Fortinet FCP_FGT_AD-7.6 Questions & Answers

IKE identity checks can fail even when packets reach the correct remote public endpoint explains a different situation, ike local identifier mismatch, where an upstream NAT hides the initiating FortiGate's public address and the responder expects an IKE identity different from the presented local ID. It does not account for the specific observed dead peer detection failover condition at Northbridge Regional Hospital. The decisive mechanism here is: Old IPsec state can persist briefly unless the peer's liveliness is checked and failed paths withdrawn.

An accepting outbound policy does not necessarily create permission for independently initiated inbound flows explains a different situation, ipsec tunnel policy return direction, where the head office reaches a remote file server but the remote office cannot initiate sessions toward the head-office database. It does not account for the specific observed dead peer detection failover condition at Northbridge Regional Hospital. The decisive mechanism here is: Old IPsec state can persist briefly unless the peer's liveliness is checked and failed paths withdrawn.

No application traffic or wrong routing can look like an idle VPN without implying failed cryptographic negotiation explains a different situation, ipsec logs versus packet sniffer, where the VPN appears idle and operations guesses phase-two failure without checking whether any LAN packets enter the firewall. It does not account for the specific observed dead peer detection failover condition at Northbridge Regional Hospital. The decisive mechanism here is: Old IPsec state can persist briefly unless the peer's liveliness is checked and failed paths withdrawn.

IKE logs show accepted peer identity and a stable authenticated SA would validate the separate control ike local identifier mismatch, not the fault reported for Northbridge Regional Hospital. To confirm this correction, the team instead needs: A supervised peer outage is detected and new sessions use the approved alternative route. That is the observable check related to dead peer detection failover.

Approved remote-initiated sessions match their own permit rule while other ports remain denied would validate the separate control ipsec tunnel policy return direction, not the fault reported for Northbridge Regional Hospital. To confirm this correction, the team instead needs: A supervised peer outage is detected and new sessions use the approved alternative route. That is the observable check related to dead peer detection failover.

The trace shows the test packet entering the tunnel and an expected encrypted egress would validate the separate control ipsec logs versus packet sniffer, not the fault reported for Northbridge Regional Hospital. To confirm this correction, the team instead needs: A supervised peer outage is detected and new sessions use the approved alternative route. That is the observable check related to dead peer detection failover.

Document local and remote IDs alongside tunnel credentials reduces recurrence of ike local identifier mismatch, rather than the observed dead peer detection failover issue. The relevant preventive control for Northbridge Regional Hospital is: Rehearse dead-peer and routing failover with realistic outages. This distinction matters because old IPsec state can persist briefly unless the peer's liveliness is checked and failed paths withdrawn.

Document allowed initiation directions in VPN access contracts reduces recurrence of ipsec tunnel policy return direction, rather than the observed dead peer detection failover issue. The relevant preventive control for Northbridge Regional Hospital is: Rehearse dead-peer and routing failover with realistic outages. This distinction matters because old IPsec state can persist briefly unless the peer's liveliness is checked and failed paths withdrawn.

Maintain safe packet-capture filters and retire debug sessions promptly reduces recurrence of ipsec logs versus packet sniffer, rather than the observed dead peer detection failover issue. The relevant preventive control for Northbridge Regional Hospital is: Rehearse dead-peer and routing failover with realistic outages. This distinction matters because old IPsec state can persist briefly unless the peer's liveliness is checked and failed paths withdrawn.

Install a valid permitted IKE identity certificate and trusted chain with protected private key is a relevant remedy for a DIFFERENT problem—certificate-authenticated ipsec—when a partner requires certificate-based IKE authentication but the branch FortiGate presents an expired client identity certificate. In this Northbridge Retail Group case that is not the failing component. Here the correct intervention is to add appropriate route-based interface policies for the required local-to-VPN and return directions because an established IPsec tunnel does not override FortiGate forward-policy enforcement.

