Which CLI command do you use to perform real-time troubleshooting for ADVPN negotiation?

1. A. get router info routing-table all
2. B. diagnose debug application ike
3. C. diagnose vpn tunnel list
4. D. get ipsec tunnel list

Correct Answer: B

Exhibit.

Which conclusion about the packet debug flow output is correct?

1. A. The total number of daily sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
2. B. The packet size exceeded the outgoing interface MTU.
3. C. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the traffic shaper, and the packet was dropped.
4. D. The number of concurrent sessions for 10.1.10.1 exceeded the maximum number of concurrent sessions configured in the firewall policy, and the packet was dropped.

Correct Answer: C

Refer to the exhibit, which shows the IPsec phase 1 configuration of a spoke.

What must you configure on the IPsec phase 1 configuration for ADVPN to work with SD-WAN?

1. A. You must set ike-version to 1.
2. B. You must enable net-device.
3. C. You must enable auto-discovery-sender.
4. D. You must disable idle-timeout.

Correct Answer: B

Refer to the exhibits.
Exhibit A

Exhibit B -

Exhibit A shows the SD-WAN performance SLA and exhibit B shows the SD-WAN member status, the routing table, and the performance SLA status.
If port2 is detected dead by FortiGate, what is the expected behavior?

1. A. Port2 becomes alive after three successful probes are detected.
2. B. FortiGate removes all static routes for port2.
3. C. The administrator manually restores the static routes for port2, if port2 becomes alive.
4. D. Host 8.8.8.8 is reachable through port1 and port2.

Correct Answer: B
This is due to Update static route is enable which removes the static route entry referencing the interface if the interface is dead

Which two statements describe how IPsec phase 1 main mode is different from aggressive mode when performing IKE negotiation? (Choose two )

1. A. A peer ID is included in the first packet from the initiator, along with suggested security policies.
2. B. XAuth is enabled as an additional level of authentication, which requires a username and password.
3. C. A total of six packets are exchanged between an initiator and a responder instead of three packets.
4. D. The use of Diffie Hellman keys is limited by the responder and needs initiator acceptance.

Correct Answer: BC