展示品を参照してください。
ネットワーク管理者は、2 つの FortiGate デバイス間の IPsec トンネルのトラブルシューティングを行っています。管理者は、フェーズ 1 が起動に失敗したと判断しました。また、管理者は両方の FortiGate デバイスで事前共有キーを再入力し、それらが一致することを確認しました。
フェーズ 1 の構成と図に示されている図に基づいて、管理者がフェーズ 1 を起動するために実行できる 2 つの構成変更はどれですか (2 つ選択してください)。
正解：C,D
To bring Phase 1 up, the following changes can be made:
A . On HQ-FortiGate, disable Diffie-Helman group 2: This is incorrect because Diffie-Hellman group 2 is already selected on both devices. Disabling it would not help.
B . On Remote-FortiGate, set port2 as Interface: This is incorrect as both sides should be consistent in their interface settings for the IPsec tunnel, and the interface is correctly set to port1 on both FortiGates in the IPsec configuration.
C . On both FortiGate devices, set Dead Peer Detection to On Demand: This is a valid option. Setting Dead Peer Detection (DPD) to "On Demand" helps maintain the IPsec connection by checking if the peer is still available, which can help in some cases where the connection fails due to timeouts.
D . On HQ-FortiGate, set IKE mode to Main (ID protection): This is also a valid option because the Remote-FortiGate is already set to Main mode (ID protection). Ensuring that both ends use the same mode is crucial for successful phase 1 negotiation.
Thus, the correct answers are:
C . On both FortiGate devices, set Dead Peer Detection to On Demand.
D . On HQ-FortiGate, set IKE mode to Main (ID protection).
