Fortinet FCP_FGT_AD-7.6 Questions & Answers

Verify IKE version during tunnel vendor onboarding reduces recurrence of ike version compatibility, rather than the observed ike local identifier mismatch issue. The relevant preventive control for Northbridge Biotechnology is: Document local and remote IDs alongside tunnel credentials. This distinction matters because iKE identity checks can fail even when packets reach the correct remote public endpoint.

Revalidate MTU when adding additional tunnel encapsulation reduces recurrence of ipsec vpn mtu and fragmentation, rather than the observed ike local identifier mismatch issue. The relevant preventive control for Northbridge Biotechnology is: Document local and remote IDs alongside tunnel credentials. This distinction matters because iKE identity checks can fail even when packets reach the correct remote public endpoint.

Retire legacy crypto exceptions by agreed migration dates reduces recurrence of vpn crypto policy hardening, rather than the observed ike local identifier mismatch issue. The relevant preventive control for Northbridge Biotechnology is: Document local and remote IDs alongside tunnel credentials. This distinction matters because iKE identity checks can fail even when packets reach the correct remote public endpoint.

Update approved phase-two selectors and corresponding policy and route objects on both ends is a relevant remedy for a DIFFERENT problem—ipsec traffic selector after subnet growth—when a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. In this Northbridge Distribution case that is not the failing component. Here the correct intervention is to install a valid permitted IKE identity certificate and trusted chain with protected private key because certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

Correct reciprocal static or dynamic routes and preserve the intended stateful path is a relevant remedy for a DIFFERENT problem—ipsec asymmetric vpn egress—when return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. In this Northbridge Distribution case that is not the failing component. Here the correct intervention is to install a valid permitted IKE identity certificate and trusted chain with protected private key because certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

Use independent permitted underlays or peer paths and verify resilience across failure domains is a relevant remedy for a DIFFERENT problem—redundant vpn split provider design—when two site-to-site IPsec tunnels terminate on the same failing ISP despite being labeled primary and backup. In this Northbridge Distribution case that is not the failing component. Here the correct intervention is to install a valid permitted IKE identity certificate and trusted chain with protected private key because certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

A negotiated child SA handles only the protected prefixes permitted by its selectors explains a different situation, ipsec traffic selector after subnet growth, where a branch adds an application VLAN but the tunnel only encrypts the original LAN subnet. It does not account for the specific observed certificate-authenticated ipsec condition at Northbridge Distribution. The decisive mechanism here is: Certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

Route-based IPsec depends on consistent forward and return routing through the negotiated security context explains a different situation, ipsec asymmetric vpn egress, where return packets from an internal server follow an internet default route instead of the incoming route-based VPN tunnel. It does not account for the specific observed certificate-authenticated ipsec condition at Northbridge Distribution. The decisive mechanism here is: Certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

Two logical tunnel interfaces sharing one upstream circuit do not protect against that circuit failure explains a different situation, redundant vpn split provider design, where two site-to-site IPsec tunnels terminate on the same failing ISP despite being labeled primary and backup. It does not account for the specific observed certificate-authenticated ipsec condition at Northbridge Distribution. The decisive mechanism here is: Certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

A test from the newly approved subnet is encrypted and reaches the remote application would validate the separate control ipsec traffic selector after subnet growth, not the fault reported for Northbridge Distribution. To confirm this correction, the team instead needs: A supervised connection authenticates with the renewed certificate and a revoked test identity fails. That is the observable check related to certificate-authenticated ipsec.

A bidirectional test flow returns on the virtual tunnel interface with accepted session state would validate the separate control ipsec asymmetric vpn egress, not the fault reported for Northbridge Distribution. To confirm this correction, the team instead needs: A supervised connection authenticates with the renewed certificate and a revoked test identity fails. That is the observable check related to certificate-authenticated ipsec.

A physical carrier outage leaves the independent tunnel serving approved traffic would validate the separate control redundant vpn split provider design, not the fault reported for Northbridge Distribution. To confirm this correction, the team instead needs: A supervised connection authenticates with the renewed certificate and a revoked test identity fails. That is the observable check related to certificate-authenticated ipsec.

