FCSS_NST_SE-7.6 Exam Dumps : Fortinet NSE 6 - Network Security 7.6 Support Engineer

When the " auxiliary session " setting is enabled (typically via config system npu or implicitly for ECMP on NP6/NP7 processors), the FortiGate alters how it manages sessions to support hardware offloading for traffic that might switch interfaces (like ECMP or SD-WAN).

B. FortiGate accelerates all ECMP traffic to the NP6 processor:

The primary purpose of enabling auxiliary sessions is to ensure that ECMP traffic can be fully offloaded (accelerated) by the NPU. Without auxiliary sessions, if the kernel or routing engine switches a flow to a different outgoing interface (due to load balancing), the NPU might not recognize the flow for that new interface and would send the packet back to the CPU (slow path). Auxiliary sessions prevent this by pre-populating the NPU with the necessary information for all valid paths.

D. FortiGate creates two sessions in case of a routing change:

Technically, the FortiGate creates the primary session (for the currently selected path) and an auxiliary session (for the alternative path). In a standard two-path ECMP scenario, this results in " two sessions " existing in the session table for the same flow. This ensures that if a routing change occurs (e.g., the flow shifts to the second path), the traffic continues to be processed by the NPU without interruption or re-evaluation by the CPU.

The correct answers are C and D .

The study guide’s get vpn ipsec tunnel details example shows:

replay: enabled

inbound and outbound sections with separate SPIs

NPU acceleration: encryption(outbound) decryption(inbound) and it labels these as “Phase 2 SAs for each direction” and “Hardware acceleration”

This directly proves D. Anti-replay is enabled , because the output explicitly says replay: enabled

For the NPU status, the study guide explains the exact npu_flag meanings:

npu_flag=00 = both IPsec SAs loaded to the kernel

npu_flag=01 = outbound IPsec SA copied to NPU

npu_flag=02 = inbound IPsec SA copied to NPU

npu_flag=03 = both outbound and inbound IPsec SAs copied to NPU

Because the exhibit shows hardware acceleration in both directions — encryption(outbound) and decryption(inbound) — the matching npu_flag is 03 , not 02. That makes C correct and A incorrect.

Why B is wrong:

The same study guide output labels the tunnel as having Phase 2 SAs for each direction , so different inbound and outbound SPIs are normal for the two SAs. Also, the FortiOS administration guide explains that auto-negotiate controls whether phase 2 SA negotiation is initiated automatically, not whether inbound and outbound SPIs are different: “By default the phase 2 security association (SA) is not negotiated until a peer attempts to send data… Auto-negotiate initiates the phase 2 SA negotiation automatically…”

So the verified answers are: C, D .