to the phase 1 proposal configuration ensures that both gateways have a matching set of encryption and hashing algorithms.

Fortinet Documentation: Configuring IPsec Tunnels (Fortinet Docs) (Welcome to the Fortinet Community!).

Fortinet Community: Troubleshooting IKE Negotiation Failures (Welcome to the Fortinet Community!) (Welcome to the Fortinet Community!).

Show Answer
asked 18/09/2024
Ismaiel Al-Mufleh
47 questions
PreviousPreviousNextNext
User
Your answer:
0 comments
Sorted by

Leave a comment first

ExamGecko

Copyright @2023 ExamGecko | All right reserved

Mail us: [email protected]
About us
Contact us
Twitter X
Facebook
Medium
Convert VPLUS to PDF
Open VPLUS files Easily and Quickly
Privacy Policy
Disclaimer
Terms