NSE 7 SDWAN
For each managed gateway in VPN manager what do you configure (4)
-Protected subnets -Gateway role (hub, spoke, so on) -Interface where the tunnel terminates -Advanced settings (peer ID, IKE mode config)
What is fortimanager
-Single pane of glass management -Minimizes initial setup costs and ongoing operating expense of large deployments -helps maintain regulatory compliance -reduces wan usage with local fortiguard cache serve -provides centralized device management -automates device provisioning and maintains policies -provides logging and reporting Other: -mass provisioning -scheduled rollout of configuration changes -maintaining, tracking, auditing changes -provisioning firewall policies Configuration central repository -deploy and manage complex star and mesh VPNs -FDS -script and automate device provisioning, policy changes, etc
Key features of fortimanager (9)
-centralized management -administrative domains -configuration revision control and tracking -local fortiguard service -firmware management -scripting -manager panes -logging and reporting -pay as you go licensing through fortinet VM on demand program
When configuring SDWAN members what do you set the gateway to when using a DHCP/Ppoe interface
0.0.0.0
What are the quick mode selectors set to for ADVPN configuration
0.0.0.0/0
Udp session state values
00 when traffic is one way 01 when traffic is two ways
Client side states (TCP proto state numbers)
0=none 1=established 2= syn 3=SYN/ack 4=fin wait 5=time wait 6=close 7=close wait 8=last ack 9=listen
How many SDWAN interface per vdom
1
If a performance SLA has multiple SLA targets how many can be used as a "required SLA target" for the lowest cost (SLA) outgoing interface strategy
1 from the same performance SLA but multiple SLA targets can be selected
Steps to configure SDWAN in fortimanager(6)
1) Enable SDWAN in central management settings for ADOM 2) create health check servers 3) create interface members 4) configure SDWAN template (interface members, SLA with health check server, rules) 5) assign devices to template 6) configure SDWAN firewall policy with SDWAN interface
What are the five load balancing modes for IPSec tunnel aggregation
1) Round robin- traffic is balanced per packet 2) L3: traffic is balanced based on layer three header information 3) L4: traffic is balanced based on layer 4 header information 4) Redundant: all traffic is sent through the tunnel that came up first. Other tunnels used for backup 5) weighted round robin- traffic is load balanced in round robin manner based on link weights configured for each tunnel
Describe the flow that fortigate follows to select an outgoing interface based on the Lowest Cost (SLA) strategy (3)
1) SLA targets Fortigate checks SLA target requirements to slew for or eliminate any outgoing interfaces 2) cost Fortigate checks for cost as the second criteria (cost is specified on the interface when you add it to SDWAN) 3) interface preference Fortigate checks the interface preference as the third criteria (order it's listed)
Steps to configure SDWAN with zero touch deployment
1) add fortigate cloud key to forticloud 2) set up and assign a configuration template to redirect fortigate to fortimanager 3) plug in fortigate to obtain a DHCP address 4) fortigate will obtain central management config from forticloud 5) authorize fortigate In fortimanager root ADOM 6) create SDWAN template and push to fortigate
Steps for zero touch provisioning with SDWAN (fortideploy)
1) add fortigate cloud key to forticloud 2) set up the configuration template with the central management configuration to redirect the fortigate to fortimanager 3) connect fortigate to a DHCP server and turn on fortigate 4)fortigate reviews and IP from the DHCP server and established a management tunnel with forticloud 5) fortigate completes zero touch provisioning by obtaining the central management config from fortigate cloud 6) fortigate appears as an authorized device in fortimanager root ADOM 7) authorize fortigate and assign an SDWAN template 8) install the SDWAN configuration on fortigate
5 steps of zero touch provisioning with fortideploy
1) add fortigate cloud key to the fortigate cloud panel 2) set up a configuration template 3) connect to the fortigate egress port to obtain a DHCP IP address 4) fortigate receives an IP from the DHCP server and establishes a management tunnel with fortigate cloud 5) fortigate completes zero touch provisioning by obtaining configuration from the platform template in the fortigate cloud
Application aware sdwan
1) application aware - visibility into 3000+ apps and app level transaction for better SLA
Five advanced SDWAN features the fortigate offers
1) application aware - visibility into 3000+ apps and app level transaction for better SLA 2) multi path intelligence - Dynamic WAN link selection using SLA strategies and automated failover capabilities 3) multi broadband supported - Transport Independent with support for Ethernet 3G/4G and aggregates multiple interfaces into single interface 4) simplified monitoring- High level monitoring of SDWAN devices on a map and detailed application monitoring 5) certified security - most verified security such as NSS labs and high performance security processor technology
Describe ADVPN message exchange (10)
1) client behind spoke 1 generates traffic for devices located on spoke 2s network 2) spoke 1 receives packet, encrypts it and sends it to the hub 3) the hub receives the packet from spoke 1 and forwards it to spoke 2 4) spoke 2 receives the packet, decrypts it and forwards it to the destination device 5) the hub knows that a more direct tunnel option might be available from spoke 1 to spoke 2 and sends a shortcut offer message to spoke 1 6) spoke 1 acknowledges the shortcut offer by sending a shortcut query to the hub 7) the hub forwards the shortcut query message to spoke 2 8) spoke 2 acknowledges the shortcut query and sends a shortcut reply to the hub 9) the hub forwards the shortcut reply to spoke 1 10) spoke 1 and spoke 2 imitate the tunnel IKE negotiation
4 steps to configuring and using BGP tags in the SDWAN rulss
1) configure the community list 2) configure the route map and set match community and set route tag 3) configure BGP and apply the route map to the BGP neighbor 4) configure SDWAN rule and apply the the route tag
What are the steps to configure VPNs with VPN manager on fortimanager (5)
1) create a VPN community 2) add gateways (members) to the community 3) install the VPN community and gateways configuration 4) add firewall policies 5) install firewall policies
8 Steps to get SDWAN orchestrator set up and configured
1) enable SDWAN orchestrator 2) plan SDWAN network 3) create shared resources 4) create profiles for hub and edge devices 5) add fortigate devices to fortimanager 6) add devices to SDWAN orchestrator and install SDWAN configurations 7) install firewall policies to fortigate devices 8) monitor SDWAN network
Steps to use zero touch provisioning on a fortigate without internet access (5)
1) register the fortigate on fortimanager 2) connect fortigate to a DHCP server configured with option 240 or 241 with fortimanager Ip or FQDN 3) stars the fortigate 4) fortigate will be assigned an IP by DHCP server and will be provided with fortimanager information 5) fortigate will configure itself with the fortimanager IP for central a management
Routing table lookup process
1) regular policy routes - if it matches policy route traffic is forwarded if it matches policy route and action is stop policy routing fortigate checks the route cache 2) SDWAN rules 3) Route cache 4) FIB
Describe xauth exchange
1) server (responder) sends a CFG_REQUEST packet 2) client (initiator) sends a CFG_REPLY packet containing the user credentials 3) if authentication is OK the server sends a CFG_SET 4) client replies with a CFG_ACK
What 7 settings need to be changed from their default values when configuring ADVPN from fortimanager VPN manager
1) set protected networks to all 2) enable ADVPN in the IPsec phase 1 with a script 3) ensure that the add-route option is disabled on hub 4) enable net-device on spokes with a script 5) configure ip addresses on the IPSec virtual interfaces 6) configure dynamic routing and use script to enable route reflector if using IBGP 7) phase1name will be automatically created by fortimanager as phase1name_0
How many bytes in a mb
1,000,000
Range for the weight for volume and session based load balancing on a member
1-255
How long does FortiOS store the SLA metrics for each interface of every health check (link quality measurements)
10 minutes
What is the default threshold that fortigate will fail to the second link (based on interface preferences) for SDWAN strategy best quality
10%
What percentage by default will SDWAN fail to the next link when best quality is used as the SDWAN rule strategy and how can you change this default
10% Config sys virtual-wan-link Config health check Config sla Set link-cost-threshold <value>
Sum of guaranteed-bandwidth-percentage of all shaping groups in one shaping profile must be no bigger than _____
100%
kb vs KB
1000 bits vs 8000 bits 125 bytes vs 1024 bytes Kilobit vs kilobyte 1 kbit = 0.125 KB
What proto state are the kernel routes for the members participating in the performance SLA set to
17
What is the default class ID for traffic shaping groups
2
How many digits is protocol state in the session table and what do both numbers mean
2 First identifies if session is in proxy or flow (server side state) Second number identifies client side state
Multi path intelligence SDWAN
2) multi path intelligence - Dynamic WAN link selection using SLA strategies and automated failover capabilities
What class IDs are within acceptable range for traffic classification by groups
2-31
How many lookups does fortigate usually perform
2. One on first packet from originator and one on first packet from responder
What DHCP option is used to use zero touch provisioning on a fortigate without access to the internet
240 fortimanager IP 241 FMG FQDN
Multi broadband supported sdwan
3) multi broadband supported - Transport Independent with support for Ethernet 3G/4G and aggregates multiple interfaces into single interface
How many traffic shaping groups can you configure
30 2-31
For the link quality measurements, the latency and jitter that are displayed on the graph and percentages are based on the last _____ proves from the server that the performance SLA is using. The packet loss percentage is calculated from the last ________ probes from the server that the performance SLA is using.
