These practice questions are original and hand-written as a personal aid while studying for the Fortinet NSE8 exam. Content may or may not be applicable to any specific exam levels, but may be useful for the NSE4, NSE7, NSE8, FCP, or FCSS FortiGate exams. No questions are pulled from actual exams. Content is sourced from and fact-checked via official Fortinet Documentation.
Question 1
What will happen to traffic matching the following route?config router policy
edit 1
set src "10.250.4.5/255.255.255.255"
set dst "142.251.111.0/255.255.255.0"
set action deny
next
end
Show Answer and Explanation
Answer:
The standard routing table (RIB) will be used to evaluate the traffic
Explanation:
The deny action, depicted in the Policy-Based Route GUI by the Stop Policy Routing Action, and when applied to a policy, will force any matched traffic to stop being evaluated by any policy routing (PBRs, ISDB Static Routes, or SD-WAN rules) and go straight to being evaluated by the standard routing table (RIB).
Question 2
BGP isn’t coming up between your two FortiGates that are connected via an IPsec tunnel called “Hub-and-Spoke”, which has been verified as up and able to pass traffic. What can be configured to bring BGP up between the two FortiGates?
Firewall 1 (AzFW01) Configurations and Diagnostics:AzFW01 (10.100.1.1/32) # show
config system interface
edit "10.100.1.1/32"
set vdom "root"
set vrf 20
set ip 10.100.1.1 255.255.255.255
set allowaccess ping
set type loopback
set role lan
next
endAzFW01 (bgp) # show
config router bgp
set as 100
config neighbor
edit "10.200.1.1"
set soft-reconfiguration enable
set interface "10.100.1.1/32"
set remote-as 100
set update-source "10.100.1.1/32"
next
end
config network
edit 1
set prefix 10.250.0.0 255.255.0.0
next
edit 2
set prefix 10.100.1.1 255.255.255.255
next
end
Firewall 2 (AzFW02) Configurations and Diagnostics:AzFW02 (BGP Loopback) # show
config system interface
edit "BGP Loopback"
set vdom "root"
set vrf 20
set ip 10.200.1.1 255.255.255.255
set allowaccess ping
set type loopback
set role lan
next
endAzFW02 (bgp) # show
config router bgp
set as 100
config neighbor
edit "10.100.1.1"
set soft-reconfiguration enable
set interface "BGP Loopback"
set remote-as 100
set update-source "BGP Loopback"
next
end
config network
edit 1
set prefix 10.251.0.0 255.255.0.0
next
edit 2
set prefix 10.200.1.1 255.255.255.255
next
end
Show Answer and Explanation
Answer:
On both FortiGates’ BGP loopback interfaces (labeled “10.100.1.1/32 and BGP Loopback), set vrf 0
Explanation:
Out of all the listed options, the answer above is the only change that will allow BGP to come up between the FortiGates. The base issue is that the BGP loopback interfaces (“10.100.1.1/32” and “BGP Loopback”, sorry for the confusing names here, they’re both functioning as BGP loopbacks) on both FortiGates cannot reach each other. The question states that the devices are connected via an IPsec tunnel called Hub-and-Spoke, which from the routing table on both FortiGates show, resides in VRF 0. The BGP loopback interfaces themselves reside in VRF 20.
On both FortiGates, a static route via Hub-and-Spoke to the peer’s loopback IP
This is already configured on both FortiGates, as seen by the route table entries for 10.100.1.1/32 and 10.200.1.1/32 in VRF 0.
BGP VRF route leaking from VRF 0 into VRF 20
This would add the single VRF 0 routes into the VRF 20 routing table, but only once BGP is up.
On both FortiGates, set ebgp-enforce-multihop enable on the neighbor configuration, change AzFW02’s AS to 200, and AzFW01’s neighbor AS to 100
These steps would configure eBGP, but the eBGP peering would still not come up due to the VRF issue.
On both FortiGates, enabling the redistribution of all static and connected routes into BGP
This would allow each FortiGate’s static and connected routes to be redistributed into BGP, but because BGP is not up and sharing routes, no redistribution would yet occur.