Reconcile site address inventories with VPN selectors after subnet additions reduces recurrence of ipsec traffic selector after subnet growth, rather than the observed certificate-authenticated ipsec issue. The relevant preventive control for Northbridge Distribution is: Monitor VPN identity certificate expiry and CA trust. This distinction matters because certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

Review reciprocal route tables after changing branch prefixes reduces recurrence of ipsec asymmetric vpn egress, rather than the observed certificate-authenticated ipsec issue. The relevant preventive control for Northbridge Distribution is: Monitor VPN identity certificate expiry and CA trust. This distinction matters because certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

Track transport diversity and avoid false redundancy assumptions reduces recurrence of redundant vpn split provider design, rather than the observed certificate-authenticated ipsec issue. The relevant preventive control for Northbridge Distribution is: Monitor VPN identity certificate expiry and CA trust. This distinction matters because certificate-based VPN peer authentication depends on issuer trust, validity and identity matching.

Allow the specifically required UDP IKE and NAT-T transport between the authorized peer addresses is a relevant remedy for a DIFFERENT problem—ike transport port restriction—when iPsec initiation fails because a new upstream access rule blocks required IKE or NAT-T UDP traffic. In this Northbridge Public Schools case that is not the failing component. Here the correct intervention is to align a secure supported phase-two PFS configuration on both FortiGates because pFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

Configure a supported BGP adjacency across the route-based IPsec interface with controlled prefix filtering is a relevant remedy for a DIFFERENT problem—ipsec bgp over virtual tunnel—when an organization wants multiple changing site networks reachable over an IPsec interface but maintains dozens of fragile static routes. In this Northbridge Public Schools case that is not the failing component. Here the correct intervention is to align a secure supported phase-two PFS configuration on both FortiGates because pFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

Correlate IKE negotiation logs, tunnel SA state, route entries and policy traffic logs for the exact test is a relevant remedy for a DIFFERENT problem—vpn session log interpretation—when a reported site-to-site outage has only generic firewall deny events and no clear IKE or IPsec event correlation. In this Northbridge Public Schools case that is not the failing component. Here the correct intervention is to align a secure supported phase-two PFS configuration on both FortiGates because pFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

IKE requires reachability to negotiation sockets before any protected data SA can be created explains a different situation, ike transport port restriction, where iPsec initiation fails because a new upstream access rule blocks required IKE or NAT-T UDP traffic. It does not account for the specific observed ipsec phase-two pfs agreement condition at Northbridge Public Schools. The decisive mechanism here is: PFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

Dynamic routing can exchange changing protected prefixes while the IPsec tunnel supplies encrypted transport explains a different situation, ipsec bgp over virtual tunnel, where an organization wants multiple changing site networks reachable over an IPsec interface but maintains dozens of fragile static routes. It does not account for the specific observed ipsec phase-two pfs agreement condition at Northbridge Public Schools. The decisive mechanism here is: PFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

A generic blocked-flow log cannot alone establish whether the tunnel negotiation or firewall rule caused failure explains a different situation, vpn session log interpretation, where a reported site-to-site outage has only generic firewall deny events and no clear IKE or IPsec event correlation. It does not account for the specific observed ipsec phase-two pfs agreement condition at Northbridge Public Schools. The decisive mechanism here is: PFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

A supervised negotiation reaches the peer and produces an established IKE SA would validate the separate control ike transport port restriction, not the fault reported for Northbridge Public Schools. To confirm this correction, the team instead needs: The child SA negotiates using the approved group and protected subnet traffic succeeds. That is the observable check related to ipsec phase-two pfs agreement.

Authorized routes are learned across the tunnel and a supervised prefix update converges would validate the separate control ipsec bgp over virtual tunnel, not the fault reported for Northbridge Public Schools. To confirm this correction, the team instead needs: The child SA negotiates using the approved group and protected subnet traffic succeeds. That is the observable check related to ipsec phase-two pfs agreement.