30 probes 100 probes
How many SAs does a hub have to maintain if there are 16 remote sites
32
300kbps in kilobytes KBps
37KBps
Simplified monitoring SDWAN
4) simplified monitoring- High level monitoring of SDWAN devices on a map and detailed application monitoring
Certified security SDWAN
5) certified security - most verified security such as NSS labs and high performance security processor technology
What OS was ADVPN introduced
5.4
How many entries can the dynamic ISDB database hold
512
Explain how this per ip setting would apply to a traffic shaping policy Max band- 5000kbps Max concurrent connections- 5
5mbps per ip on the network. If there is ten users it total to 50mbs of outgoing traffic. Each user will be allocated 5mbps of max band and five concurrent sessions at a time
What FortiOS is OCVPN supported on
6.2.0 and later
Since what FortiOS does SDWAN support ADVPN
6.2.1
Default time that fortigate tries to fetch OCVPN related data from the OCVPN cloud and what is configurable range
60 minutes Configurable between 30-120 minutes
What is traffic shaping
A bandwidth management technique that prioritizes specific traffic over other traffic whose potential Loss would be less damaging attempts to normalize traffic peaks and bursts to prioritize certain flows over others Adjust how your fortigate allocate resources to different traffic types to improve the performance and stability of latency sensitive or band with intensive network applications
What is the ISDB
A database of well known internet service definitions made of public IP addresses and destination ports
What must be defined for unclassified traffic on a traffic shaping profile
A default-class-ID that way all traffic that doesn't match a group will be matched to the default class id
What is an ISDB entry made of
A direction which can be destination or source or both A reference to an IP range internal list A reference to an IP number
What happens after you have enabled SDWAN and configured the member interfaces and the load balancing method?
A logical interface called SDWAN is added to the interface list
What Is the link health monitor
A mechanism that detects when a router along the path is stopped or degraded
Describe IKE mode configuration (What is it, when does it occur, describe exchange)
A method for automatically configuring the IP settings of IPSec clients After phase 1 is up and xauth is completed, but before phase 2 the following exchange occurs 1) client sends a CFG_REQUEST message listing the required IP settings 2) server replies with a CFG_REPLY containing the assigned values for each attribute requested
What is a shared shaper
A shared shaper applied to a policy means all traffic matching the policy will share the bandwidth that is allocated. Using a shared shaper you can reserve guaranteed bandwidth as well as maximum bandwidth. Packets will be dropped if max is exceeded
What is IPsec
A suite of protocols for authenticating and encrypting traffic between two peers. the two most used protocols in the suite are: IKE which does the handshake, tunnel maintenance, and disconnection ESP, which ensures data integrity and encryption
What is SDWAN (3)
A virtual interface consisting of a group of member interfaces that can be connected to different link types Allows effective WAN usage with various load balancing algorithms Supports link quality measurement
SDWAN ASIC specs
A53 quad @ 1.4ghz DDR4-32B @ 2400 28,000 DMPS 18x network ports 36 GBPS throughput 18 GBPS IPSec throughput CAPWAP support
What is an ADOM
ADOMs enable the admin account to create groupings of devices for administrators to monitor and manage. It divides administration of devices by grouping the Em based on a management criteria and to control and restrict admin access
Four main fortimanager wizards
Add device Install wizard Import policy Reinstall policy
What is adding a model device in fortimanager and SDWAN orchestrator
Adding an offline fortigate by it's serial number
How does SDWn simplify configurations
Admin can configure a single set of routes and firewall policies and apply them to all member interfaces
What is time wait client state 5
After a fin ack is sent the fortigate keeps the session in the session table for a few more seconds to allow for any out of order packets
When is the session flagged as may_dirty
After traffic is evaluated against the firewall policies and allowed it is flagged (usually first packet for a new session)
Where do you configure protected subnets on fmg vpn manager
All VPN communities
What will the output of the command Be Get router info kernel | grep "proto=17"
All the FIB route entries that are used to reach the servers defined on the performance SLA page over each participant interface
Source ip based load balancing
All traffic from a source ip is sent to the same interface
What are SDWAN rules for
Allow you to specify which traffic you want to route through which interface based on different strategies
What is fortideploy
Allows admins to add fortigate and fortiap devices in bulk to their fortigate cloud or fortiap cloud acccounts. It then allows admins to select a configuration template and operating system to deploy with the newly added devices.
Application control shaping
Allows bandwidth control on specific applications, application Categories, and URL categories. Application control must be enabled on the IPv4 policy for application control shaping to work and web filter should be enabled on ipv4 policy fir URL category shaping to work
What is an SDWAN template in fortimanager and what are the 4 components
Allows you to add your SDWAN components to a single template. You can add interface members, performance SLA, SDWAN rules, and neighbor
Customized profile option for the quality criteria field in the best quality strategy SDWAN rule and what is the equation
Allows you to estimate quality of link based on a combination of the same three performance measures determined by an equation. Link quality = (a*latency)+(b*jitter)+(c*packetloss)+(d/bandwidth)
What is zero touch provisioning(fortideploy)
Allows you to provision and configure fortigate and fortiap devices automatically from forticloud or fortimanager. Admins can use the fortideploy feature to configure all devices simultaneously and manage them all with a single click
Fortimeter
Allows you turn fortiOSVMs and fortiWebOS VMs on and off as needed paying for only the volume of traffic that you use. These VM's are also sometimes called pay-as-you-go VMs. You must have a forti meter license and the fortimeter license must be linked with fortimanager using forticare
If all phase 1 settings are configured the same for an IPSec tunnel how does the fortigate choose between the two
Alphabetical order
What is forward error correction
An IPSec phase 1 setting that adds additional packets with redundant data. Recipient can use this redundant information to construct any lost packet or any packet that arrives with errors. Feature increases bandwidth usage but improves reliability on lossy or noisy links.
What is SDWAN orchestrator (3)
An application that is released and signed by fortinet to run on fortimanager. It is part of management extension on fortimanager. It is used for configuring and monitoring SDWAN networks on fortigate devices that are managed by fortimanager Simplifies centralized deployment and enables automation
What is automatically generated when you enabled SDWAN
An implicit rule designed to balance the traffic among all the available SDWAN member links based on source IP
When the hub forwards a spokes shortcut query (Ike message) to the desired spoke what does spoke 2 send to the hub to be forwarded to spoke one
And Ike message (shortcut reply) containing it's public ip
What needs to be enabled in order for application and URL category shaping to work
App control and web filter profile on IPV4 policy
What two databases can SDWAN use to steer traffic along a specific link
Application control database ISDB
What must be applied to a firewall policy if you specify an application in an SDWAN rule
Application control profile allowing the SDWAN traffic
IP DSCP app method
Application identification method. SDWAN rules are matched based on differentiated services code point values (DSCP) Traffic must be marked with IP DSCP before reaching fortigate
Application control app method
Application identification method. Fortigate identifies applications based on signatures. The well known app list is updated from fortiguard automatically. Method requires a learning phase during which the first session is required to identify the application and may not match the expected sdwan rule. After the initial learning phase, dynamic cache entries are stored in the ISDB to avoid the learning phase again
ISDB app method
Application identification method. Internet service database is a DB of well known internet service definitions that is made of public opinion addresses and destination ports. Updated from fortiguard and identifies the application immediately. It does not include all of the internet services
Customer application control app method
Application identification method. Users can define a custom application control signature.
Custom ISDB app method
Application identification method. Uses a user defined ISDB. Admins can create custom services and can group them into service groups. Method is flexible and identification is also fast but requires manual maintainence.
FQDN app method
Application identification method. Uses fully qualified domain name firewall addresses as destinations. Fortigate uses DNS to resolve the FQDN to IP addresses. It's simple and fast but not as accurate for cloud services or for most well known internet service
How does SDWAN install routes for it's member interfaces into the routing table
As individual routes
What are the requirements to be an alive member
As long as it's configured failure threshold (link status check) has not been reached SDWAN member will be in alive state even though it is failing to match the SLA target requirements
How are vpn settings stored on fortimanager for VPN manager
As objects in the objects database
After configuring all SDWAN settings what two important steps do you need to do for SDWAN to be applied
Assign to a device and create a firewall policy
How many member interfaces need to be specified for SDWAN interface
At least 2
If a fortigate device has multiple dial up VPNs using preshared keys and sharing the same local gateway , proposal, and DH group, what do you need to do to for the fortigate to identify the correct VPN configuration for each incoming proposal
At least one tunnel must use aggressive mode Or both use aggressive and different peer IDs
Fortigate SDWAN configuration requirements (4)
At least two member interfaces Interfaces should not be referenced by another configuration element Supports aggregate, VLAN, and IPSec interfaces One one SDWAN interface per vdom
What does the IKE SA consist of
At the IKE level, a single IKE SA is established to handle secure communications both ways between the two peers. The following is an example of the type of information that would be included in an IKE SA. Description Example Authentication method used MD5 Encryption and hash algorithm 3DES DH group used 2 Lifetime of the IKE SA in seconds or kilobytes 86,400 Shared secret key values for the encryption algorithms
What does the IPSec SA consist of
At the IPSec level, SAs are unidirectional—one for each direction A separate IPSec SA is established for each direction of a communication session Each IPSec SA consists of security parameter values, such as a destination address, a unique security parameter index (SPI), the IPSec transforms used, the security keys, and additional attributes, such as IPSec lifetime. The SPI value becomes a unique record identifier (key field) linked to the SA parameters in the Security Parameter Databases in the RAM of peer devices. Each IPSec SA consists of values such as Description Example Peer (destination) address 10.1.1.23 Security parameter index (SPI) 7C123A9C IPSec transforms used AH, HMAC-SHA-1 Security keys 12345CD8765EF432A Additional attributes (such as IPSec lifetime)
How to configure session route persistence and what is default
At the interface level Config system interface Edit <interface> Set preserve-session-route (enable | disable) Disable- fortigate flushes all routing information from the session table after a route change and performs new routing lookups for new packets (default) Enable- fortigate marks existing session routing information as persistent and only applies the modified routes to new sessions
What extra option is there to enable as an outgoing interface strategy for the SDWAN rules in the CLI
Auto Fortigate will select an SDWAN member based on the quality of the link
What commands need to be enabled on what devices for ADVPN (3)
Auto-discovery-forwarder enabled on the interfaces that connects two hubs together Auto-discovery-sender enabled on hub interface connected to the spoke Auto-discovery-receiver enabled on the spoke interface connecting to the hub
What routing protocols does ADVPN support (3)
BGP OSPF RIPv2/ng
SDWAN rule strategy: best quality
Based on the performance of the link. It will prefer the interface that is added to the list first and then won't switch to the next member until the priority link quality is 10% or worse than the quality of the next in the link. 10% is the default but can be changed with the set link-cost-threshold command
Why should you configure SDWAN early
Because you cannot use a member interface if the interface is referenced by a firewall policy or static route
Which SDWAN strategy rules require you to specify an SLA
Best quality Lowest cost Max bandwidth
What SDWAN rule strategy does not use an SLA TARGET
Best quality (link cost threshold based on latency jitter packet lost or custom)
What SDWAN rule strategy requires estimated upstream and downstream bandwidth to be configured on the interface (hint 3)
Best quality- criteria: bandwidth Upstream bandwidth Downstream bandwidth
Phase 1 of IPSec negotiation uses a single ______ ___ and phase 2 uses two ______ for each _____
Bidirectional SA SAs for each traffic direction
What must you do on an application control profile if you are using Google signatures on an an SDWAN rule
Block QUIC traffic
Give an example of when priority would come into play for a traffic shaping profile on an interface
Both class 2 and 3 will be assigned their guaranteed first. 20 each of 100. Then the remaining of 60 will be allocated to class 2 because of the higher priority.