Question 3
Which of the following interfaces will be used for traffic to 55.55.55.55/32?
Show Answer and Explanation
Answer:
Proxy-VLAN
Explanation:
This is a simple administrative distance (AD) and static route priority order question. All routes are identical in destination, so the route with the lowest AD will be selected. As a tiebreaker between static routes with the same AD, the route with the lowest priority will be selected. If two static routes share the same destination, AD, and priority, they will be ECMP load-balanced.
With this said, the order of priority for the listed routes is:
Proxy-VLAN > asymVPN > Captive > 10.200.2.1/24
Question 4
Your FortiGate has the following configurations. Which of the following packet types will be evaluated by firewall policies and require an allow policy match to pass through the FortiGate?config system settings
set asymroute enable
set asymroute-icmp enable
end
Show Answer and Explanation
Answer:
TCP SYN packets
UDP packets
Explanation:
TCP SYN packets are not part of an existing session and will always require a firewall policy to pass.
UDP packets are always checked by firewall policies, regardless of whether they’re part of an existing session or not.
The asymroute and asymroute-icmp configurations do not change either of the above facts.
TCP non-SYN packets that are part of an existing session, by the nature of stateful firewalls like FortiGate, do not require a firewall policy match to pass.
TCP non-SYN packets that are NOT part of an existing session, when asymroute is enabled, are punted to the CPU and no firewall or security inspection will occur.
ICMP packets that are part of an existing session, by the nature of stateful firewalls like FortiGate, do not require a firewall policy to pass.
ICMP packets that are NOT part of an existing session, when asymroute-icmp is enabled, are punted to the CPU and no firewall or security inspection will occur.
Question 5
With the policy route and full routing table shown in the images below, users are reporting that App Store web traffic is failing. Which of the following configurations is most likely to remediate the issue?
Show Answer and Explanation
Answer:
Adding a default static route via the Outside interface
Explanation:
Policy-based routes, like SD-WAN routes, are only functional if there is a route in the RIB via the specified outgoing interface. The route table shows no routes to public/internet IPs. Adding a default route (0.0.0.0/0) via the Outside interface would allow for the policy-based route to function.
Setting the gateway address on the policy-based route to the Outside interface’s WAN gateway is not required for a policy-based route to function. When only the outgoing interface is specified, FortiGate will do a RIB lookup for the gateway address matching interface.
Removing the Apple-App.Store internet service and instead specifying the Apple App Store well known FQDNs as the destination address will have no effect on the functionality of the policy route, other than changing which destinations are matched. Traffic will still not be able to reach the Apple App Store without a route to the public internet.
Changing the source port to 443 and destination port to 0 – 65535 will break the functionality of this policy-based route even further. Port 443 for web/HTTPS traffic is a destination port. When packets are sent for HTTPS web traffic, they are destined to 443 and sourced from a random ephemeral port (typically between 49152 and 65535). With 443 set as the source port, this PBR will only match when the random source port happens to be 443, which it never would.
Question 6
With the following configurations, you notice that SNMP polling and testing via SNMP walks is failing. You’ve verified your SNMP server is configured correctly to point to 10.250.4.4 and your SNMP community string matches. Which of the following changes are most likely to fix the SNMP issue?config system ha
set mode a-p
set group-name "HA"
set password ENC [Redacted Password]
set hbdev "port2" 0
set override enable
set priority 255
set ha-mgmt-status enable
config ha-mgmt-interface
edit 1
set interface port2
next
end
end
config system interface
edit "port2"
set vdom "root"
set ip 10.250.4.4 255.255.255.0
set allowaccess ping https ssh fgfm fabric snmp
set type physical
next
end
config system snmp sysinfo
set status enable
set description "AzFW01"
end
config system snmp community
edit 1
set name "Monitoring"
config hosts
edit 1
set ip 192.168.50.10 255.255.255.255
next
end
next
end
Show Answer and Explanation
Answer:
In the SNMP host 1 settings, set ha-direct enable
Explanation:
The configuration in the question shows port2 acting as both the HA management interface and the target interface for SNMP polling. When ha-mgmt-status is enable and an HA management interface specified, that interface will not allow SNMP polling against it, unless ha-direct has been enabled on either the global HA settings or the SNMP host settings.
