Dialup IPsec VPN II

Question 1 of 16

1

Uses UDP port 500 (and UDP port 4500 when crossing NAT)
Negotiates a tunnel’s private keys, authentication, and encryption
One lPsec SA is used per trafﬁc direction.
Phases:
Phase1
Phase2

Select one of the following:

IKE
ESP
AH

Explanation

Question 2 of 16

1

Phase 1 negotiation modes

Select one of the following:

main mode
aggresive mode
main mode
quick mode

Explanation

Question 3 of 16

1

Phase 2 negotiation mode

Select one of the following:

aggresive mode
quick mode

Explanation

Question 4 of 16

1

takes place when each endpoint of the tunnel—the initiator and the responder—connects and begins to set up the VPN.

Select one of the following:

Phase 1
Phase 2

Explanation

Question 5 of 16

1

❌ Negotiate one bidirectional SA (called IKE SA) ln IKE v1, two possible ways: -Main mode: six packets exchanged -Aggressive mode: three packets exchanged Not the same as ﬁnal SAs later Encrypted tunnel for Difﬁe-Hellman (DH)

❌ Authenticate peers Pre—shared key or digital signature *Extended authentication (XAuth)

❌ DH exchange for secret keys

Drag and drop to complete the text.

2.

1 .

3.

Explanation

Question 6 of 16

1

Key agreement method:
Independently calculate a private key using only public keys

Each FortiGate uses a shared secret key plus a nonce to calculate keys for the following:
Symmetric encryption algorithms (such as 3DES, AES)
Symmetric authentication (HMACs)

Select one of the following:

Diffie-Hellman
IKE
ESP

Explanation

Question 7 of 16

1

ESP can´t support NAT because it has no port numbers.

Select one of the following:

True
False

Explanation

Question 8 of 16

1

Negotiates two unidirectional SAs for ESP (called lPsec SAS)
Protected by phase IKE SA
When SAs are about to expire, it renegotiates
Optionally, if Perfect Forward Secrecy is set to Enabled, FortiGate uses Diffie-Hellman to generate new keys each time phase 2 expires.
Each phase 1 can have multiple phase 2s.
High security subnets can have stronger ESP.

Select one of the following:

Phase 2
Phase 1

Explanation

Question 9 of 16

1

Also, if you set ____________ to Enable, each time phase 2 expires, FortiGate will use Difﬁe-Hellman to recalculate new secret keys. In this way, new keys are not derived from older keys, making it much harder for an attacker to crack the tunnel.

Select one of the following:

Perfect Forward Secrecy
NAT-Transversal
Split tunneling

Explanation

Question 10 of 16

1

If multiple phase 2 exist, FortiGate directs trafﬁc to the correct phase 2.
Allows granular security settings for each LAN.
If trafﬁc does not match an lPsec SA selector, it is dropped.
ln point-to-pointVPNs, selectors must match.
- The source on one FortiGate is the destination setting on the other.

Select which SA to apply using:
Destination and source IP subnet(s)
Protocol number
Source port and destination port

Select one of the following:

Quick mode selectors
Phase 2
Phase 1
Agressive mode

Explanation

Question 11 of 16

1

During phase 2, you must conﬁgure a pair of settings called quick mode selectors. They identify and direct traffic to the appropriate phase 2. In other words, they allow granular SAs.

Select one of the following:

True
False

Explanation

Question 12 of 16

1

In aggressive mode, how many packets are exchanged to establish phase 1 of the lPsec tunnel?

Select one of the following:

A. Six
B. Three

Explanation

Question 13 of 16

1

Which statement about quick mode selectors is true?

Select one of the following:

A. Only phase 2 has quick mode selectors.
B. Only phase 1 has quick mode selectors.

Explanation

Question 14 of 16

1

Settings need in Dialup VPN between two fortigates

Select one of the following:

A phase 1
At least one phase 2
Firewall policies
Static routes or a dynamic routing protocol
A phase 1
At least one phase 2
Firewall policies
Static routes or a dynamic routing protocol
IPsec interface

	Created by Marcos Avila about 6 years ago

NSE4 6.0 NSE4 6.0 Quiz on Dialup IPsec VPN II, created by Marcos Avila on 13/09/2018.

Dialup IPsec VPN II

Question 1 of 16

Uses UDP port 500 (and UDP port 4500 when crossing NAT) Negotiates a tunnel’s private keys, authentication, and encryption One lPsec SA is used per trafﬁc direction. Phases: Phase1 Phase2

Select one of the following:

Explanation

Question 2 of 16

Phase 1 negotiation modes

Select one of the following:

Explanation

Question 3 of 16

Phase 2 negotiation mode

Select one of the following:

Explanation

Question 4 of 16

takes place when each endpoint of the tunnel—the initiator and the responder—connects and begins to set up the VPN.

Select one of the following:

Explanation

Question 5 of 16

Drag and drop to complete the text.

Explanation

Question 6 of 16

Key agreement method: Independently calculate a private key using only public keys Each FortiGate uses a shared secret key plus a nonce to calculate keys for the following: Symmetric encryption algorithms (such as 3DES, AES) Symmetric authentication (HMACs)

Select one of the following:

Explanation

Question 7 of 16

ESP can´t support NAT because it has no port numbers.

Select one of the following:

Explanation

Question 8 of 16

Select one of the following:

Explanation

Question 9 of 16

Also, if you set ____________ to Enable, each time phase 2 expires, FortiGate will use Difﬁe-Hellman to recalculate new secret keys. In this way, new keys are not derived from older keys, making it much harder for an attacker to crack the tunnel.

Select one of the following:

Explanation

Question 10 of 16

Select one of the following:

Explanation

Question 11 of 16

During phase 2, you must conﬁgure a pair of settings called quick mode selectors. They identify and direct traffic to the appropriate phase 2. In other words, they allow granular SAs.

Select one of the following:

Explanation

Question 12 of 16

In aggressive mode, how many packets are exchanged to establish phase 1 of the lPsec tunnel?

Select one of the following:

Explanation

Question 13 of 16

Which statement about quick mode selectors is true?

Select one of the following:

Explanation

Question 14 of 16

Settings need in Dialup VPN between two fortigates

Select one of the following:

Explanation

Question 15 of 16

Dialup IPsec is also known as

Select one of the following:

Explanation

Question 16 of 16

IKE mode configuration automatically configures network settings?

Select one of the following:

Explanation

Uses UDP port 500 (and UDP port 4500 when crossing NAT)
Negotiates a tunnel’s private keys, authentication, and encryption
One lPsec SA is used per trafﬁc direction.
Phases:
Phase1
Phase2

Key agreement method:
Independently calculate a private key using only public keys

Each FortiGate uses a shared secret key plus a nonce to calculate keys for the following:
Symmetric encryption algorithms (such as 3DES, AES)
Symmetric authentication (HMACs)