StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · IPsec VPNs

Practice question 386 of 440 · medium

A WAN firewall rule permits TCP port 50 but blocks IP protocol 50. IKE over UDP 500 succeeds, while a native ESP path fails. Which change addresses the transport misunderstanding?

Choose the single best answer.

  1. A.Permit TCP port 500 instead.
  2. B.Require every ESP packet to use a TCP application port.
  3. C.Replace Phase 2 selectors with the value 50.
  4. D.Permit native ESP as IP protocol 50 where the design requires it.
Show the answer and explanation

✓ Correct answer

  • Permit native ESP as IP protocol 50 where the design requires it.

Native ESP is IP protocol 50, not TCP/UDP port 50. IKE’s UDP 500 is separate. Selector values do not change ESP into a TCP service, and TCP 500 does not permit the intended native encapsulation.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.