Fortinet Exam FCP_FGT_AD-7.4 Topic 7 Question 5 Discussion

Actual exam question for Fortinet's FCP_FGT_AD-7.4 exam

Question #: 5
Topic #: 7

Refer to the exhibit.

A network administrator is troubleshooting an IPsec tunnel between two FortiGate devices. The administrator has determined that phase 1 failed to come up. The administrator has also re-entered the pre-shared key on both FortiGate devices to make sure they match.

Based on the phase 1 configuration and the diagram shown in the exhibit, which two configuration changes can the administrator make to bring phase 1 up? (Choose two.)

AOn HQ-FortiGate, disable Diffie-Helman group 2.

BOn Remote-FortiGate, set port2 as Interface.

COn both FortiGate devices, set Dead Peer Detection to On Demand.

DOn HQ-FortiGate, set IKE mode to Main (ID protection).

Show Suggested Answer

Suggested Answer: B, D

by Joni at Sep 12, 2024, 12:47 AM

Limited Time Offer

25%

Off

Get Premium FCP_FGT_AD-7.4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Alexis

2 months ago

I agree with Amie. Option C is the most logical choice here. Of course, if all else fails, you could always try turning it off and on again. That usually works, right?

upvoted 0 times

...

Amie

2 months ago

Ha! Setting port2 as the interface on the Remote-FortiGate? That's like trying to fit a square peg in a round hole. I'd go with option C and set the Dead Peer Detection to On Demand on both devices.

upvoted 0 times

Micaela

30 days ago

Definitely, let's try that configuration change on both devices.

upvoted 0 times

...

Sheridan

1 months ago

Yeah, Dead Peer Detection on demand seems like the way to go.

upvoted 0 times

...

Viola

1 months ago

I agree, setting port2 as the interface doesn't make sense.

upvoted 0 times

...

Kathrine

2 months ago

Good call. Let's make that change and see if phase 1 comes up.

upvoted 0 times

...

Shantay

2 months ago

Yeah, let's go with option C and see if that fixes the issue.

upvoted 0 times

...

Xochitl

2 months ago

I agree, setting port2 as the interface doesn't seem right.

upvoted 0 times

...

Kip

2 months ago

Option C sounds like a good idea. Dead Peer Detection might help.

upvoted 0 times

...

Thersa

2 months ago

I'm not sure about option C though. Dead Peer Detection might not be the issue here.

upvoted 0 times

...

Naomi

3 months ago

Hmm, I'm not sure. Disabling Diffie-Helman group 2 on the HQ-FortiGate seems like it could work, but I'd have to double-check the compatibility between the two devices.

upvoted 0 times