How is an ISDB entry identified
By a number starting from 65536
How are the ISDB and application control databases maintained
By fortiguard
How can traffic be classified
By the traffic shaping policy into different groups or class IDs based on matching criteria. Set the "then" to "assign shaping class ID" instead of choosing "apply shaper"
What is QoS?
Capability to adjust some quality aspects of your overall network traffic - quality of service
Failover parameters for SLA (3)
Check interval Failure before inactive Success before restore
What are the acceptable value ranges for the link status configuration Check interval Failures before inactive Restore link after
Check interval - 500-3600 Failures before inactive - 1-3600 Restore link after - 1-3600
What are the following fields under the link status for: Check interval Failures before inactive Restore link after Update static route
Check interval means it will send the probe every _____ miliseconds Failures before inactive and restore link after settings are to help prevent the system from continuously transferring traffic back and forth between links (known as flapping) Failures before inactive switches to dead after x consecutive unanswered requests from both servers Restore link after switches back to alive after x consecutive responses from one of the two servers Update static route automatically disables static routes for inactive interfaces and restores routes on interface recovery
Config system settings Set firewall-session-dirty (check-all | check-new | check-policy-option) What are each options
Check-all - default and all policy information is removed from session affected by a policy change. When new packets are received they are reevaluated Check-new - existing sessions are unaffected. New sessions are evaluated against the modified policies Check-policy-option- sessions will be handled based on the firewall policy configuration
What does the best quality SDWAN rule use the performance SLA for
Chooses link based on latency, jitter, or packet loss or custom and uses SLA for these values
Three steps to configuring interface based shaping
Classify traffic into different groups using traffic shaping policy Configure the traffic shaping profile, assign a percentage based value for guaranteed and max bandwidth along with priority to each group Assign a shaping profile to interface with outbound bandwidth configured
Command to get details on an ISDB ID (shows ID, name, direction, ip-range-number, ip-number)
Config firewall internet-service <ID> Get
Command to enable or disable ISDB entries in the CLI
Config firewall internet-service-extension Edit <ID> Config disable-entry Use diag internet-service ID-summary to get id
Command to apply traffic shaper to firewall policy
Config firewall policy Edit <> Set traffic-shaper <shaper> Set traffic-shaper-reverse <shaper name> Set per-ip-shaper <shaper name>
True or false? You can apply traffic shaper to a firewall policy
Config firewall policy Edit <> Set traffic-shaper <shaper> Set traffic-shaper-reverse <shaper name> Set per-ip-shaper <shaper name>
When check-policy-option is configured for the global session handling what is the command to modify behavior per policy
Config firewall policy Edit <ID> Set firewall-session-dirty (check-all | check-new) Next End
Command to configure a per ip shaper
Config firewall shaper per-ip-shaper
Command to configure a shared shaper
Config firewall shaper traffic-shaper
CLI command to configure traffic shaping group
Config firewall shaping-policy Set name Set service Set srcaddr Set dstintf Set class-ID Set dstaddr
Command to configure traffic shaping profile in CLI
Config firewall shaping-profile Edit name Set default-class-id Config shaping-entries Edit 1 Set class-id Set priority Set guaranteed-bandwidth-percentage Set maximum-bandwidth-percentage Edit 2 Set class-ID
Command to configure BGP with route map to apply route tag
Config router bgp Config neighbor Set route-map-in "name of route map that has community list and tag"
What needs to be enabled in the IBGP configuration on the hub so that routes learned from one spoke are forwarded to the other spokes
Config router bgp Set neighbor-group Set route-reflector-client enable
Command to configure community list
Config router community list Edit "1:2" Confif rule Edit 1 Set action permit Set match "1:2" Next End Next End
Command to configure policy routes
Config router policy
Command to configure route map with community list and route tag
Config router route-map Edit "name" Config rule Edit 1 Set match-community "1:2" Set set-route-tag # Next End Next End
Command to configure a static route with SDWAN interface
Config router static Edit <> Set dst 0.0.0.0 0.0.0.0 Set virtual-wan-link enable End Next
Command to force sessions to stay on the same SDWAN member after a route chanbe
Config sys int Edit <SDWAN member> Set preserve-session-route enable
Command to apply a traffic shaper and outbandwidth on an interface
Config sys interface Edit wan1|wan2 Set outbandwidth <kbps> Set egress-shaping-profile <shaper name>
Command to configure the time to wait before a packet is considered lost
Config sys virtual-wan-link Config health-check Set probe-timeout <500-5000> Msec
Command to configure sla
Config sys virtual-wan-link Config health-check Config sla Edit <> Set link-cost-factor [latency | jitter | packet-loss] Set latency-threshold < 1-10000000> Set jitter-threshold <0-10000000> Set packetloss-threshold <0-100>
Command to configure SDWAN rule
Config sys virtual-wan-link Set name Set addr-mode Set input-device Set mode <priority | auto | manual | sla | load-balanced> Set src "all" Set input-device-negate disable Set src-negate disable Set health-check Etc
Command to set members for the performance SLA
Config sys virtual-wan-link Config health-check Set member <0,1,2>
When SNAT is applied in a session what command determines the action fortigate takes when there is a route change? What is the default?
Config system global Set SNAT-route-change [disable | enable] Default is disabled
Command to configure health check for SDWAN
Config system sdwan Config system virtual-wan-link Config health-check Edit <name> Set protocol (ping | tcp-echo | UDP-echo | http | dns | twamp) Set server x.x.x.x x.x.x.x Set members Config sla Edit <> Next End Next End
Global session handling setting command and what is default
Config system settings Set firewall-session-dirty (check-all | check-new | check-policy-option) Check-all is default
Command to configure link status parameters in CLI
Config system virtual-wan-link Config health-check Set interval <500-3600> Set failtime <1-3600> Set recoverytime <1-3600>
Command to configure SDWAN rule with route tag
Config system virtual-wan-link Config service Edit 1 Set route-tag # applied to route map
Commands to configure sdwan
Config system virtual-wan-link Set status enable Set load-balance-mode <> Config members Edit <> Set interface <> Set gateway <> Set source <> (ip for SLA probe) Set cost <> Set priority <> Set status enable Next End
Command to set load balance mode on CLI
Config system virtual-wan-link Set load-balance-mode <load balance mode> Source-ip-based Weight-based Usage-based Source-dest-ip-based Measured-volume-based
Command to configure IPSec aggregate tunnel
Config vpn IPSec phase1-interface Edit <> Set aggregate member enable Set aggregate-weight <> Next End
In interface mode for IPSec vpn, by default static routes are automatically added to each IPSec dial up client, what should you do if you are using a dynamic routing protocol over ipsec and do not want fortigate to automatically add static routes
Config vpn IPSec phase1-interface Edit <phase1 name> Set add-route disable
What is auto-discovery-sender enable
Configured on hub for ADVPN indicates that when IPSec traffic transits the hub, the hub should send a shortcut offer to the initiator of the traffic
What is a traffic shaping policy
Controls how and what traffic will be shaped. You will apply the shaper once the type of traffic is specified.
By default vpn zone is enabled when creating vpn communities on vpn manager, what is a vpn zone
Creates an interface Zone and adds the IPSec virtual interfaces to them
In a volume based load balancing algorithm weighted distribution is based on ____ ____ of ____ across each member.
