NSE7_EFW-7.0 Questions and Answers

The local router has received a total of three BGP prefixes from all peers.

The local router has not established a TCP session with 100.64.3.1.

Since the counters were last reset, the 10.200.3.1 peer has never been down.

The local router BGP state is OpenConfirm with the 10.127.0.75 peer.

IPS will scan every byte in every session.

FortiGate will spawn IPS engine instances based on the system load.

New packets will be passed through without inspection if the IPS socket buffer runs out of memory.

IPS will use the faster matching algorithm which is only available for units with more than 4 GB memory.

This is an expected session created by a session helper.

Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.0.1.10.

Traffic in the original direction (coming from the IP address 10.171.122.38) will be routed to the next-hop IP address 10.200.1.1.

This is an expected session created by an application control profile.

FortiGate uses the CN information from the Subject field in the server certificate.

FortiGate uses the first entry listed in the SAN field in the server certificate.

FortiGate uses the SNI from the user's web browser.

FortiGate closes the connection because this represents an invalid SSL/TLS configuration.

The existing session table entry has been updated with the app_id and the firewall policy table needs to be checked for a match.

The application or URL category is unknown and needs to be rescanned by the IPS engine to try to identify the Layer 7 details.

The URL category for this session has been updated by FortiGuard and the session needs to be checked against the policy again to ensure proper web filtering is applied.

Traffic has been identified as coming from an application that is not allowed and the relevant replacement message needs to be displayed to the user, if configured.

The administrator must also run the command diagnose debug enable.

The administrator must enable the following real-time debug: diagnose debug application ipsec -1.

The log-filter setting is incorrect. The VPN traffic does not match this filter.

The debug shows only error messages. If there is no output, then the phase 1 and phase 2 configurations match.

The local gateway has configured less secure encryption and hashing algorithms compared to the remote gateway.

The Diffie-Hellman group does not match on the local and remote gateways.

The proposal ID does not match between local and remote gateways.

The encapsulation method for phase 2 is set to none on local and remote gateways.

The local router's BGP state is Established with the 10.125.0.60 peer.

Since the counters were last reset; the 10.200.3.1 peer has never been down.

The local router has received a total of three BGP prefixes from all peers.

The local router has not established a TCP session with 100.64.3.1.

IPS inspection is affected when FortiGate enters FD conserve mode.

A FortiGate enters FD conserve mode when the amount of available description is less than 5%.

FD conserve mode affects all daemons running on the device.

Restarting the WAD process is required to leave FD conserve mode.

It was created by the FortiGate kernel to allow push updates from FotiGuard.

It is for management traffic terminating at the FortiGate.

It is for traffic originated from the FortiGate.

It was created by a session helper or ALG.

Enable the redistribution of connected routers into BGP.

Enable the redistribution of static routers into BGP.

Disable the setting network-import-check.

Enable the setting ebgp-multipath.

FortiManager can download and maintain local copies of FortiGuard databases.

FortiManager supports only FortiGuard push to managed devices.

FortiManager will respond to update requests only if they originate from a managed device.

FortiManager does not support rating requests.

It sends an ARP packet to all connected devices, indicating that the HA virtual MAC address is reachable through a new master after a failover.

It sends a link failed signal to all connected devices.

It disabled all the non-heartbeat interfaces in all HA members for two seconds after a failover.

It forces the former primary device to shut down all its non-heartbeat interfaces for one second, while the failover occurs.

They are used to filter real-time debugs.

They display real-time application debugs.

Some of them display statistics and configuration information about a feature or process.

Some of them can be used to restart an application.

To enable IPS bypass mode

To disable the IPS engine

To restart all IPS engines and monitors

To provide information regarding IPS sessions

It is currently in system conserve mode because of high CPU usage.

It is currently in FD conserve mode.

It is currently in kernel conserve mode because of high memory usage.

It is currently in system conserve mode because of high memory usage.

route-reflector enable

route-reflector-server enable

route-reflector-client enable

route-reflector-peer enable

The local router has a different AS number than the remote peer.

The local router is receiving BGP keepalives from the remote peer, but the local peer has not received the openConfirm yet.

The local router initiated the BGP session to 10.200.3.1 but did not receive a response.

The router 10.200.3.1 has authentication configured for BGP and the local router does not.

10.0.1.240

One of the public FortiGuard distribution servers

10.0.1.244

10.0.1.242