NSE7-EFW-7-2 Sample Questions & Answers

Certain features, by their nature, require CPU processing and are incompatible with hardware acceleration. Per-IP traffic shaping is one such feature. It requires the FortiGate CPU to track and manage bandwidth for each individual IP address, preventing the session from being offloaded to the NP7 processor. To enable offloading, a shared traffic shaper would need to be used instead.

When an OSPF adjacency is stuck in the ExStart/Exchange state, it indicates that the routers are failing to exchange Database Description (DBD) packets successfully. A common cause for this is a mismatched Maximum Transmission Unit (MTU) on the interfaces. If one router sends a DBD packet larger than the other router's interface MTU, the packet will be dropped, and the exchange process cannot complete. Mismatched area IDs or authentication keys would prevent the adjacency from forming at an earlier stage.

Policy Blocks are a FortiManager feature specifically designed for this purpose. They allow an administrator to define a standard, centralized set of policies while also creating placeholders (Policy Blocks) where device-level or group-level policies can be inserted. This provides a hierarchical policy structure, enabling a balance between global standardization and local customization without needing separate policy packages or ADOMs.

For a route-based VPN, even if the tunnel (Phase 1 and Phase 2) is successfully established, traffic will not flow unless two other conditions are met. First, there must be firewall policies that explicitly allow traffic from the local network to the VPN interface and vice-versa. Second, the FortiGate's routing table must have a static or dynamic route that directs traffic destined for the remote network to use the virtual IPsec interface as its gateway. Since the tunnel is already up, Phase 1 and Phase 2 settings are likely correct.

Modern applications, including P2P clients, heavily use SSL/TLS encryption to obfuscate their traffic. Application control can only inspect the content of traffic it can see. By enabling a 'deep-inspection' SSL/SSH Inspection profile on the firewall policy, the FortiGate can decrypt the traffic, allowing the application control engine to accurately identify and block the underlying P2P application. Without decryption, the engine can only rely on less reliable indicators like IP addresses or certificate information.

The most efficient and scalable solution is to place both the HQ and retail devices in the Global ADOM, which allows management of devices from different ADOMs under a single policy framework. A single policy package can be created containing policies for both HQ and retail. The key is to use installation targets. The social media blocking policy would have its installation target set to the device group containing the 200 retail stores, ensuring it is only installed on those devices. The marketing access policy would be targeted to the HQ device. This avoids ADOM sprawl and simplifies management.

The BGP path selection process follows a specific order of attributes. One of the earliest and most influential attributes is LOCAL_PREF. A higher LOCAL_PREF value is always preferred. In this scenario, Peer A's route has a LOCAL_PREF of 150, which is higher than Peer B's 100. Therefore, the router will select the path through Peer A, regardless of the shorter AS_PATH from Peer B. The AS_PATH length is considered much later in the selection process.

The primary purpose of session pickup (session-pickup enable) is to provide stateful failover. It synchronizes the session tables from the primary unit to the secondary unit. In the event of a failover, the new primary unit will have information about existing TCP connections, UDP sessions, and IPsec tunnels, allowing them to continue without being dropped. This prevents users from having to re-authenticate or re-establish connections.

The 'AUTHENTICATION_FAILED' error during the IKE_AUTH exchange in IKEv2 with certificates typically means the peer could not validate the certificate it received. The most common reason is that the responding FortiGate is missing the certificate of the Certificate Authority (CA) that signed the initiator's certificate. Without the trusted CA certificate, the responder cannot verify the signature on the initiator's certificate and thus rejects the authentication attempt. Mismatched proposals would fail earlier in the IKE_SA_INIT phase.

This statement is false. When a policy package is installed, a policy marked as 'disabled' in FortiManager is still pushed to the managed FortiGate. On the FortiGate, it will exist in the configuration but will be in a disabled state (set status disable). This is useful for pre-staging policies that can be enabled later without requiring another push from FortiManager.