FCSS_EFW_AD-7.4 questions and answers

In a hub-and-spoke topology using OSPF over IPsec VPNs, thepoint-to-multipointnetwork type is necessary to establish neighbor adjacencies between the hub and spokes. This network type ensures that OSPF operates correctly without requiring a designated router (DR) and allows dynamic routing updates across the IPsec tunnels.

The Fortinet FGSP (FortiGate Session Life Support Protocol) cluster allows session synchronization between two FortiGate devices to provide seamless failover. However, ICMP (ping) is a connectionless protocol , and by default, FortiGate does not synchronize connectionless sessions unless explicitly enabled.

In the exhibit:

The command get system session list | grep icmp on FortiGate_B returns no output , meaning that ICMP sessions are not being synchronized from FortiGate_A.

If session-pickup-connectionless is disabled, FortiGate_B will not receive ICMP sessions , causing packet loss during failover.

In FortiManager pre-run CLI templates , are used in Zero-Touch Provisioning (ZTP) and Low-Touch Provisioning (LTP) to configure a FortiGate device before it is fully managed by FortiManager.

These templates apply configurations when a device is initially provisioned. Once the pre-run CLI template is executed , FortiManager automatically unassigns it from the device because it is not meant to persist like other policy configurations. This prevents conflicts and ensures that the FortiGate configuration isnot repeatedly applied after the initial setup.

In BGP (Border Gateway Protocol) , a neighbor (peer) configuration is required to establish a connection between two BGP routers. SinceFortiGate A is connecting to the ISP (Autonomous System 10) from AS 30, the administrator must define the ISP's BGP router as a neighbor .

The config neighbor command is used to: Define the ISP's IP address as a BGP peer Specify the remote AS (AS 10 in this case)
Allow BGP route exchanges between FortiGate A and the ISP

The Internet Service Database (ISDB) in FortiGate is used to enforce content filtering at Layer 3 (Network Layer) and Layer 4 (Transport Layer) of the OSI model by identifying applications based on their predefined IP addresses and ports .

FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard:

FortiGate retrieves and updates a predefined list of IPs and ports for different internet services from FortiGuard .

This allows FortiGate to block specific services at Layer 3 and Layer 4 without requiring deep packet inspection.

The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard:

ISDB works by matching traffic to known IP addresses and ports of categorized services.

When an application or service is blocked, FortiGate prevents communication bydenying traffic based on its destination IP and port number .

When multiple remote sites connect to thesame hubusingoverlapping subnets, FortiGate needs to determine which route should be used for traffic forwarding. Theroute-overlapsetting in IPsec Phase 2 allows FortiGate to handle this scenario by deciding whether to keep theexisting route(use-old) or replace it with anew route (use-new).

In anECMP (Equal-Cost Multi-Path) routing setup,both routes should be retained and balanced, but FortiGate does not supportECMP directly over overlapping routesin IPsec Phase 2. Instead, an administrator must decide which connection takes precedence usingroute-overlapsettings.

From the OSPF status output , the key information is:

"This router is an ASBR" This means the FortiGate is acting as an Autonomous System Boundary Router (ASBR) .

An ASBR is responsible for injecting external routing information into OSPF from another routing protocol (such as BGP, static routes, or connected networks).

In this ADVPN (Auto-Discovery VPN) network , there are two hubs ( Hub A and Hub B ) connected via EBGP , while IBGP is used within each overlay. To ensure proper BGP routing between the overlays, the administrator must configure specific BGP options..

set ebgp-enforce-multihop enable

By default, EBGP requires directly connected neighbors. Since Hub A and Hub B are not directly connected but reach each other over an IPsec tunnel, multihop must be enabled for EBGP sessions to work.

set next-hop-self enable
In IBGP, the next-hop attribute does not change by default. When an IBGP route is advertised from a spoke to another hub or spoke, the next-hop needs to be updated to ensure proper reachability. Enabling next-hop-self forces the BGP speaker to advertise itself as the next-hop, ensuring that all spokes properly reach routes across the overlays.