Independence Day Deal! Unlock 25% OFF Today – Limited-Time Offer - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Fortinet Exam NSE7_LED-7.0 Topic 3 Question 27 Discussion

Actual exam question for Fortinet's NSE7_LED-7.0 exam
Question #: 27
Topic #: 3
[All NSE7_LED-7.0 Questions]

Refer to the exhibit.

Examine the IPsec VPN phase 1 configuration shown in the exhibit

An administrator wants to use certificate-based authentication for an IPsec VPN user

Which three configuration changes must you make on FortiGate to perform certificate-based authentication for the IPsec VPN user? (Choose three)

Show Suggested Answer Hide Answer
Suggested Answer: C, D

According to the FortiManager Administration Guide, ''Central management mode allows you to manage all FortiSwitch devices from a single interface on the FortiManager device.'' Therefore, option C is true because the exhibit shows that the FortiSwitch manager is enabled and the FortiSwitch device is managed by the FortiManager device. Option D is also true because the exhibit shows that the FortiSwitch device status is offline, which means that it is not reachable by the FortiManager device, but it is authorized, which means that it has been added to the FortiManager device. Option A is false because per-device management mode allows you to manage each FortiSwitch device individually from its own web-based manager or CLI, which is not the case in the exhibit. Option B is false because the FortiSwitch device is authorized, as explained above.


Contribute your Thoughts:

Buddy
1 months ago
Main mode for ID protection? Sounds like we're playing spy games with our VPN now. Hope the user's certificate doesn't get revoked while I'm in the field!
upvoted 0 times
Bette
1 days ago
B) In the IKE section of the IPsec VPN tunnel, in the Mode field, select Main (ID protection).
upvoted 0 times
...
Rolf
3 days ago
A) Create a PKI user for the IPsec VPN user, and then configure the IPsec VPN tunnel to accept the PKI user as peer certificate.
upvoted 0 times
...
...
Tommy
2 months ago
Wait, XAUTH? I thought this was supposed to be certificate-based, not username/password-based. Guess I'll skip that one.
upvoted 0 times
Arlean
1 months ago
User 3: Don't forget to configure the IPsec VPN tunnel to accept the PKI user as peer certificate.
upvoted 0 times
...
Margart
1 months ago
User 2: I think we should focus on creating a PKI user and importing the CA for certificate-based authentication.
upvoted 0 times
...
Rodolfo
1 months ago
User 1: You're right, XAUTH is for username/password authentication.
upvoted 0 times
...
...
Judy
2 months ago
Signature authentication, huh? Well, that's a fancy way of saying 'use a certificate instead of a password'.
upvoted 0 times
...
Lachelle
2 months ago
Ah, so I need to import the CA that signed the user's certificate. Makes sense, otherwise FortiGate won't trust it.
upvoted 0 times
...
Gertude
2 months ago
Hmm, looks like I need to create a PKI user and configure the VPN tunnel to accept it. Gotta remember that one.
upvoted 0 times
Gerry
12 days ago
User4: And don't forget to create a PKI user for the IPsec VPN user.
upvoted 0 times
...
Breana
15 days ago
User3: Make sure to select Main (ID protection) in the IKE section of the IPsec VPN tunnel.
upvoted 0 times
...
Lenna
28 days ago
User2: Yeah, that's important for certificate-based authentication.
upvoted 0 times
...
Catalina
1 months ago
User1: Don't forget to import the CA that signed the user certificate.
upvoted 0 times
...
...
Nikita
2 months ago
And don't forget to select Main (ID protection) in the IKE section of the IPsec VPN tunnel.
upvoted 0 times
...
Izetta
2 months ago
Yes, we also need to import the CA that signed the user certificate.
upvoted 0 times
...
Nikita
3 months ago
I think we need to create a PKI user for the IPsec VPN user.
upvoted 0 times
...

Save Cancel
az-700  pass4success  az-104  200-301  200-201  cissp  350-401  350-201  350-501  350-601  350-801  350-901  az-720  az-305  pl-300  

Warning: Cannot modify header information - headers already sent by (output started at /pass.php:70) in /pass.php on line 77