View all questions & answers for the NSE 6 – LAN Edge 7.6 Architect Exam Materials exam
NSE 6 – LAN Edge 7.6 Architect Exam Materials - Question #27 Discussion
Community Explanations & Comments (4)
Mohamed Shaban
8 months ago
Selected: C
The missing configuration is a firewall policy that allows users’ unauthenticated traffic to reach the captive portal, as described on page p267.
In other words, you must have a policy from the user-facing interface that permits HTTP/HTTPS (and usually DNS) so the FortiGate can intercept the request and present the captive portal login page
so I think there is missing option for this question
In other words, you must have a policy from the user-facing interface that permits HTTP/HTTPS (and usually DNS) so the FortiGate can intercept the request and present the captive portal login page
so I think there is missing option for this question
Anonymous User
7 months ago
Selected: D
Either this question is rubbish, or if not, then only D remains as only possible answer. C is wrong, because adress objects have been added as exempt already. But setting exempt alone is not enough, we need an addition policy allowing traffic from WLAN Client to DNS and Authenticatior. I would assume to use the wireless interface as source, but as we only have the option of port 4 as source, I would choose this.
Bora
4 months ago
I agree with you
Anonymous User
6 months ago
Selected: C
I had this question in my exam. In this version the screenshot is not correct. In my exam, the FAC & AD were selected as source exempt. So C is the correct answer, because both objects has to be the exempt destination / service.
Anonymous User
4 months ago
Selected: D
correct choice is option D
However, FortiGate is a stateful firewall. Adding these servers to the "Exempt" list in the WiFi settings only ensures that the Wireless Controller itself does not block that traffic. For the traffic to actually pass through FortiGate's internal architecture from port4 (or the corresponding WiFi interface) to the port3 interface (the Server Block), a Firewall Policy must absolutely be in place.
In the current policy table, there is no rule configured for the Guest -> port3 direction! There is only a Guest -> port1 (Internet) rule available.
The correct choice is option D (Technical Root Cause): The interface to which the FortiAP is connected and where the guest traffic enters the FortiGate is port4. For guests to access the DNS (WindowsAD) and Authentication (FortiAuthenticator) servers located behind port3, a firewall policy with port4 (or the related Guest SSID interface) as the source and port3 as the destination is missing.
However, FortiGate is a stateful firewall. Adding these servers to the "Exempt" list in the WiFi settings only ensures that the Wireless Controller itself does not block that traffic. For the traffic to actually pass through FortiGate's internal architecture from port4 (or the corresponding WiFi interface) to the port3 interface (the Server Block), a Firewall Policy must absolutely be in place.
In the current policy table, there is no rule configured for the Guest -> port3 direction! There is only a Guest -> port1 (Internet) rule available.
The correct choice is option D (Technical Root Cause): The interface to which the FortiAP is connected and where the guest traffic enters the FortiGate is port4. For guests to access the DNS (WindowsAD) and Authentication (FortiAuthenticator) servers located behind port3, a firewall policy with port4 (or the related Guest SSID interface) as the source and port3 as the destination is missing.
Refer to the exhibits to analyze a network topology and SSID settings. FortiGate is configured to use an external captive portal for authentication to grant access to a wireless network. Testing detected that users attempting to access the SSID are not able to access the captive portal login page. Which configuration change should fix this issue? (Choose one answer)
Brave-Dump Community Votes