Cumulative number of bytes
Where is a member marked dead when it fails the link status check
Dead on the health-check and in all rules associated with the performance SLA (will be removed from route if that option is enabled)
What does fortigate do when net-device is enabled in the phase 1 IPSec configuration and what is default
Default is disabled Fortigates creates desperate virtual interfaces for each dial up client and uses the destination subnets in the quick mode selections Tunnel name = phase1name_index
What is the per-policy option Explain enabled and disabled and which is default
Default is disabled When disabled fortigates applies the specified shaping rules to all policies using the shaper. When enabled fortigate applied shaping rules to each policy individually
What do shaping profiles do
Define the percentage of the interface bandwidth that is allocated to each group (in max and guaranteed bandwidth) defines how different shaping groups or classes of traffic are prioritized
If add-route is enabled on IPSec interface mode configuration, what is the destination of the static route
Destination subnet that is received In the phase2 quick mode selectors
What does the session table contain
Details information about every IP connection that crosses or terminates at the fortigate
Where to configure the health check servers to be used for SDWAN in fortimanager
Device manager > sdwan > health check servers
Where to create interface members for SDWAN in fortimanager
Device manager > sdwan > interface members
Where can you monitor SDWAN status in fortimanager
Device manager > sdwan > monitor
How to filter the real-time debug of IKE
Diag debug console timestamp en Diag vpn Ike log filter clear Diag vpn Ike log filter ? (Mdst-addr4) Diag debug app ike -1 Di de en
Sniffer command to match any packet with the SYN flag on to port 443
Diag sniffer packet any 'tcp[13]&2==2 and port 443' 4
Command to show every session in detail
Diag sys session list
Command to bring IPSec tunnel up
Diag vpn tunnel up <tunnel name>
Command to collect debug information for probes are what are values for ICMP UDP HTTP and TCP probes
Diagnose debug enable Diagnose debug application link-monitor <> 1 server up down events 2 configuration changes 4 engine events 8 ICMP probes 16 UDP probes 32 TCP probes 64 HTTP probes 128 TWAMP probes 256 GRE probes 512 link detection 1024 DNS messages 2048 application messages 4096 policy route messages
Command to see ISDB list in the kernel of firewall
Diagnose firewall internet-service-app-Ctrl list
Command to see policy routes
Diagnose firewall proute list
To view information for the per-IP shaper command Shows max bandwidth Max concurrent sessions Packets dropped Bytes dropped
Diagnose firewall shaper per-ip-shaper list name <name>
To view information about a shared traffic shaper what diagnose command do you use Shows name Max and guaranteed bandwidth Current bandwidth Priority queue value Overhead Packets dropped Bytes dropped
Diagnose firewall shaper traffic-shaper list name <name of shaper>
Command to get the ISDB entry summary (shows ID and name)
Diagnose internet-service ID-summary
Command to get all IPs and ports for a given ISDB entry (shows ISDB ID and name, version, timestamp, number of IP ranges, more info)
Diagnose internet-service id <>
Command of you want to get information about which ISDB entry includes a specific IP and specific port (shows ISDB ID, country, region, city )
Diagnose internet-service info <vdom name> <proto> <port> <ip>
Command to show ISDB entries that include a specific IP address (Shows ISDB ID, name, and matches number )
Diagnose internet-service match <vdom name> <ip> <netmask>
Command to check route cache
Diagnose ip rtcache list
Command to check allocated max, guaranteed and current bandwidth per class including the default class ID on an interface
Diagnose net link interface list <port> Look for egress traffic control
Command to collect different information regarding SDWAN members health checks and rules (name a few options)
Diagnose sys virtual-wan-link Member Service Health-check Neighbor Log SLA-log Internet-service-app-ctrl-list Internet-service-app-ctrl-flush
Command to collect basic information regarding SDWAN members (name some options)
Diagnose sys virtual-wan-link ? Member Service Route-tag-list Route-tag-flush Health-check Neighbor Log SLA-log Intf-SLA-log Internet-service-app-ctrl-list Internet-service-app-Ctrl-flush Reset
Command to see the performance SLA health check values in the CLI
Diagnose sys virtual-wan-link health-check
Command to show details on health check
Diagnose sys virtual-wan-link health-check
Debug command for performance SLA shows port, shows state, packet loss, latency, and jitter
Diagnose sys virtual-wan-link health-check <performance SLA name>
Command to see the dynamic ISDB cache/database
Diagnose sys virtual-wan-link internet-service-app-Ctrl-list
Debug command to check Interface specific SLA logs for the last 10 minutes
Diagnose sys virtual-wan-link intf-SLA-log <interface name>
Command to shows detailed info about SDWAN members (shows member, interfaces, gateway, priority, weight)
Diagnose sys virtual-wan-link member
Command to reset sdwan
Diagnose sys virtual-wan-link reset
Command to see SDWAN rules, with members, member state, source, destination, and interface services
Diagnose sys virtual-wan-link service
Command to show details on SDWAN rules
Diagnose sys virtual-wan-link service <rule>
Command to show details of health check quality information in last ten minutes
Diagnose sys virtual-wan-link sla-log
Debug command to debug the link monitor probe process for SLA and what are levels
Diagnose test application lnkmtd <level> 1 show memory info 2 show VDOM monitor info 3 show fail detection info
Command to display extra routing information such as IPSec Tunnel name Bound interface Important: ipv4 route tree (Shows quick mode selectors and tunnel index)
Diagnose vpn tunnel list name <name of tunnel>
What should you do if you are running a dynamic routing protocol over ipsec
Disable add-route
By default what is the distance and priority assigned to a static route added automatically by IPSec when add-route is enabled and how can you change it
Distance 15 Priority 0 Config vpn ipsec phase1-interface Edit <phase1 name> Set distance <> Set priority <>
Describe the initial burst approach traffic shaping uses
During transitions from no traffic to having traffic, for the first second of the transition, the rate can be up to two times the configured rate . Then, after the first second of transition, the rate reduces to the configured rate , And should stay there
What type of interfaces does SDWAN orchestrator create for generated tunnel interfaces
Dynamic interfaces with per-device mappings so they can be used on firewall policy packages
How is the ISDB updated
Dynamically updated from fortiguard servers.
Advantage of having a hub and spoke topology Disadvantages
Easy to manage the VPN configuration and firewall policies Minimal system requirements for branch office devices Disadvantages: Communication between branch offices through headquarters is slower than it would be using a direct connection Single point of failure
What is the first step in creating an SDWAN using fortimanager
Enable SDWAN central management for the ADOM in system settings System settings > all ADOMs > ADOM name > central management > SDWAN
What is this option for when configuring an SDWAN rule: Set input-device-negate disable | enable
Enable to include all interfaces but exclude the interfaces configured with the command "set input-device <interface>"
What is this option for when configuring an SDWAN rule: Set src-negate disable | enable
Enable to include all source addresses but exclude addresses configured with the command "set src <"src">
What is this option for when configuring an SDWAN rule: Set default disable | enable
Enable to use SDWAN as the default service With disable FIB lookups are done to validate the route to the destination
Interface based shaping
Enable traffic controls based on percentage of the interface bandwidth
Per ip traffic shaping
Enabled you to apply traffic shaping to all source IP addresses in the security policy
Policy shaping
Enables you to define the maximum bandwith and the guaranteed bandwith set for a security policy
Per IP shaping
Enables you to define traffic control on a more granular level
What is ESP
Encapsulating security payload Part of the IPsec suite of protocols ensures data integrity and encryption
What is the guaranteed bandwidth option for shared shaper
Ensure there is a consistent reserved bandwidth available for traffic passing through the policy. Traffic should be significantly less than the bandwidth capacity of the interface. If not it will cause unwanted latency for other traffic passing through that shaper policy.
If a session is flagged as May_dirty and there is a policy change the session is flagged as dirty as well. Where do offloaded session packets go in this case?
Even if they are offloaded the next packet in a dirty session will go to the CPU
Why would you need to set the source ip for SDWAN probe traffic and what if it's set to 0.0.0.0
Example, if you are sending it over a VPN tunnel and only specific subnet is allowed If set to 0.0.0.0 then fortigate will use the primary IP address of the SDWAN member interface as the source IP
After a static route is removed (such as an SDWAN member becoming dead) what happens?
Existing sessions are revalidated
True or false: when a device is added to fortimanager it can automatically be used in SDWAN orchestrator
False devices must be added to SDWAN orchestrator separately
True or false. SDWAN can't be interstated with OCVPN
False it can
True or false: NAT is not supported for ADVPN
False it is supported by the on demand tunnels
True or false. Only one SLA target can be selected as the required SLA target for the lowest cost (SLA) outgoing interface strategy for SDWAN rules
False multiple can be selected. All the selected SDWAN member interfaces must satisfy ALL of the selected SLA targets to be considered as a selection for the outgoing interface
True or false. SLA targeted are required
False they are optiona
True or false. You should use SDWAN manager on fortimanager first and then SDWAN orchestrator
False you should not use SDWAN manager if using orchestrator
True or false. You have to add fortigate to fortimanager before adding it to SDWAN orchestrator
False. It is recommended to add it to fortimanager first but you can add it to SDWAN orchestrator first
True or false. Only one SLA target can be created per performance SLA
False. Multiple can be created in although there are limited scenarios you would want to do that
True or false the default route using SDWAN requires two gateways to be defines instead of one
False. You define associated gateways when you configure the member interfaces under SDWAN virtual interface
SDVPN dynamic spoke-to-spoke shortcuts
Feature that allows SDWAN to combine a dynamic shortcut tunnel between spokes and the static tunnel to the hub. When the static tunnel to the hub is referred to in the SDWAN rules, the rules will add a dynamic shortcut tunnel automatically when a shortcut tunnel is established
What two things can you configure with the SDWAN virtual interface instead of separate interfaces
Firewall policy and static routes
A route with a lower priority would be chosen _____
First
Why may a session not match a configured SDWAN rule In a new deployment
First session is required as a learning phase to identify the application and may not match expected SDWAN rule
How is VPN manager enabled on fortimanager
For each ADOM in the system settings > ADOM > ADOM name > central management
What is the "set link-cost-factor" command used for Config sys virtual-wan-link Config service Set link-cost-factor [latency | jitter | packetloss]
For the SDWAN rules when you select best quality for the strategy on selecting outgoing interfaces
Requirements for a fortigate to participate in OCVPN
FortiOS 6.2.0 and later Fortigate must have internet access Must be registered to forticare using same forticare account
What four components overal make up the fortinet secure SDWAN solution
Fortigate Fortimanager Fortianalyzer Fortideploy
What happens if net-device is disabled in the IPsec phase1 config
Fortigate creates a single IPSec virtual interface that is shared by all IPSec clients connecting to the same dial up vpn. In this case the tunnel-search setting determines how fortigate learns networks behind each remote client.
