Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Fortinet Exam FCSS_EFW_AD-7.4 Topic 5 Question 3 Discussion

Actual exam question for Fortinet's FCSS_EFW_AD-7.4 exam
Question #: 3
Topic #: 5
[All FCSS_EFW_AD-7.4 Questions]

Refer to the exhibits.

The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server 172.16.0.254 are shown.

Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message: Packet needs to be fragmented but DF set?

Show Suggested Answer Hide Answer
Suggested Answer: C

The issue occurs because FortiGate enforces the 'do not fragment' (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of 1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.

To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.


by Germaine at Apr 04, 2025, 11:03 PM

Limited Time Offer

25%

Off

Get Premium FCSS_EFW_AD-7.4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Sherly
9 days ago
I wonder if the user tried turning it off and on again. That usually fixes everything, right? Oh, wait, that's just for IT support calls.
upvoted 0 times
...
Leota
20 days ago
I bet the exam writers thought this one would really stump the candidates. Good thing the FortiGate's behavior is well-documented.
upvoted 0 times
...
Shannon
26 days ago
The user must have a keen eye for detail to spot the MTU discrepancy. Option C is the winner here.
upvoted 0 times
Luann
7 days ago
That makes sense, the user must have missed that detail.
upvoted 0 times
...
Rebecka
8 days ago
Yes, FortiGate honors the do not fragment bit and the packets are dropped.
upvoted 0 times
...
Sommer
15 days ago
I think the user needs to adjust the ping MTU to 972 to succeed.
upvoted 0 times
...
...
Janine
1 months ago
Hmm, the 'Packet needs to be fragmented but DF set' message is a dead giveaway. C is the way to go.
upvoted 0 times
Nikita
18 days ago
C) FortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust the ping MTU to 972 to succeed.
upvoted 0 times
...
...
Kris
1 months ago
Adjusting the ping MTU to 972 is a clever solution. I wouldn't have thought of that.
upvoted 0 times
Tawny
29 days ago
User2: Yes, it's important to understand how MTU affects connectivity.
upvoted 0 times
...
Cherri
1 months ago
User1: Adjusting the ping MTU to 972 is a clever solution.
upvoted 0 times
...
...
Gilberto
1 months ago
The issue is clearly related to the MTU mismatch between the user's PC and the FortiGate. Option C seems like the correct answer.
upvoted 0 times
...
Hui
1 months ago
Hmm, that makes sense too. Maybe we should review the exhibit again to confirm.
upvoted 0 times
...
Cherry
2 months ago
I disagree, I believe the answer is A. The user needs to adjust the ping MTU to 1000 to succeed.
upvoted 0 times
...
Hui
2 months ago
I think the answer is C. FortiGate drops packets when the do not fragment bit is honored.
upvoted 0 times
...

Save Cancel