Refer to the exhibit.
You deployed an active-passive FortiGate HA cluster using a CloudFormation template on an existing VPC. Now you want to test active-passive FortiGate HA failover by running a debug so you can see the API calls to change the Elastic and secondary IP addresses.
Which statement is correct about the output of the debug?
HA Event and Failover:
The debug output indicates that a failover event occurred and the secondary instance (Fgt2) is now taking over as the master.
Elastic IP Association:
The debug output shows the process of moving the Elastic IP (eipalloc-090425f83f912c8d6) to the new master instance. This involves associating the Elastic IP with the appropriate network interface (eni) of the new master.
Specific IP Address Association:
The Elastic IP is specifically associated with port1 of Fgt2. The message 'associate elastic ip eipalloc-090425f83f912c8d6 to 10.0.0.13 of eni eni-0f6b35f8fccd24eb0' indicates that the Elastic IP is now linked to the primary IP address (10.0.0.13) on port1 of the new master.
Other Options Analysis:
Option A is incorrect because the routing table update details are not explicitly stated.
Option C is incorrect because the IP address association mentioned relates to an Elastic IP, not eni-0b61d8afc0aefb8a2.
Option D is incorrect because it specifically mentions port2 for the Elastic IP association, which is not indicated in the debug output.
FortiGate HA Configuration Guide: FortiGate HA
AWS native network services offer vast functionality and inter-connectivity between the cloud and on-premises networks.
Which three additional functions can FortiGate for AWS offer to complement the native services offered by AWS? (Choose three.)
Web Filtering:
FortiGate for AWS offers advanced web filtering capabilities, which allow organizations to control and monitor web access. This feature complements AWS's native security services by providing granular control over web traffic (Option B).
OSPF over IPSec:
FortiGate for AWS can establish dynamic routing protocols such as OSPF (Open Shortest Path First) over IPSec tunnels. This capability enhances network routing flexibility and security, which is not natively provided by AWS (Option C).
Secure SD-WAN with Application Visibility:
FortiGate for AWS provides Secure SD-WAN functionality, offering enhanced application visibility and traffic management. This is a significant addition to AWS's networking services, optimizing application performance and security (Option E).
Comparison with Other Options:
Option A (Higher VPN throughput) is not specifically enhanced by FortiGate as compared to AWS native services.
Option D (Advanced dynamic routing) is partially covered under OSPF over IPSec but is not as specific as the other chosen options.
FortiGate for AWS Documentation: FortiGate on AWS
Refer to the exhibit.
What occurs during a failover for an active-passive (A-P) cluster that is deployed in two different availability zones? (Choose two.)
Cluster Elastic IP Address (EIP) Movement:
During a failover in an active-passive (A-P) cluster, the Elastic IP (EIP) associated with the active FortiGate instance (FGT-1) needs to be moved to the passive instance (FGT-2), which becomes the new active instance. This ensures that the traffic directed to the EIP is now handled by FGT-2 (Option A).
Secondary IP Address Movement:
The secondary IP address on Port2 of the current active instance (FGT-1) is moved to the same port on the new active instance (FGT-2). This step is crucial to ensure seamless network traffic redirection and connectivity for the services relying on that IP address (Option B).
Other Options Analysis:
Option C is incorrect because the static route modification mentioned is not directly related to the failover process described.
Option D is incorrect because no additional route needs to be added to the HA Sync AZ2 subnet route table to forward traffic to the Internet Gateway during a failover.
FortiGate HA Configuration Guide: FortiGate HA
Refer to the exhibit.
An administrator configured a FortiGate device to connect to the AWS API to retrieve resource values from the AWS console to create dynamic objects for the FortiGate policies. The administrator is unable to retrieve AWS dynamic objects on FortiGate.
Which two reasons can explain why? (Choose two.)
Invalid Credentials:
The debug output shows an 'AuthFailure' error, indicating that AWS was not able to validate the provided access credentials. This usually points to incorrect or invalid AWS access or secret keys configured in the AWS Lab SDN connector (Option C).
Clock Skew:
Another common reason for authentication failures in AWS API calls is a clock skew between the FortiGate device and AWS. AWS requires that the system time of the client making the API call is synchronized with its own time, within a small margin. If there is a significant time difference, AWS will reject the credentials (Option B).
Other Options Analysis:
Option A is incorrect because the AWS API supports XML version 1.0.
Option D is incorrect as the error message does not indicate an issue with connecting on port 401.
Option E is incorrect because the error is related to authentication, not the absence of instances.
AWS API Authentication: AWS API Security
FortiGate AWS Integration Guide: FortiGate AWS Integration
A customer has implemented GWLB between the partner and application VPCs. FortiGate appliances are deployed in the partner VPC with multiple AZs to inspect traffic transparently.
Which two things will happen to application traffic based on the GWLB deployment? (Choose two.)
Understanding Gateway Load Balancer (GWLB):
GWLB is designed to distribute traffic across multiple appliances for both inbound and outbound traffic, providing scalability and high availability.
Traffic Load Balancing:
GWLB can send traffic to multiple FortiGate appliances for load balancing purposes, ensuring efficient use of resources (Option A).
Stateful Processing:
For stateful processing, GWLB ensures that traffic flows (both inbound and outbound) for a given connection are directed to the same FortiGate appliance. This maintains session integrity (Option B).
Preservation and Hashing of Traffic:
Options C and D are incorrect as they suggest incorrect behavior regarding traffic content preservation and hashing for data integrity, which are not primary functions of GWLB.
AWS Gateway Load Balancer Documentation: AWS Gateway Load Balancer
FortiGate Integration with GWLB: Fortinet Documentation