Instead of the admin actively directing and pushing out devices in response to network topology changes how does OCVPN propagate these changes
Fortigate devices use device polling to propagate changes across nodes in the VPN
For the guaranteed bandwidth feature what does fortigate do if the flow does not achieve the configured rate
Fortigate increases the packet priority queue in effort to increase rate
What are the requirements to use zero touch provisioning feature (2)(fortideploy)
Fortigate must have internet access and a DHCP server must assign an IP address to the fortigate interface
What is the FIB
Forwarding Information Base is used for management and is generated by the routing process. Used for packet forwarding information. In HA the FIB exists on both members but the routing table only exists on the primary
Are are SDWAN rules evaluated
From top down
How are SDWAN rules evaluated
From top down
What topologies does OCVPN offer
Full mesh Hub and spoke (with or without ADVPN )
Advantages and disadvantages of full mesh
Full mesh connects every location to every other location. Topology causes less latency and hub and spoke requires less HQ bandwidth Disadvantages: every spoke fortigate must be powerful and administration and troubleshooting is more complicated
What's proto options are available in GUI and CLI for the link health monitor probing
GUI Ping HTTP DNS CLI PING HTTP tcp-echo UDP-echo TWAMP Dns
What is it called when fortigate initially selects the wrong phase 1 and switches to a different one
Gateway revalidation
What is the implicit rule for SDWAN rules
Generated when SDWAN is enabled. Used when other conditions are not met and is designed to balance the traffic among all the available SDWAN member links
Command to verify which IPSec tunnels are up
Get IPSec tunnel list
Command to get prefixes received and next hops for each destination for BGP
Get router info BGP network
Command to see FIB
Get router info kernel
When you look at the session table you will see dev->/dev -> indicating the ingress and egress ports for the traffic. How do you determine which ports they are being mapped to
Get router info kernel and it will show dev=#(port#)
Command to see routing table
Get router info routing-table all
Commands to verify there are BGP prefixes being received over the tunnels
Get router info routing-table all get router info BGP network Get router info BGP neighbors <tunnel ip > received-routes Get router info BGP summary
Command to show brief summary of each session including protocol source ip, destination ip, and port
Get sys session list
Command to see total number of IPV4 sessions for the current vdom
Get sys session status
Fortimanager management layers and sub layers (3)
Global ADOM layer - Global objects, all header and footer policies ADOM layer - Common object database, devices, device groups and policy packages Device manager layer- Name and type of managed devices, addresses, revision history, real time status, model, firmware
What level is session handling for firewall policies configured at
Globally or at VDOM level if VDOMs are enabled
What utility can be used to sort through the session list (get sis session list) for a specific ip
Grep
Name some preconfigured traffic shapers
Guaranteed 100 KBPS High priority Low priority Medium priority Shared 1M pipe
What is the purpose of configuring two server beacons for link health monitor
Guards against the server being at fault at not the link
What will an on demand tunnel look like (both through a VPN created on fmg vpn manager and one directly on fortigate )
H2S_0 H2S_0_0 Phase1vpnname_0
Diagnose debug application link-monitor 64
HTTP probe debug for link monitor
What options are there for the traffic priority drop down when creating a traffic shaoee
High medium low
For the RETRIEVE_CONFIG option of SDWAN orchestrators first online action what type of settings are retrieved (4ish)
Host name WAN port LAN/DMZ port Static route
What does the thickness of the line on the map represent on SDWAN orchestrator
How much traffic is flowing over the link
Diagnose debug application link-monitor 8
ICMP probe debug for link monitor
What methods does a fortigate support for automatically configuring the IP settings of IPSec clients (3)
IKE mode configuration DHCP over IPSec L2TP over IPSec
When does gateway revalidation apply (3)
IKEv1 with certificate authentication IKEv2 with preshared key authentication IKEv2 with certificate authentication
What two formats are accepted for specifying a link health monitor server
IP or FQDN
What does application control rely on to identify the application (besides signature)
IPS engine in order to identify the upper layer protocols (kernel cannot do this) kernel can only identify NTP DNS and ICMP
When OCVPN is enabled on fortigates registered to the same forticare account what is generated automatically
IPSec phase1 and 2 configuration, static routes, and firewall policies are generated automatically
What IP version does ADVPN support
IPv4 and ipv6
Format of a traffic shaping policy (___+____)
If + then
For a fortigate without internet access, that is managed by a fortimanager, what is employed to prevent fortimanager IP Spoofing (this is for FMG access on a lan or lab)
If a different fortimanager IP comes from the DHCP server at a later time fortigate will not change the central management configuration
When would an SDWAN member assigned to a performance SLA be selected over the other participating links
If it meets the SLA target and the others dont
Describe the two tunnel-search setting: nexthop for phase1 of a dial up vpn
If net device is disabled and tunnel search is set to nexthop fortigate does not use the quick mode selectors to learn about remote networks. Fortigate will learn those routes with the assistance of a dynamic routing protocol configured to run over the IPsec tunnels
What exception is there to the usual two route lookups that fortigate performs
If there is a route change route information is flushed from affected sessions and route cache entries
When is the session flagged as blocked
If there is no matching firewall policy or it matches a deny policy
What does the phase2 route-overlap setting define
If two remote sites share the same subnets they might create overlapping static routes on the central fortigate. This phase 2 setting defines what action fortigate will take if a new remote site is connecting and there is already a remote site connected with an overlapping subnet
In what cases would SNAT-route-change enabled be used
If you are not using SDWAN or a link monitor and you have multiple ISPs and one link goes down If you have multiple ISPs and you change a route attribute for one of the static routes such as priority
What does it mean to add member "0" to the participants for a performance SLA and where is this done
In the CLI and it is equivalent of adding all SDWAN members to the SLA
Fortimanager management model
In the global ADOM layer you create header and foot policy rules that can be assigned to multiple ADOMs In the ADOM layer objects and policy packages in each ADOM share a common object database. You can create import from and install policy package on many managed devices at once In the device manager layer you can configure and install device settings for each device. Fortimanager compares the current configuration to the changes configuration and creates a new configuration revision on fortimanager.
Where is the ISDB loaded
In the kernel
Even though you must configure routes using SDWAN virtual interface fortigate installs _____ ______ for the member interfaces in the routing table
Individual routes
By design, traffic Shaping configured in a firewall policy, application list, or traffic shaper policy uses an ________ ______ approach
Initial burst approach
How do you push vpn settings for the fortimanager vpn manager to devices
Installing policy package
Icmp protocol state
It has not state Proto_state is always 00
Why is it recommended to enable SSL deep inspection on policies when you use application control profiles
It improves the accuracy of application detection
What happens if you add a fortigate to SDWAN orchestrator before adding it to fortimanager
It is automatically added to fortimanager
Why would you configure cost for an SDWAN interface
It is used in the SDWAN rules strategies Lowest Cost and Maximize Bandwidth options
Can OCVPN use multiple wan links at once
It supports multiple but will only use one at a time
For any incoming IPSec connection, how does fortigate select which phase1 to use
It uses the first phase 1 (in alphabetical order) that matches the following: Local gateway IP Mode (aggressive or main) Peer ID if aggressive mode is used (b/c aggressive includes peer ID in first packet) Authentication method (psks and certs) Digital certificate information Proposal DH group
If no policy routes (regular policy route or SDWAN rule) matches the traffic, fortigate will perform a FIB lookup. If the FIB resolved interface is an SDWAN member what does the fortigate do
It uses the load balancing method configured in the implicit rule
How does fortigate route properly when tunnel search is set to next hop
It uses the remote IPs for the tunnel interfaces learned through the IKE messages and interface index then routes to the destination learned through the dynamic routing protocol
How does fortigate route properly when tunnel search is set to selectors
It uses the subnets learned through the quick mode selectors and the tunnel indexes
What happens if traffic does not match any traffic shaping policies
It will go through implicit policy
How can you tell if a policy route is an SDWAN rule from the command diagnose firewall proute list
It will say vwl_service and vwl_mbr_seq
With the SDWAN rule setting configuration set to default enable + gateway enable what does fortigate do
It will select the first outbound interface in the SDWAN policy route and will skip the FIB lookup
How would a reverse shaper affect YouTube
It would affect not just upload but download speed as well
When you configure traffic shapers you configure bandwidth values as ____ but in CLI and GUI stats you see bandwidth in _____
Kilobits Kbps Kilobytes KBps
What three criteria are used to measure the quality of the links connected to the member interface participating in a performance SLA
Latency Jitter Packet loss
For the best quality SDWAN rule strategy what are the options for quality criteria
Latency Jitter Packet loss Downstream Upstream Bandwidth Customized profile
What sections make up the performance SLA
Link health monitor SLA targets Link status
Customized profile equation
Link quality = (a*latency)+(b*jitter)+(c*packetloss)+(d/bandwidth)
Process responsible for performing performance SLA probes
Lnkmtd
Common session flags (11)
Log = session is being logged Local = session is to/from local stack Ndr= session will be checked by IPS signature Nds= session will be checked by IPS anomaly Br= session is being bridged (TP mode) Npu = session can be offloaded to npu Wccp = web caching Npd = session cannot be offloaded to NPU Redir = session is being processed by an application layer proxy Authed= session was successfully authenticated Auth=session requires or required authentication
What type of traffic log and column should you use to verify that traffic is egressinf the correct SDWAN member interfaces
Log and report > forward traffic Destination interface
What rule option uses SDWAN member interface cost
Lowest cost
Which SDWAN rule strategies require the SLA TARGETS
Lowest cost Max bandwith
What rules require an SLA target to be defined
Lowest cost Maximize bandwidth
What will a debug flow say if a packet is exceeded max concurrent connection limit and denied for per ip shaper
MSG="blocked by quota check, dropepd"
What will a debug flow say if packets are exceeded the maximum bandwidth and being dropped for a shared shaper
MSG="exceeded shaper limit, drop"
What SDWAN rule strategy does not depend on performance SLA or SLA targets
Manual
What 4 strategies can be used for SDWAN rules to route traffic through an outgoing interface
Manual Best quality Lowest cost Maximize bandwidth
What two views can you monitor SDWAN on fortimanager
Map view and table view
Which SDWAN rule strategy does not take cost or interface preference into consideration
Maximize bandwidth (SLA)
Link health monitor
Mechanism for detecting when a router along the path is stopped or degraded Used so fortigate can check the status/health of each SDWAN member interface participating in a performance SLA by periodically sending probing signals through each member link to a server that acts as a beacon.
