Fortinet Exam NSE7_NST-7.2 Topic 1 Question 22 Discussion

Actual exam question for Fortinet's NSE7_NST-7.2 exam

Question #: 22
Topic #: 1

Refer to the exhibit, which shows oneway communication of the downstream FortiGate with the upstream FortiGate within a Security Fabric.

What three actions must you take to ensure successful communication? (Choose three.)

AEnsure the port for Neighbor Discovery has been changed.

BFortiGate must not be in NAT mode.

CEnsure TCP port 8013 is not blocked along the way

DYou must authorize the downstream FortiGate on the root FortiGate.

EYou must enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate.

Show Suggested Answer

Suggested Answer: C

Understanding protocol states:

proto_state=00: Indicates no traffic or a closed session.

proto_state=01: Typically indicates one-way ICMP traffic or a partially established TCP session.

proto_state=10: Indicates an established TCP session, where the session has completed the three-way handshake and both sides can send and receive data.

proto_state=11: Often indicates a fully established and active bidirectional session.

Explanation of correct answer:

proto_state=10 is the correct indication for an established TCP session as it signifies that the session is fully established and active.

Fortinet Network Security 7.2 Support Engineer Documentation

Fortinet Firewall Protocol State Documentation

by Carey at Mar 09, 2025, 06:54 AM

Limited Time Offer

25%

Off

Get Premium NSE7_NST-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tyra

2 months ago

I wonder if the exam will throw in a curveball and ask us to also enable the 'Backdoor Access' option on the FortiGate. You know, just to really keep us on our toes!

upvoted 0 times

Tasia

12 days ago

C) Ensure TCP port 8013 is not blocked along the way

upvoted 0 times

...

Jaime

22 days ago

B) FortiGate must not be in NAT mode.

upvoted 0 times

...

Stefany

1 months ago

A) Ensure the port for Neighbor Discovery has been changed.

upvoted 0 times

...

Whitney

2 months ago

This is a straightforward one. You need to make sure the communication port is open, and that the Security Fabric/Fortitelemetry is enabled on the receiving interface. Simple as that!

upvoted 0 times

Lonny

1 months ago

E) You must enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate.

upvoted 0 times

...

Gilma

1 months ago

C) Ensure TCP port 8013 is not blocked along the way

upvoted 0 times

...

Shaniqua

2 months ago

A) Ensure the port for Neighbor Discovery has been changed.

upvoted 0 times

...

Twila

2 months ago

Haha, I bet the exam writers just threw in that 'Neighbor Discovery' option to see if anyone would fall for it. That's a classic trick question!

upvoted 0 times

Lili

23 days ago

C) Ensure TCP port 8013 is not blocked along the way

upvoted 0 times

...

Loise

2 months ago

B) FortiGate must not be in NAT mode.

upvoted 0 times

...

Nakita

2 months ago

A) Ensure the port for Neighbor Discovery has been changed.

upvoted 0 times

...

Gladis

2 months ago

Authorizing the downstream FortiGate on the root FortiGate is definitely a requirement. It's the only way to ensure secure communication within the Security Fabric.

upvoted 0 times

Ryan

26 days ago

Enabling Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate is another important step.

upvoted 0 times

...

Georgeanna

1 months ago

Also, make sure TCP port 8013 is not blocked along the way.

upvoted 0 times

...

Verda

2 months ago

Don't forget to ensure the port for Neighbor Discovery has been changed.

upvoted 0 times

...

Alisha

2 months ago

Yes, authorizing the downstream FortiGate on the root FortiGate is crucial for secure communication.

upvoted 0 times

...

Jestine

3 months ago

In addition to those, we must enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate.

upvoted 0 times

...

Xochitl

3 months ago

C and E seem like the obvious choices here. Why would I need to change the Neighbor Discovery port or check if the FortiGate is in NAT mode? That doesn't seem relevant to this scenario.

upvoted 0 times