Fortinet Fortinet Certified Professional Network Security FCSS_EFW_AD-7.6 New Questions

VXLAN (Virtual Extensible LAN) is an overlay network technology that extends Layer 2 networks over Layer 3 infrastructure. When VXLAN is used extensively on FortiGate, hardware acceleration is crucial for maintaining performance.

● NP7 (Network Processor 7) is Fortinet’s latest network processor designed to accelerate high-performance networking features, including:

● VXLAN encapsulation/decapsulation

● IPsec VPN offloading

● Firewall policy enforcement

● Advanced threat protection at wire speed

NP7 significantly reduces latency and improves throughput when handling VXLAN traffic, making it the best choice for large-scale VXLAN deployments.

When configuring ADVPN (Auto-Discovery VPN) to connect overlay networks across different hubs using IBGP and EBGP, special configurations are required to allow spokes from different overlay networks to dynamically establish tunnels.

● set auto-discovery-crossover enable

● This allows cross-hub tunnel discovery in an ADVPN deployment where multiple hubs are used.

● Since Hub A and Hub B belong to different overlays, enabling crossover discovery ensures that spokes from one overlay can dynamically create direct tunnels to spokes in the other overlay when needed.

● set enforce-multihop enable

● This setting ensures that BGP peers using loopback interfaces can establish connectivity even if they are not directly connected.

● Multihop BGP sessions are required when using loopback addresses as BGP peer sources because the connection might need to traverse multiple routers before reaching the BGP neighbor.

● This is especially useful in ADVPN deployments with multiple hubs, where routes might need to cross from one hub to another.

From the BGP neighbor status output, the key issue is that BGP is stuck in the "Idle" state, meaning the FortiGate is unable to establish a BGP session with its peer 100.65.4.1 (Remote AS 65300).

The output also shows:

● "Not directly connected EBGP" → This means the BGP peer is not on the same subnet, requiring multihop BGP.

● "Update source is Loopback" → Since a loopback interface is used, FortiGate must be configured to allow BGP neighbors over multiple hops.

To resolve this issue, the administrator must enable ebgp-enforce-multihop, which allows BGP sessions to be established even when the neighbors are not directly connected.

The Internet Service Database (ISDB) in FortiGate is used to enforce content filtering at Layer 3 (Network Layer) and Layer 4 (Transport Layer) of the OSI model by identifying applications based on their predefined IP addresses and ports.

FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard:

● FortiGate retrieves and updates a predefined list of IPs and ports for different internet services from FortiGuard.

● This allows FortiGate to block specific services at Layer 3 and Layer 4 without requiring deep packet inspection.

The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard:

● ISDB works by matching traffic to known IP addresses and ports of categorized services.

● When an application or service is blocked, FortiGate prevents communication by denying traffic based on its destination IP and port number.