What things must be specified under an SDWAN interface (2)
Member and it's associated gateway
Advantages and disadvantages of a partial mesh topology
Minimizing required resources of a full mesh but reduces latency from a hub and spoke. Partial mesh is appropriate if communication is not required between every location Disadvantage is that fortigates configuration is still more complex than a hub and spoke and routing requires more planning
What is recommended to do with the policy blocks that are automatically installed to fortimanager by SDWAN orchestrator
Move them to the top of the policy package
Formula for required VPN tunnels
N sites = N(N-1)/2
What are the three first online action options to choose from when adding a device to SDWAN orchestrator
NONE: manually imitate confirmation installation after adding the device to the orchestrator RETRIEVE_CONFIG: import some of the configuration settings from the device when the devices comes online for first time. Settings such as host name, WAN port, LAN DMZ port and static route are imported SYNC_CONFIG select to install the SDWAN orchestrator config associated with the profile when the device comes online for first time
What 5 options are there for PerIP traffic shaper
Name Max bandwidth Max concurrent connections Forward DSCP Reverse DSCP
When you add a fortigate device to SDWAN orchestrator what do you assign to the device
Name Profile name First online action Region
Where can you monitor SDWAN link status
Network > performance SLA > graph
What is the duel vpn wizard
Network > sdwan Edit SDWAN member Interface + vpn Used to automatically set up multiple VPN tunnels to the same destination over multiple outgoing interfaces for redundancy. Includes automatically configuring IPSec, routing and firewall settings
What is the gateway used for when configuring member interfaces
Next hop up used to create the kernel route to each performance SLA and also used for static routes created by SDWAN virtual interface
Are ADOMs enabled by default
No
Is cost or preference taken into consideration for the maximize bandwidth (SLA) strategy?
No only if members meets SLA targets
Where can you check OCVPN license type, device information and network topology
OCVPN portal Contains license type Device information including serial number, OCVPN rule, host name, public IP address, port number, overlays Topology
Where are configured traffic shaping profiles applied
On network > interfaces > select interface > traffic shaping
When is the session flagged as dirty
On the first packet before it is evaluated against policies and if there is a change in policy configuration any existing may_dirty sessions will also be flagged as dirty
If you are configuring a primary hub and secondary hub for OCVPN how are overlays configured
On the primary and the cloud will sync them to the secondary
What two policy blocks does SDWAN orchestrator create on fortimanager and what are they for
One for hub devices (SDWAN_Overlay_PB_HUB) One for edge devices (SDWAN_Overlay_PB_EDGE) The policy blocks include the necessary firewall policies to allow health check and negotiate traffic for VPN tunnels
Why are two SAs required to secure traffic from peer-to-peer
One for inbound and one for outbound traffic
What direction is a shared shaper applied to
Only outbound traffic
What happens if update-static-route is enabled for the performance SLA
Only static routes for the dead member with the same next-hop are removed from the routing table Static routes for the dead member that are routed through a different next hop are kept on the RIB/FIB
Does OCVPN support vdoms
Only supported on the root vdom
How does SDWAN orchestrator work with fortimanager to install the configuration on fortigate (3)
Orchestrator automatically generates CLI scripts of the configuration Orchestrator installs the CLI scripts to the device manager database on fortimanager Fortimanager receives the CLI scripts and fortimanager installs the configurations on fortigate
How can traffic shaping policy be used for interface based traffic shaping
Organizes traffic into groups so that a shaping profile can be applied to the groups which defines the percentage based values for guaranteed and max bandwidth and priority
Where in the session table can you see shared shaper information and other detailed information like packet drop counter
Origin-shaper Reply-shaper
Oif
Outgoing interface
What is OCVPN
Overlay controller vpn cloud based solution for provisioning and setting up IPSec VPN. When OCVPN is enabled on fortigate devices that are registered to forticare using the same forticare account, IPSec phase1 and 2 configuration, static routes, and firewall policies are generated automatically
What must be the same on the OCVPN config on each fortigate for the local and remote selectors pairs to be negotiated
Overlay names
SDWAN orchestrator automatically establishes _____ between all hubs
Overlays
What happens if maximum bandwidth is exceeded for traffic shaping
Packets will be dropped
What is IKE
Part of the IPsec suite which does the handshake, tunnel maintenance, and disconnection Phase 1 and phase 2 Negotiates the tunnels private keys, authentication, and encryption Allows parties involved in a transaction to set up their security associations
Where in the session table can you see per_ip_shaper shaper information
Per_ip_shaper
Explain IPSec aggressive mode exchange
Phase 1 3 packet exchange 1) client initiates by suggesting the security policies and providing it's DH public value and peer ID 2) responder replies with same information + hash 3) initiator sends it's hash payload
Explain IPSec main mode exchange
Phase 1 6 packet exchange 1) client imitates by proposing security policies (ISAKMP policies) 2) reps ponder selects which security policy it will agree to use and reply 3) initiator sends it's DH public value 4) responder replies with it's DH public value 5) imitator sends it's peer ID and hash payload 6) responder replies with it's peer ID and hash payload
What settings do you configure for vpn community on vpn manager
Phase 1 and phase 2 Authentication and encryption settings for phase 1 Diffie Hellman Key life Dpd Phase 2 PFS Replay detection
What phases and options are there for IKE
Phase 1 main or aggressive mode Phase 2 quick mode
What type of interfaces does SDWAN support (4+)
Physical VLAN Aggregate IPSec interfaces Others
What are the measurement techniques for SLA (5)
Ping Http TCP echo UDP echo TWAMP
Diag dvm device list on fmg Pkg: modified Cond: ok
Pkg= policy package status Cond= device database status Conn= firewall up or down Conf=configuration status Db= device database status
Where to configure traffic shapers
Pol it and objects > traffic shapers
Where to create a traffic shaping policy in GUI
Policy and object > traffic shaping policy
How do you modify an ISDB in the GUI
Policy and objects > internet service database Enable or disable
Where can you see stats on traffic shapers including current bandwidth utilization And dropped bytes
Policy and objects > traffic shapers
Where to configure traffic shaping profile in gui
Policy and objects > traffic shaping profile
SDWAN rules are treated as _______ routes
Policy based routes
Proute
Policy route
What type of routes are SDWAN rules
Policy routes
Which routes take precedence on fortigates
Policy routes
Which gets checked first policy routes or SDWAN routes
Policy routes then sdwan routes
What order does fortigate perform policy lookups
Policy-based routes: If a match occurs and the action is to forward, traffic is forwarded based on the policy route. SDWAN rules Route Cache: If there are no matches, FortiGate looks for the route in the route cache. Forwarding Information Base, otherwise known as the kernel routing table. If no match occurs, the packet is dropped.
With command diagnose sys virtual-wan-link health-check what do you see
Port member State (alive or dead) Packet loss percentage Latency in ms Jitter in ms Sla_map
For ADVPN over OCVPN to work at least one device must announce it's role as ____ _____
Primary hub
What role does priority assignment play when assigning bandwidth to a group or class within a traffic shaping profile
Priority decides which class can win when multiple classes are competing for available bandwidth
Pro and con of ISDB app method
Pro is it identifies and application immediately and is managed by fortiguard. Con is that it does not contain all internet service
Pros and cons of FQDN app method
Pro is it is fast but not as fast as the other options b/c it needs to use DNS. con is it is not accurate for cloud services or for most well known internet services
Pro and con of IP DSCP app method
Pro is that is can help integrate SDWAN with an existing architecture. Con is that there is less control over traffic identification, it must be marked with IP DSCP val before it reaches fortigate and users or applications both may interfere with marking
Pros and cons of custom ISDB app method
Pro is that it is fast and flexible and con is that is required manual maintenance
Pro and con of application control app method
Pro is that the fortigate identifies based on app signatures and the well known app list is managed by fortiguard. Con is that it requires a learning phase to identify the application and the first session may not match the expected SDWAN rule. After the learning phase a dynamic cache entry is stored in the ISDB to avoid the learning phase
What is SDWAN orchestrator profile
Profile creates a template that defines general system, network, and business policies for devices in SDWAN networks
What does the diag sys session list command show
Protocol number (proto=) Protocol state(proto_state=) Expiration (expire=) Traffic shaper counters (origin-shaper reply-shaper) Session flags (state=) Rx and Tx Statistics (statistics) SNAT and DNAT for each direction(origin->sink) Source mac of packet (src_mac) PolicyID (policy ID=) Hardware accel counters (npu_state, NPU info: VLAN)
When the hub sends a shortcut offer to a spoke informing that it can negotiate a direct connection, the spoke sends a FortiOS specific Ike message (shortcut query) with what information (4)
Public ip Local subnet Desired remote subnet Auto generated PSK or digital cert
_____ Can be a useful tool for optimizing the performance of the various applications on your network
QOS
What is traffic queuing?
Queuing ensures that packets are transmitted in order of their assigned priority Q for that physical Interface
Plan your SDWAN network topology based on what two principles
Regions- each device should be added to corresponding region depending on how network is structured geographically Hub and edges- defining the roles of each fortigate device
How to configure OCVPN for the fortigate (6)
Register device on forticare account VPN > overlay controller vpn Enable OCVPN Select the role (hub or spoke) Select an WAN interface Create a new overlay, specifying name, local subnets, and local interface
What must you do before you can configure OCVPN on the fortigate itself
Register the fortigates to the forticare account and then you can go to VPN > OCVPN on the fortigate
In what way is traffic load balanced between members for the maximize bandwidth (SLA) outgoing interface strategy
Round robin session based
What does the kernel perform first? Route lookup or policy lookup
Route then policy
What is a security association
SA is the basis for building security functions into IPSec A security association is the establishment of shared security attributes between two network entities to support secure communication. An SA may include attributes such as: cryptographic algorithm and mode; traffic encryption key; and parameters for the network data to be passed over the connection.
