NSE7-NST-7-2: Fortinet NSE 7 - Network Security 7.2 Support EngineerDemo

Question

Refer to the exhibit, which shows the output of diagnose vpn tunnel list.

Question Image

Which command captures ESP traffic for the VPN named DialUp_0?

A diagnose sniffer packet any 'host 10.0.10.10'
B diagnose sniffer packet any 'ip proto 50'
C diagnose sniffer packet any 'esp and host 10.200.3.2'
D diagnose sniffer packet any 'port 4500'

Explanation

NAT Traversal encapsulates ESP traffic in UDP. Because the tunnel uses local UDP port 4500, filtering on port 4500 captures the NAT-T-encapsulated ESP traffic. Native ESP filtering with IP protocol 50 applies only when ESP is not UDP-encapsulated.

Learn more

Tunneling protocol and encapsulation | FortiGate / FortiOS Administration Guide

NSE7-NST-7-2: Fortinet NSE 7 - Network Security 7.2 Support EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ6

Community Discussion