A VPN configuration includes a static route to 10.22.0.0/24 using device Site-B, but the host’s actual destination is 10.23.0.20. The tunnel SAs are up. What should be checked first?

Choose the single best answer.

A.Whether the intended destination has a correct route and matching selectors/policy.
B.Whether Phase 1 encryption is strong enough to recognize all subnet addresses.
C.Whether SAs automatically add routes for every nearby subnet.
D.Whether the peer’s GUI dashboard has been refreshed.

Show the answer and explanation

✓ Correct answer

Whether the intended destination has a correct route and matching selectors/policy.

A route and selectors for one /24 do not establish a path or authorization for another. Cryptographic strength and a dashboard refresh do not add the missing destination coverage. Inspect the exact tuple rather than treating SA state as universal reachability.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.