Set a mutually supported IKE version and compatible authentication proposals is a relevant remedy for a DIFFERENT problem—ike version compatibility—when an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. In this Northbridge Retail Group case that is not the failing component. Here the correct intervention is to add appropriate route-based interface policies for the required local-to-VPN and return directions because an established IPsec tunnel does not override FortiGate forward-policy enforcement.

Adjust the supported path MTU or TCP MSS behavior after measuring encapsulation overhead and PMTUD is a relevant remedy for a DIFFERENT problem—ipsec vpn mtu and fragmentation—when a file transfer fails only for larger payloads across a healthy IPsec tunnel. In this Northbridge Retail Group case that is not the failing component. Here the correct intervention is to add appropriate route-based interface policies for the required local-to-VPN and return directions because an established IPsec tunnel does not override FortiGate forward-policy enforcement.

Certificate-based VPN peer authentication depends on issuer trust, validity and identity matching explains a different situation, certificate-authenticated ipsec, where a partner requires certificate-based IKE authentication but the branch FortiGate presents an expired client identity certificate. It does not account for the specific observed route-based tunnel interface policy condition at Northbridge Retail Group. The decisive mechanism here is: An established IPsec tunnel does not override FortiGate forward-policy enforcement.

IKEv1 and IKEv2 have distinct negotiation flows and cannot always interoperate as configured explains a different situation, ike version compatibility, where an IPsec tunnel fails after one vendor peer requires IKEv2 but the FortiGate configuration is pinned to an incompatible IKE version. It does not account for the specific observed route-based tunnel interface policy condition at Northbridge Retail Group. The decisive mechanism here is: An established IPsec tunnel does not override FortiGate forward-policy enforcement.

ESP and optional NAT-T add packet overhead that can exceed the underlay path payload size explains a different situation, ipsec vpn mtu and fragmentation, where a file transfer fails only for larger payloads across a healthy IPsec tunnel. It does not account for the specific observed route-based tunnel interface policy condition at Northbridge Retail Group. The decisive mechanism here is: An established IPsec tunnel does not override FortiGate forward-policy enforcement.

A supervised connection authenticates with the renewed certificate and a revoked test identity fails would validate the separate control certificate-authenticated ipsec, not the fault reported for Northbridge Retail Group. To confirm this correction, the team instead needs: Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions. That is the observable check related to route-based tunnel interface policy.

The two devices negotiate the intended IKE version and establish the required child SA would validate the separate control ike version compatibility, not the fault reported for Northbridge Retail Group. To confirm this correction, the team instead needs: Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions. That is the observable check related to route-based tunnel interface policy.

A supervised large transfer succeeds without recurring fragmentation-related loss would validate the separate control ipsec vpn mtu and fragmentation, not the fault reported for Northbridge Retail Group. To confirm this correction, the team instead needs: Authorized LAN-to-LAN traffic matches the intended IPsec interface policy in both directions. That is the observable check related to route-based tunnel interface policy.

Monitor VPN identity certificate expiry and CA trust reduces recurrence of certificate-authenticated ipsec, rather than the observed route-based tunnel interface policy issue. The relevant preventive control for Northbridge Retail Group is: Test firewall policy scope after creating new tunnel interfaces. This distinction matters because an established IPsec tunnel does not override FortiGate forward-policy enforcement.

Verify IKE version during tunnel vendor onboarding reduces recurrence of ike version compatibility, rather than the observed route-based tunnel interface policy issue. The relevant preventive control for Northbridge Retail Group is: Test firewall policy scope after creating new tunnel interfaces. This distinction matters because an established IPsec tunnel does not override FortiGate forward-policy enforcement.

Revalidate MTU when adding additional tunnel encapsulation reduces recurrence of ipsec vpn mtu and fragmentation, rather than the observed route-based tunnel interface policy issue. The relevant preventive control for Northbridge Retail Group is: Test firewall policy scope after creating new tunnel interfaces. This distinction matters because an established IPsec tunnel does not override FortiGate forward-policy enforcement.