Question 7
You notice that the following session is not being offloaded to hardware like it’s supposed to be. Which configuration change should you make to resolve this?
Show Answer and Explanation
Answer:
config vpn ipsec phase1-interface
edit Dial-Up
set npu-offload enable
next
end
Explanation:
The key out from the session table list here is no_ofld_reason: disabled-by-policy. This offload failure reason will only appear when auto-asic-offload is disabled. Re-enabling the setting will resolve the offload failure reason.
set npu-offload disable on the Phase 1 VPN configuration would create the npu-flag-off offload failure reason. Therefore set npu-offload enable would not resolve the offload failure reason.
set np-accel-mode none would disable NTurbo and would not produce the disabled-by-policy offload failure reason. Therefore set np-accel-mode basic would not resolve the offload failure reason.
set cp-accel-mode none would disable IPSA and would not produce the disabled-by-policy offload failure reason. Therefore set cp-accel-mode basic would not resolve the offload failure reason.
Question 8
Based on the following session information, which of the following is configured on this FortiGate?
session info: proto=6 proto_state=02 duration=10 expire=2 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ tun_id=0.0.0.0/172.203.132.222 vlan_cos=0/255
state=log may_dirty f00 f02
statistic(bytes/packets/allow_err): org=180/3/1 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=19->4/4->19 gwy=0.0.0.0/0.0.0.0
hook=pre dir=org act=noop 172.20.0.1:2067->10.251.4.5:139(0.0.0.0:0)
hook=post dir=reply act=noop 10.251.4.5:139->172.20.0.1:2067(0.0.0.0:0)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=7 pol_uuid_idx=15878 auth_info=0 chk_client_info=0 vd=0
serial=00003299 tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfwid=n/a
npu_state=0x000100
no_ofld_reason: npu-flag-off
hrx info: valid=0/0, qid=0/0, npuid=0/0, sublink=0/0
reflect info 0:
dev=19->4/4->19
npu_state=0x000400
npu info: flag=0x91/0x00, offload=8/0, ips_offload=0/0, epid=129/0, ipid=142/0, vlan=0x0017/0x0000
vlifid=142/0, vtag_in=0x0017/0x0000 in_npu=1/0, out_npu=1/0, fwd_en=0/0, qid=4/0
total reflect session num: 1
Question 9
Which of the routes listed above will be ECMP load-balanced with the route via Proxy-VLAN?
Show Answer and Explanation
Answer:
None of the above
Explanation:
For ECMP load-balancing to occur with static routes on FortiGate, the routes must have the same Distance (AD) and Priority. The question asks which route will be load-balanced with the first route, which carries an AD of 10 and Priority of 10. None of the listed routes also have an AD of 10 and Priority of 10.
Question 10
You configure the following policy-based route to use port1 for your FortiGate’s FortiGuard ISDB update traffic. After analyzing logs and hit count on the configured policy route, you determine that outbound traffic is still using the incorrect interface. What is the best reason as to why this is occurring?
Show Answer and Explanation
Answer:
Local-out traffic is not evaluated by policy-based routes
Explanation:
The above answer is the best reason the policy-based route is not being used, and will never be used. FortiGate FortiGuard ISDB updates are considered local-out traffic and will never match a PBR. The FortiGate’s local-out settings should be used to customize the outbound interface for this traffic.
There is no incoming interface set
An incoming interface on a PBR is not required to match traffic.
There is not a RIB entry to FortiGuard servers via port1
This would break traffic matching this PBR, but the PBR will never be matched because local-out traffic is not evaluated by PBRs.
The firewall is not licensed to download ISDB updates from FortiGuard
This would stop ISDB updates from succeeding, but not the policy from matching.
Leave a Reply