NSE7-NST-7-2: Fortinet NSE 7 - Network Security 7.2 Support EngineerDemo

By Fortinet · Question Mode

QuestionQ9

Network Security Support Engineer

Refer to the exhibit, which shows partial output from an IKE real-time debug.

Question Image

The administrator cannot access the remote gateway. Based on the debug output, which configuration change can the administrator make on the local gateway to resolve the Phase 1 negotiation error?

  • A In the phase 1 proposal configuration, add AESCBC-SHA2 to the list of encryption algorithms.
  • B In the phase 1 proposal configuration, add AES256-SHA256 to the list of encryption algorithms.
  • C In the phase 1 proposal configuration, add AES128-SHA128 to the list of encryption algorithms.
  • D In the phase 1 network configuration, set the IKE version to 2.
Explanation

Phase 1 requires a proposal that matches the peer on encryption, integrity/hash algorithm, and Diffie-Hellman group. The remote peer offers AES-256 with SHA2-256 and DH group 2048 or 1536, while the local gateway offers AES-128 with SHA. Adding AES256-SHA256 to the local Phase 1 proposal provides a matching proposal.

Community Discussion

No comments yet. Be the first to start the discussion!