Fortinet FCSS_EFW_AD-7.6 Exam Dumps

In the given ADVPN (Auto-Discovery VPN) topology, BGP is being used to dynamically establish routes between spokes. The neighbor-range configuration is crucial for simplifying BGP peer setup by automatically assigning neighbors based on their IP range.

set neighbor-group advpn

The neighbor-group parameter is used to apply pre-defined settings (such as AS number) to dynamically discovered BGP neighbors.

The advpn neighbor-group is already defined in the configuration, and assigning it to the neighbor-range ensures consistent BGP settings for all spoke neighbors.

set prefix 172.16.1.0 255.255.255.0

This command allows dynamic BGP peer discovery by defining a range of potential neighbor IPs (172.16.1.1 - 172.16.1.255).

Since each spoke has a unique /32 IP within this subnet, this ensures that any spoke within the 172.16.1.0/24 range can automatically establish a BGP session with the hub.

When configuring a loopback interface as the BGP source for connecting to an ISP, two important settings must be applied:

1. Enable EBGP Multihop (ebgp-enforce-multihop)

2. Set the Update Source (update-source)

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence the preferred path for incoming traffic from an external autonomous system (AS). The diagram shows that FortiGate_1 advertises MED 200, while FortiGate_2 advertises MED 300, meaning the ISP will prefer the route through FortiGate_1 because a lower MED is preferred in BGP.

To modify the MED value on FortiGate_1 for routes advertised to AS 30, the administrator must configure a route-map-out. A route map can match specific routes and set the MED value before sending them to the BGP neighbor.

Since Core1 and Core2 are not designated as management VDOMs, they rely on the root VDOM for connectivity to external resources such as FortiGuard updates. If the root VDOM lacks a VDOM link to these VDOMs or cannot reach FortiGuard services, security features like web filtering will stop working.

Unlike IPS or antivirus databases, FortiGate does not store a full web filter database locally. Instead, FortiGate queries FortiGuard (or FortiManager, if configured) dynamically to classify and filter web content in real time.

Key points:

Web filtering works on a cloud-based model:

When a user requests a website, FortiGate queries FortiGuard servers to check its category and reputation.

The response is then cached locally for faster lookups on repeated requests.

No local web filter database version:

Unlike IPS and antivirus, which download and store signature updates locally, web filtering relies on cloud-based queries.

This is why no database version appears in the GUI.

Flow mode vs Proxy mode:

In proxy mode, FortiGate can cache some web filter data, improving performance.

In flow mode, all queries happen dynamically, with no locally stored database.