What two components does secure SDWAN encompass
SDWAN (SDWAN, QoS, VPN) + NGFW (app control IPS AV URL sandboxing ssl inspection)
SDWAN configuration components (5) main (10 subtypes)
SDWAN - interfaces rules SLA Routing - static BGP Security - policies and profiles VPN - IPSec tunnels QoS - traffic shapers, policy, profile
Difference between SDWAN implicit load balancing methods vs ECMP load balancing method
SDWAN includes one more: volume
Where to add devices for SDWAN orchestrator
SDWAN orchestrator > configuration > device
Where in GUI do you create profiles for SDWAN orchestrator hub and edge devices
SDWAN orchestrator > configuration > profile
How does SDWAN use BGP tags
SDWAN rules can use BGP learned routes as dynamic destinations You can accept a route that matches a community and set a tag to the routes These tags can be used as dynamic destinations in the SDWAN rules
How can SDWAN work with ADVPN(3)
SDWAN rules can use the shortcut VPN to forward traffic between spokes Dynamic shortcut tunnels and the static tunnel to the hub are combined into one SDWAN member When the shortcut tunnel is established the traffic through SDWAN will go through the shortcut tunnel rather than through the hub
What makes fortinet SDWAN ultrafast (app identification and steering)
SOC4 chip
When using the application control database for SDWAN rules and policies with app control UTM what should you use for an accurate application identification
SSL deep inspection
Auth flag
Sacha requires or required authentication
Where is routing information written on the fortigate for each session (2)
Session Table and route cache
Which load balancing methods use weights configured on each SDWAN member
Session and volume based
Npu flag
Session can be offloaded to NPu
Npd flag
Session cannot be offloaded to NPU
Br flag
Session is being bridged (TP mode)
log flag
Session is being logged
Redir flag
Session is being processed by an application layer proxy
Authed flag
Session was successfully authenticated
Nds flag
Session will be checked by IPS anomaly
Ndr flag
Session will be checked by IPS signature
In a session based load balancing algorithm weighted distribution is based on the number of ____on each SDWAN member
Sessions
Weight based load balancing
Sessions Interfaces with higher weights have a higher priority and get more traffic
What is session route persistence
Sessions passing through that interface will continue to pass without being affected by a route change. Route changes will apply only to new sessions. This is applied at the interface level when SNAT is not applied
IBGP configuration of a hub participating in ADVPN
Set AS the same as the remote AS In the neighbor group Enable set route-reflector-client enable in the neighbor group In the neighbor range set the neighbor group and prefix range for the overlay subnet Add protected subnets for the hub
IBGP configuration for spoke participating in ADVPN
Set asn Config neighbor as the hub ip and set remote asn Define protected subnet for the spoke
What needs to be configured on the ADVPN spoke
Set auto-discovery-receiver enable Set ip on the tunnel interface Set net-device enable
What needs to be configured on the ADVPN hub (5)
Set net-device disable Set add-route disable Set tunnel-search nexthop Set auto discovery sender enable Assign an ip to the tunnel interface
What gets imported from the device when you select RETRIEVE_CONFIG for the first online action for add device in SDWAN orchestrator
Settings such as host name, WAN port, LAN DMZ port and static route are imported
What 5 things are so specified when creating a shared traffic shaper
Shared or per ip Name Priority Max bandwidth Guaranteed bandwidth DSCP
What three traffic shaping message does the fortigate offer?
Shared policy shaping Per IP shaping Interface based shaping
What 4 differences are there when configuring a shared shaper vs per-ip shaper (2 each)
Shared shaper will have you configure a priority and guaranteed bandwidth does not have concurrent connections Per ip shaper will have you configure max concurrent connect and reverse and forward DSCP does not have priority or guaranteed bandwidth
Diagnose sys virtual-wan-link health-check
Shows information like packet loss, latency, jitter for the servers acting as the beacons
What type of hub and spoke architecture is supported by ADVPN
Single or multiple hub
Why do you need to configure the hub as a route reflector when using IBGP for ADVPN
So routes learned from one spoke are forwarded to the other spokes
Why would you configure priority for an SDWAN interface member
So the priority can be used for SDWAN rules or priority rules
What is ADVPN
Solution based on IKE and IPSec Provides direct connectivity between all sites by creating on demand tunnels between spokes Benefit of full mesh topology while providing scalability with minimum configuration
What options are there for controlling the type of traffic matched on a shaping policy
Source IP Destination IP Service Application URL category
What parameters can be used with SDWAN rules to match traffic (7)
Source IP User group Destination Ip Destination port number ISDB address objects as dest Firewall application as dest ToS
SDWAN load balancing methods (5) what is default
Source IP (default) - sessions from the same source IP address use the same interface Source destination IP - sessions with the same source and destination IP pair use the same interface Spillover - use one interface until the threshold is reached then use the next Sessions - sessions will be distributed based on weights assigned on the interfaces Volume - sessions are distributed so the traffic volume is distributed by the interface weights
What criteria is defined is defined on a traffic shaping policy
Source address Destination address Service Application URL category Name Shaper to apply Outgoing interface
Source-dest-IP-based load balancing
Source and destination IP All traffic from a source IP to a destination IP is sent to the same interface
What is configured on an interface for a traffic shaping profile to be applied
Specified profile Outbound bandwidth
What three things are configured in a traffic shaping profile
Specify group (class ID) Set max and guaranteed bandwidth Set priority
Usage based load balancing
Spillover All traffic is sent to the first interface on the list. When the bandwidth on that interface exceeds the spillover limit the new traffic is sent to the next interface
What VPN communities are the hub and spoke roles provided as options in VPN manager
Star and dial up
What type of WAN IPs does OCVPN support
Static and dynamic
What traffic and routes does the SDWAN implicit rule only apply to
Static routes
Interface weight on an SDWAN member only applies to ____ ____
Static routing
What account can enable and create ADOMs
Super_user
What type of user can enable management extensions in fortimanager
Super_user
What protocol is TCP and what is UDP
TCP 6 UDP 17
Diagnose debug application link-monitor 32
TCP probe debug for link montiro
What protocols are available to use for SLA probing in the CLI that are not in the GUI
TCP-echo UDP-echo Twamp
Diagnose debug application link-monitor 128
TWAMP prob debug for link monitor
What do the green arrows on the link quality measurement (performance SLA page) indicate
That the server is responding to the health check, regardless of the packet loss latency and jitter values. Does not mean the SLA targets are being met.
Where are the routes for the link health monitor added (for the beacon probing)
The FIB
If you assign multiple classes the same priority on a shaper profile how is bandwidth allocated after guaranteed limits have been reached
The allocation to each class will be proportional to it's guaranteed bandwidth percentage. Bottom All classes will be assigned their guaranteed first which is 20 for class 2 20 for class 3 and then 30 for class 4. The remaining 30 will be allocated to class 2 and 4 because of the higher priority. The allocation of the remaining will be proportional to the guaranteed bandwidth. In this case it is 12 for class 2 (30 mbps * 20/50) and then 18 for class 4 (30*30/50)
What is the requirement to select and outbound interface when SDWAN rule settings are set default and set gateway disable (1)
The best match to the destination must be an SDWAN member A policy route outbound interface is considered acceptable only if it has a FIB route to the destination The first OIF filling this requirement is selected
What is helpful for troubleshooting when SDWAN member interfaces routes are removed or adding to the routing table
The event logs
Describe the learning phase of the application control app identify method
The first session is required to identify the application and may not match an expected SDWAN rule. After the learning phase dynamic cache entries are stored in the ISDB to avoid the learning phase again. Kernel matches policy based on IPv4 headers. Flags session as may dirty with app 0 allows sessions sends traffic to IPS to identify layer 7 info ips flags as dirty so kernel will reevaluate. After IPS identifies the app it adds an entry to a dynamic ISDB with the destination IP and port. Any further session to the same destination will use the ISDB entry to immediately identify the app This entry will be pushed to the kernel firewall
What rule is the load balancing algorithm configured on
The implicit rule
Where are the dynamic ISDB entries pushed after IPS identifies the application
The kernel firewall
If bandwidth is exceeded what traffic will be dropped first when there are traffic shapers configured
The ones with the lowest priority configured on the policy or on the profile
What is defined by an SLA target
The quality of the link Jitter Latency Packet loss
What does the fortigate do after a changing in the routing table when it is not applying SNAT (3)
The routing information is removed from the sessions that are affected by the change, session is flagged as dirty, and related route cache entries are deleted Route lookup is done again for the next packets (2 total) one for originator and one for responder
What is outbandwidth for on the interface that a traffic shaper profile is applied to
The shaper uses outbound bandwidth as maximum link speed to shape traffic. It is the bandwidth of the link
What will the routing table look like with the command get router info routing-table all when you have SDWAN configured
There will be individual static routes with both gateways applied and equal routing attributes (dest address and subnet, distance, priority) so fortigate can remove individual routes in the event of an interface outage and redirect to the remaining members without affecting the whole SDWAN load balance group
What is a vpn gateway on vpn manager and what are the two types
They are the fortigates that will be assigned to a community and have a vpn tunnel configured on it Managed - managed by fortimanager in the current ADOM External - devices not managed by fortimanager or devices ina. Different ADOM
VPN community on fortimanager and what are the three types
They contain the common ipsec settings (phase 1 and phase2) that are shared by all the IPSec gateways members of the community Full mesh Star Dial up
What are business rules in sdwan orchestrator profiles
They define routing policies between subnets in SDWAN networks or defines how traffic from SDWAN subnets accesses the internet. Orchestrator includes predefined business rules in profiles.
