NSE7-EFW-7-0 Fortinet NSE 7 - Enterprise Firewall 7.0 Practice Questions

The diagnose firewall iprope lookup command simulates the path a packet would take through the FortiGate's forwarding plane. It uses the provided parameters (source IP, destination IP, protocol, source port, destination port, and source interface) to determine which route in the FIB (Forwarding Information Base) and which firewall policy would match this specific traffic flow. It is a powerful tool for verifying both routing and policy configuration for a hypothetical packet without actually sending traffic.

Spokes use NHRP registration messages to inform the hub (which acts as the Next Hop Server) of their public 'underlay' IP address and the corresponding 'overlay' VPN tunnel IP address. This builds a dynamic mapping database on the hub.

When one spoke needs to build a direct shortcut tunnel to another, it sends an NHRP resolution request to the hub. The hub uses its registration database to look up the public IP of the destination spoke and sends this information back to the requesting spoke, enabling the direct tunnel negotiation.

Since the domains change dynamically, URL-based or category-based filtering is unreliable. The best approach is to use Application Control. If a pre-defined signature exists for the application, it can be allowed. If not, a custom application signature can be created based on unique patterns in the application's traffic (like hostnames, user agents, or other headers). This allows for precise control of the application itself, regardless of its IP or domain, without weakening the 'Proxy Avoidance' web filter category for all other traffic.

True. When session-pickup is enabled, the primary unit synchronizes its session table with the secondary unit(s). This includes both connection-oriented TCP sessions and connectionless UDP and ICMP sessions. After a failover, the new primary unit has a copy of the session table and can continue processing the existing traffic without requiring sessions to be re-established.

This condition is called a split-brain. It occurs when the HA cluster members can no longer communicate with each other over the heartbeat link. When the slave unit stops receiving heartbeat packets from the master, it assumes the master has failed and promotes itself to master. The result is two active master units, both trying to process traffic, which can cause severe network instability. The root cause is almost always a physical or logical failure of the heartbeat link (e.g., a disconnected cable, a failed switch port, or a VLAN misconfiguration).

The OSPF ExStart state indicates that the devices have established two-way communication but are failing to exchange database description (DBD) packets. A common reason for this failure on broadcast networks is an MTU mismatch between the interfaces, which prevents the larger DBD packets from being successfully exchanged. Mismatched area IDs or router IDs would prevent the adjacency from even reaching the ExStart state, and mismatched hello timers would result in a state flapping between Down and Init or 2-Way.

For ADVPN to function, the advpn option must be enabled in the IPsec Phase 1 configuration on all participating spokes. If it's disabled on the new spoke, it will not attempt to create dynamic shortcut tunnels.

The auto-discovery-sender setting on a spoke's Phase 1 allows it to initiate shortcut offers to other spokes. If this is disabled, the spoke cannot trigger the creation of a spoke-to-spoke tunnel, which matches the described symptom.

BGP Graceful Restart allows a BGP speaker to inform its neighbors of its impending restart (or in this case, a failover). The neighbors will then retain the routes learned from the restarting speaker for a specified period, preventing the forwarding table from being cleared. This allows traffic to continue flowing while the BGP sessions are re-established on the newly active cluster member, minimizing disruption. session-pickup is for user sessions, not control plane protocols like BGP.

When snat-route-change is disabled (the default setting), FortiOS does not re-evaluate the route for existing sessions when the routing table changes. The session is tied to its original egress interface and next-hop. Therefore, the existing session will continue to use Route 1, even though it is no longer the preferred route, until the session naturally concludes or times out. New sessions would use the new best route (Route 2).

A 'commit failure' typically means that FortiManager successfully sent the configuration to the FortiGate, but the FortiGate itself rejected the configuration when trying to commit it to its running config. This is often due to a syntax error, a reference to a non-existent object (like an interface or address object that doesn't exist on that specific FortiGate), or a feature that is not supported by the device's specific hardware model or license.