A reproduced fault produces a clear matching IKE or policy decision with timestamps would validate the separate control vpn session log interpretation, not the fault reported for Northbridge Public Schools. To confirm this correction, the team instead needs: The child SA negotiates using the approved group and protected subnet traffic succeeds. That is the observable check related to ipsec phase-two pfs agreement.

Include VPN transport ports in ISP firewall change tests reduces recurrence of ike transport port restriction, rather than the observed ipsec phase-two pfs agreement issue. The relevant preventive control for Northbridge Public Schools is: Coordinate cryptographic suite changes across tunnel peers. This distinction matters because pFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

Monitor BGP neighbor health and filter accidental prefix advertisements reduces recurrence of ipsec bgp over virtual tunnel, rather than the observed ipsec phase-two pfs agreement issue. The relevant preventive control for Northbridge Public Schools is: Coordinate cryptographic suite changes across tunnel peers. This distinction matters because pFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

Use a structured troubleshooting record for all VPN incidents reduces recurrence of vpn session log interpretation, rather than the observed ipsec phase-two pfs agreement issue. The relevant preventive control for Northbridge Public Schools is: Coordinate cryptographic suite changes across tunnel peers. This distinction matters because pFS group disagreement can prevent a compatible child SA even after IKE phase one completes.

Review child-SA selectors, tunnel routes and interface firewall policies in the correct sequence is a relevant remedy for a DIFFERENT problem—phase-one up but no payload traffic—when both peers show an established IKE SA yet applications fail because no relevant phase-two or firewall policy state exists. In this Northbridge Insurance case that is not the failing component. Here the correct intervention is to use the correct FortiOS security-policy model for the chosen IPsec tunnel type because policy-based and route-based IPsec have different policy and interface matching requirements.

Edit the supported wizard-created address objects and policies to the complete approved site scope is a relevant remedy for a DIFFERENT problem—vpn wizard group policy permissions—when a newly created wizard tunnel is reachable from one internal subnet but the wizard-generated policy does not include the second authorized subnet. In this Northbridge Insurance case that is not the failing component. Here the correct intervention is to use the correct FortiOS security-policy model for the chosen IPsec tunnel type because policy-based and route-based IPsec have different policy and interface matching requirements.

Configure supported split-tunnel selectors or client routes limited to approved corporate networks is a relevant remedy for a DIFFERENT problem—split tunnel protection for remote vpn—when a remote IPsec client is routed through headquarters for every internet destination although company policy only requires private application prefixes. In this Northbridge Insurance case that is not the failing component. Here the correct intervention is to use the correct FortiOS security-policy model for the chosen IPsec tunnel type because policy-based and route-based IPsec have different policy and interface matching requirements.

IKE control-channel establishment is not equivalent to permitted encrypted application forwarding explains a different situation, phase-one up but no payload traffic, where both peers show an established IKE SA yet applications fail because no relevant phase-two or firewall policy state exists. It does not account for the specific observed policy-based versus route-based vpn condition at Northbridge Insurance. The decisive mechanism here is: Policy-based and route-based IPsec have different policy and interface matching requirements.

A wizard's initial example selectors and permit addresses may not match every required protected network explains a different situation, vpn wizard group policy permissions, where a newly created wizard tunnel is reachable from one internal subnet but the wizard-generated policy does not include the second authorized subnet. It does not account for the specific observed policy-based versus route-based vpn condition at Northbridge Insurance. The decisive mechanism here is: Policy-based and route-based IPsec have different policy and interface matching requirements.

Tunnel selector and route scope decide which client packets use the encrypted corporate path explains a different situation, split tunnel protection for remote vpn, where a remote IPsec client is routed through headquarters for every internet destination although company policy only requires private application prefixes. It does not account for the specific observed policy-based versus route-based vpn condition at Northbridge Insurance. The decisive mechanism here is: Policy-based and route-based IPsec have different policy and interface matching requirements.