Fortinet Exam NSE7_NST-7.2 Topic 1 Question 4 Discussion

Actual exam question for Fortinet's NSE7_NST-7.2 exam

Question #: 4
Topic #: 1

Exhibit.

Refer to the exhibit, which contains partial output from an IKE real-time debug.

The administrator does not have access to the remote gateway.

Based on the debug output, which configuration change can the administrator make to the local gateway to resolve the phase 1 negotiation error?

AIn the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.

BIn the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

CIn the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.

DIn the phase 1 network configuration, set the IKE version to 2.

Show Suggested Answer

Suggested Answer: B

Analyzing Debug Output:

The debug output shows multiple proposals with encryption algorithms like AES CBC and hashing algorithms like SHA256.

The negotiation failure (no SA proposal chosen) suggests that there is a mismatch in the encryption or hashing algorithms between the local and remote gateways.

Configuration Change:

To resolve the phase 1 negotiation error, the local gateway needs to include a compatible proposal.

Adding AES256-SHA256 to the phase 1 proposal configuration ensures that both gateways have a matching set of encryption and hashing algorithms.

Fortinet Documentation: Configuring IPsec Tunnels (Fortinet Docs) (Welcome to the Fortinet Community!).

Fortinet Community: Troubleshooting IKE Negotiation Failures (Welcome to the Fortinet Community!) (Welcome to the Fortinet Community!).

by Chantell at May 30, 2024, 10:17 AM

Limited Time Offer

25%

Off

Get Premium NSE7_NST-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rosita

5 months ago

Hey, at least the admin has access to the debug output. That's more than most of us have when troubleshooting VPNs!

upvoted 0 times

...

5 months ago

C) AES128-SHA128? What is this, the stone age? Get with the times, man!

upvoted 0 times

Lovetta

5 months ago

B) In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.

upvoted 0 times

...

Billy

5 months ago

A) In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.

upvoted 0 times

...

6 months ago

I think the answer is A) In the phase 1 proposal configuration, add AESCBC-SHA2.

upvoted 0 times

...