What other options besides protocols can you configure in the CLI for the health-check that are not available in the GUI (3)
Threshold-warning And threshold-alert for packet loss perentage, latency ms, and jitter ms Ha election priority Enable/disable system DNS as probe server
When net device is disabled and tunnel search is set to next hop how does fortigate learn the remote ips of the clients
Through the IKE messages (IPs on the IPSec virtual interfaces of the clients)
What is the max concurrent session option for per ip traffic shaping
Total number of simultaneous connections each source IP can have
What is traffic policing?
Traffic policing is dropping packets that do not conform to bandwidth limitations.
Shapers will allow you to define how traffic will flow by setting the ____, ____, _____
Traffic priority Bandwidth DSCP options
_____ Are the point of control where you can define bandwidth values and priority and then use them in traffic shaping policy
Traffic shapers
SDWAN rules: maximize bandwidth (SLA)
Traffic will be load balanced among all the members that satisfy the SLA target and if there are multiple SLA targets traffic will be load balanced between members that meet all the targets. Traffic is load balanced using session based round robin
True or false. Preshared key is NOT part of the matching criteria when choosing phase 1 settings
True
What do the virtual interfaces that are created by the set net-device enable command look like
Tunnel name = phase1name_index
How many servers can be used as a beacon for link health monitor
Two
What is an aggregate IPSec tunnel
Two or more IPSec tunnels between two sites can be combined to create an aggregate tunnel. Similar to LACP port aggregate. One single interface for routing and firewall policing
What is twamp
Two way active measurement protocol defines a standard for measuring round-trip network performance between any two devices that support the TWAMP protocols. ... The TWAMP-Test protocol is used to send and receive performance-measurement probes
Went in IP sack tunnel is traversing Nat how is ESP encapsulated
UDP over port 4500
Diagnose debug application link-monitor 16
UDP probe debug for link monitor
Where do you turn off add route on fmg vpn manager
Under the VPN gateway configuration of the hub
How long do on demand tunnels remain active for ADVPN
Until the SAs are manually flushed it until they time out
How long do sessions flag does block stay in memory in the session table And what happens two packets matching a session with the block flag
Until the session expires all packets matching will be dropped
What needs to be configured in the CLI to use the bandwidth link criteria options (3) for the SDWAN rule link quality strategy
Upstream and downstream bandwidth estimate Config sys int Set estimated-upstream-bandwidth Set estimated-downstream-bandwidth
Bandwidth option for the quality criteria field in the best quality strategy SDWAN rule (3)
Upstream, downstream, or bidirectional Fortigate selects the link based on the available bandwidth in the incoming direction, outgoing direction, or both The estimated upstream and downstream bandwidth per member interface must be configured
How can you exclude a criteria from the customized profile quality criteria
Use 0 as the value
After SDWAN network is configured on all devices by the SDWAN orchestrator when do you do
Use fortimanager to define and install firewall policies to the fortigate
What possible actions are there for the phase2 route-overlap setting (3)
Use-new - disconnect existing and accept new Use-old - keep existing and reject new one Allow - keep existing and accept new one. Traffic sessions that start from the central fortigate will be load balanced over both VPN with ECMP
What is Xauth
Used as additional authentication for IPSec tunnels. One side must provide credentials (username and password) in order to authenticate. It is known as phase 1.5 because it occurs after phase 1 and before phase 2
What is auto-discovery-receiver enabled
Used in ADVPN Configured on spike interface Indicates that the IPSec tunnel wants to participate in ADVPN and receive a SHORTCUT-OFFER
What is the max bandwidth option for shared shaper
Used to set the largest amount of traffic allowed using a policy where this shaper is enabled. If traffic goes above this limit fortigate will start dropping packets
What is this option for when configuring an SDWAN rule: Set mode <> What options can be enabled with it (5)
Used to set the outgoing interface strategy Auto -select based on quality of link Manual Priority - best quality SLA -lowest cost Load-balanced -maximize bandwidth
What is SDWAN usage monitor and three views
Used to view traffic distribution between the member interfaces based on bandwidth, volume, or sessions Bandwidth shows bandwidth utilization by each member interface Volume shows volume of traffic sent and received per member interface Sessions show number of sessions lasting through per member interface
What are SDWAN orchestrator shared resources
Useful for creating resources that are going to be used across all deployments Shared resource categories include: Intranet addresses Network SLA System Health threshold Resources such as DHCP servers/ relays, DNS servers, SNMP hosts, NTO servers fortiguard and email etc
Link quality measurements
Using Ping or HTTP echo fortigate can determine the latency Jitter, or packet loss percentage for each link and dynamically select links based on these measurements
How does SDWAN allow you to control application performance
Using rules and performance SLAs that route traffic based on quality type
How is effective WAn use achieved (3)
Using various load balancing glorying such as bandwidth usage Sessions or application aware routing
Fortimanager manager panes(5)
VPN SDWAN FortiAP Fortiswitch Fabric view
What is fortimanager VPN manager
VPN manager simplifies the administration of multiple VPNs. Allows you to install IPSec settings on multiple fortigates simultaneously
Max number of ADOMs on fortimanager
Varies by models
Measured volume based load balancing
Volume based Sessions are load balanced based on traffic volume in bytes. More traffic is sent to interfaces with higher volume ratios
Main motivator for deploying SDWAN
WAN use when using multiple WAN links
Wccp flag
Web caching
What is this option for when configuring an SDWAN rule: Set hold-down-time 0
When a backup member becomes primary it remains as primary for at least this time period regardless of changes in the quality of links
When is the only time the zero touch provisioning feature can be used(fortideploy)
When fortigate restarts after factor reset or on a new fortigate device provisioning
Why should you create an intranet IP pool that SDWAN orchestrator can use
When it creates the SDWAN network orchestrator will use an IP pool to assign IP addresses to the devices in the LAN segment and automatically create addresses objects and address groups based on this assignment
When will an SDWAN member be dead
When it reaches the failure threshold
Describe the two tunnel-search setting: selectors for phase1 of a dial up vpn and when the tunnel-search setting applies
When net-device is disabled Fortigate learns about the remote networks behind each remote client depending on what tunnel-search is set to If set to selectors fortigate uses the destination subnets of the quick mode selectors to populate the routing table with information about the remote networks. In this scenario fortigate needs to use the tunnel index's to route traffic to each remote network
When are SLA targets usef
When referenced by a rule
Where would you specify the cost of an SDWAN interface when you want to use the lowest cost (SLA) strategy
When you add the interface as a member to the SDWAN virtual interface it gives you the option to select interface, specify gateway, specify cost, and enable or disable
What the the performance SLA - link status for
Where you can set how often the system checks the link status to determine if it needs to transfer the traffic to another link
What is reverse direction shaping
Will shape any incoming traffic
How are SLA violations marked on the link quality performance SLA page
With red numbers
Is a member considered alive if it is failing the SLA target
Yes
Can different vdoms be assigned to different ADOMs on fortimanager if they belong to the same device
Yes if advanced mode is enabled
Do you need to specify an SLA for the best quality strategy and why
Yes you specify the SLA to be used but you don't use the SLA targets Fortigate estimates the quality of each link based on either latency jitter or packet loss percentage (you can specify the quality criteria)
Describe a scenario in which there would be multiple SLA targets for one performance SLA
You are located in a branch office and use a few different application that run on the same server headquarters. You could create on performance SLA that will perform the health check on that server but then have different SLA targets for the different applications.
SDWAN rules: lowest cost (SLA) strategy
You select an SLA target from a performance SLA. The selected SDWAN member (based on order from top down) must satisfy all the selected SLA targets to be considered as a selection for the outgoing interface
SDWAN rule strategy: manual
You specify the interface priority you want to send traffic out from. Traffic matching the rule criteria will go out the first available interface based on the interface preference. Does not depend on performance SLA or targets.
What do you get when you include fortideploy on your fortinet device order
You will receive a bulk deployment forticloud key tied to all support devices within that order so that you can enter the bulk key in forticloud for all devices instead of each individual one
What happens when SNAT-route-change is disabled and what happens when it is enabled
disabled - After a routing change the sessions with SNAT keep using the same outbound interface as long as the old route is still active Enabled - routing information is flushed from existing SNAT sessions (flagged as dirty) so the existing sessions can use the new best route Route cache entries are removed Routing lookups are done again for the next packets RPF is done again
How does zero touch provisioning work on a fortigate without internet access or policies, etc
https://www.historiantech.com/zeroish-touch-provisioning-connect-to-fortimanager-via-the-dhcp-option/
SDWAN orchestrator shared resource categories (5)
include: Intranet addresses Network SLA System Health threshold
Diagnose sys virtual-wan-link member | service
information related to SDWAN rules shows interface preference, state, etc
What feature is essential for SDWAN (how to know if link is down)
link quality measurements
Formula for tunnels for a hub and spoke topology
n - 1
Another name for traffic shaping
qos
What is a security association
security association is the establishment of shared security attributes between two network entities to support secure communication. Two types of SAs IKE IPsec
Local flag
session is to/from local stack
How are the link quality measurements used?
the values are used against the SLA criteria within the rules that are used to route traffic based on the link quality of each member
How to enable ADVPN shortcuts on OCVPN
"Auto discovery shortcuts" on the OCVPN GUI page
Six application identification methods
- ISDB - custom ISDB - FQDN - IP DSCP - Application control - customer application control
Three examples of when a routing change may occur
- when the order of the interfaces in the policy route changes - when an SDWAN member state changes - when there is a dynamic routing update
When should you use fortimanager in your network
-Large enterprises -Managed service providers