Align a secure supported phase-two PFS configuration on both FortiGates is a relevant remedy for a DIFFERENT problem—ipsec phase-two pfs agreement—when an IPsec child SA fails after the partner enables perfect forward secrecy using a different Diffie-Hellman group. In this Northbridge Transport Authority case that is not the failing component. Here the correct intervention is to add or correct the intended destination route through the virtual IPsec interface because an established VPN cannot carry private prefixes without routing their packets to it.

Update approved phase-two selectors and corresponding policy and route objects on both ends is a relevant remedy for a DIFFERENT problem—ipsec traffic selector after subnet growth—when a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. In this Northbridge Transport Authority case that is not the failing component. Here the correct intervention is to add or correct the intended destination route through the virtual IPsec interface because an established VPN cannot carry private prefixes without routing their packets to it.

Correct reciprocal static or dynamic routes and preserve the intended stateful path is a relevant remedy for a DIFFERENT problem—ipsec asymmetric vpn egress—when return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. In this Northbridge Transport Authority case that is not the failing component. Here the correct intervention is to add or correct the intended destination route through the virtual IPsec interface because an established VPN cannot carry private prefixes without routing their packets to it.

PFS group disagreement can prevent a compatible child SA even after IKE phase one completes explains a different situation, ipsec phase-two pfs agreement, where an IPsec child SA fails after the partner enables perfect forward secrecy using a different Diffie-Hellman group. It does not account for the specific observed ipsec tunnel static route condition at Northbridge Transport Authority. The decisive mechanism here is: An established VPN cannot carry private prefixes without routing their packets to it.

A negotiated child SA handles only the protected prefixes permitted by its selectors explains a different situation, ipsec traffic selector after subnet growth, where a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. It does not account for the specific observed ipsec tunnel static route condition at Northbridge Transport Authority. The decisive mechanism here is: An established VPN cannot carry private prefixes without routing their packets to it.

Route-based IPsec depends on consistent forward and return routing through the negotiated security context explains a different situation, ipsec asymmetric vpn egress, where return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. It does not account for the specific observed ipsec tunnel static route condition at Northbridge Transport Authority. The decisive mechanism here is: An established VPN cannot carry private prefixes without routing their packets to it.

The child SA negotiates using the approved group and protected subnet traffic succeeds would validate the separate control ipsec phase-two pfs agreement, not the fault reported for Northbridge Transport Authority. To confirm this correction, the team instead needs: A route lookup selects the tunnel and a private test packet is encrypted. That is the observable check related to ipsec tunnel static route.

A test from the newly approved subnet is encrypted and reaches the remote application would validate the separate control ipsec traffic selector after subnet growth, not the fault reported for Northbridge Transport Authority. To confirm this correction, the team instead needs: A route lookup selects the tunnel and a private test packet is encrypted. That is the observable check related to ipsec tunnel static route.

A bidirectional test flow returns on the virtual tunnel interface with accepted session state would validate the separate control ipsec asymmetric vpn egress, not the fault reported for Northbridge Transport Authority. To confirm this correction, the team instead needs: A route lookup selects the tunnel and a private test packet is encrypted. That is the observable check related to ipsec tunnel static route.

Coordinate cryptographic suite changes across tunnel peers reduces recurrence of ipsec phase-two pfs agreement, rather than the observed ipsec tunnel static route issue. The relevant preventive control for Northbridge Transport Authority is: Review tunnel routes when branch CIDRs change. This distinction matters because an established VPN cannot carry private prefixes without routing their packets to it.

Reconcile site address inventories with VPN selectors after subnet additions reduces recurrence of ipsec traffic selector after subnet growth, rather than the observed ipsec tunnel static route issue. The relevant preventive control for Northbridge Transport Authority is: Review tunnel routes when branch CIDRs change. This distinction matters because an established VPN cannot carry private prefixes without routing their packets to it.

Review reciprocal route tables after changing branch prefixes reduces recurrence of ipsec asymmetric vpn egress, rather than the observed ipsec tunnel static route issue. The relevant preventive control for Northbridge Transport Authority is: Review tunnel routes when branch CIDRs change. This distinction matters because an established VPN cannot carry private prefixes without routing their packets to it.