Fortinet FCSS_EFW_AD-7.4 Exam Dumps

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence the preferred path for incoming traffic from an external autonomous system (AS). The diagram shows that FortiGate_1 advertises MED 200, while FortiGate_2 advertises MED 300, meaning the ISP will prefer the route through FortiGate_1 because a lower MED is preferred in BGP.

To modify the MED value on FortiGate_1 for routes advertised to AS 30, the administrator must configure a route-map-out. A route map can match specific routes and set the MED value before sending them to the BGP neighbor.

In a transparent mode Virtual Domain (VDOM) configuration, FortiGate operates as a Layer 2 bridge rather than performing Layer 3 routing. The set forward-domain <domain_ID> command is used to control how traffic is forwarded between interfaces within the same transparent VDOM.

A forward-domain acts as a broadcast domain, meaning only interfaces with the same forward-domain ID can exchange traffic. This setting is commonly used to separate different VLANs or network segments within the transparent VDOM while still allowing FortiGate to apply security policies.

When configuring ADVPN (Auto-Discovery VPN) to connect overlay networks across different hubs using IBGP and EBGP, special configurations are required to allow spokes from different overlay networks to dynamically establish tunnels.

set auto-discovery-crossover enable

This allows cross-hub tunnel discovery in an ADVPN deployment where multiple hubs are used.

Since Hub A and Hub B belong to different overlays, enabling crossover discovery ensures that spokes from one overlay can dynamically create direct tunnels to spokes in the other overlay when needed.

set enforce-multihop enable

This setting ensures that BGP peers using loopback interfaces can establish connectivity even if they are not directly connected.

Multihop BGP sessions are required when using loopback addresses as BGP peer sources because the connection might need to traverse multiple routers before reaching the BGP neighbor.

This is especially useful in ADVPN deployments with multiple hubs, where routes might need to cross from one hub to another.

neighbor-group:

This command is used to group multiple BGP neighbors with the same configuration, reducing redundant configuration.

Instead of defining individual BGP settings for each spoke, the administrator can create a neighbor-group and apply the same policies, reducing manual work.

neighbor-range:

This command allows the configuration of a range of neighbor IPs dynamically, reducing the need to manually define each spoke neighbor.

It automatically adds BGP neighbors that match a given prefix, simplifying deployment.

To minimize CPU and RAM usage while still enforcing security features like web filtering and application control, SSL certificate inspection mode is the best choice.

SSL certificate inspection allows FortiGate to inspect only the SSL/TLS handshake, including the Server Name Indication (SNI) and certificate details, without decrypting the full encrypted payload.

This enables features like web filtering and application control because FortiGate can determine the destination website or application based on SNI and certificate information.

It significantly reduces system load compared to full SSL inspection, which requires full decryption and re-encryption of traffic.