Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

d-AG-NSE5-FMG 7.0 > 07. Diagnostics And Troubleshooting > Flashcards

07. Diagnostics And Troubleshooting Flashcards

1
Q

FMG behind NAT default settings

A

only FortiManager can discover a new device.
If the FGFM tunnel is torn down, only FortiManager tries to reestablish the FGFM tunnel.
By default, the NATed FortiManager IP address is not configured on FortiGate central management.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

FMG behind NAT best practice

A

configure the FortiManager NATed IP address on FortiGate under the central management configuration.
This allows FortiGate to announce itself to FortiManager and try to re-establish the FGFM tunnel, if it is torn down.

On FGT
Config system central-management
Set fmg {FMG natted IP address}
End

On FMG
Config system admin settings
Set mgmt-addr {FMG natted ip address}
End

if you configure the FortiManager NATed IP address under the FortiManager system administrator settings, FortiManager sets this address on FortiGate during the discovery process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Fortigate behind NAT

A

FortiManager can discover FortiGate through the FortiGate NATed IP address.
FortiGate can also announce itself to FortiManager

If the FGFM tunnel is torn down, only FortiGate attempts to reestablish the connection.
FortiManager treats the NATed FortiGate as an unreachable device and doesn’t attempt to reestablish the FGFM tunnel.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

FMG and FGT behind NAT

A

FortiGate device is discovered by FortiManager through the FortiGate NATed IP address.

FortiManager does not attempt to reestablish the FortiGate to FortiManager (FGFM) tunnel to the FortiGate NATed IP address, if the FGFM tunnel is interrupted.
If the FortiManager NATed IP address is configured on FortiGate under the central management configuration, FortiGate tries to reestablish the FGFM tunnel, if it is torn down.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

FGFM keepalive messages

A

Only FGT sends keep alive messages regardless who initiated FGFM tunnel

Keep alive include configuration checksums

The messages also show ips version of the FortiGate device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Keepalive message includes

A

fgfm-sock-timeout: the maximum FortiManager or FortiGate communication socket idle time, in seconds

fgfm_keepalive_itvl: the interval at which the FortiGate sends a keepalive signal to a FortiManager device to keep the FortiManager or FortiGate communication protocol active

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When FGFM tunnel is torn down

A

If there are no responses to the keepalive messages for the duration of the sock timeout value

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

FGFM debug on FGT

A

Diag debug application fgfmd 255
Diag debug en

Shows keepalive messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

FGFM debug on FMG

A

Diag debug application fgfmsd 255
Diag debug en

Shows keepalive messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Recovery logic FMG

A

For each installation, FortiManager sends the following commands to the managed FortiGate device:
• Set commands, needed to apply the configuration changes
test FGFM tunnel, if down

Unset commands, to recover the configuration changes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Recovery logic FGT

A

When applying changes, FortiGate:
• Applies the set commands, using memory only, nothing written to a configuration file
• Tests the FGFM connection to FortiManager
If the connection fails to reestablish, FortiGate applies the unset command after 15 minutes (not configurable and not based on sock timeout values)

Optional config (disabled by default)

Config system dvm
Set rollback-allow-reboot enable
End

If the connection remains down, and rollback-allow-reboot is enabled on FortiManager, FortiGate reboots to recover the previous configuration from its configuration file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

replace the standalone managed device (RMA)

A

manually change the serial number of the faulty device to the serial number of the replacement device on FortiManager. Then, you redeploy the configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

replacing a FortiGate cluster member

A

FortiManager learns the new serial number through the FGFM tunnel

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Steps to replace managed device

A

1.note original FGT device name
Diag dvm device list
2. Update serial number
Exe device replace sn <dev> <new>
3. Verify sn was updated on FMG side
Diag dvm device list
4. Send registration request from replaced FGT
5. If connectivity fails after you update the serial number, you might need to reclaim the management tunnel.
Exe fgfm reclaim-dev-tunnel <optional,device name></new></dev>

Note that the replacement FortiGate should not contact FortiManager before the execute device replace sn <devname> <serialnum> command is run. If it does, you will have to delete the unregistered device entry prior to rerunning the command.</serialnum></devname>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What happens if you reclaim management tunnel without specifying device name?

A

Exe fgfm reclaim-dev-tunnel

FortiManager tries to reclaim tunnels from all managed devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

If FMG is behind NAT, what step is recommended

A. Configure nated ip,address,of FMG with set mgmt-addr command under the conf system admin settings
B. Configure NAT ip address on fortigate

A

A. Configure nated ip,address,of FMG with set mgmt-addr command under the conf system admin settings

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does fgfm-sock-timeout command does

A. It sets idle time out setting for communication between FMG and FGT
B. It sets idle time out setting for communication between FMG and public Fortiguard server

A

A. It sets idle time out setting for communication between FMG and FGT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

CLI commands to confirm FGFM tunnel is up

A

Diag fgfm session-list
Diag dvm device list

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

CLI command to read crash log

A

Diag debug crashlog read

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Diag snif pack command on FMG

A

Unlike FGT, FortiManager supports only verbose options 1, 2, and 3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

partitions on FortiManager

A

/dev/shm is used as shared memory.
• /tmp is temporary file storage file system.
• /data is the pointer to the flash disk partition.
• /var is used for FortiManager database storage.
• /drive0 is used as the FortiAnalyzer archives and postgres database.
• /Storage is used for FortiAnalyzer log and report storage.

View partitions with
diagnose system print df command

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Processes status

A

Check for any locked processes

On idle system no process should be locked

Diag dvm lock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Stuck process or task

A

Diag dvm proc list

Task 81 (pending) 1 lines, 0% done

cancel or delete the pending (stuck) task from Task Monitor on the System Settings pane.

24
Q

Show current debug settings

A

Diag debug info

25
Q

Reset debug settings to defaults

A

Diag debug reset

26
Q

Debug device level operations such as registering, deleting, auto update, refresh, resend process

A

Diag debug application dmapi 255

27
Q

Debug ADOM to device db copy process and import policy packages

A

Diag debug application securityconsole 255

28
Q

Debug registration process and install process including CLI scripts run directly on devices, retrieves and revision history

A

Diag debug application depmanager 255
Diag debug dpm conf-trace enable

29
Q

Best practice before performing a firmware upgrade

A

Make sure all administrators are logged off, and perform database integrity checks

30
Q

What if integrity issue can’t be resolved

A

If you cannot resolve a data integrity issue, you can perform a factory reset on FortiManager, and then restore the configuration using a good backup configuration.

31
Q

What command can you use to sniff FGFM communication between FMG and FGT

A. Diag sniffer packet any “port 8113” 3
B. Diag sniffer packet any “port 541” 3

A

B. Diag sniffer packet any “port 541” 3

32
Q

Which statement about FMG best practices is true

A. To shutdown FMG always do graceful shutdown by running exe shutdown CLI command
B. to shutdown FMG unplug power cable

A

A. To shutdown FMG always do graceful shutdown by running exe shutdown CLI command

33
Q

How to see what templates applied to particular device

A

check from the Provisioning Templates widget, or from the individual device Configuration and Installation Status widget

34
Q

Display whole device configuration

A

Exe fmpolicy print-device-database

displays the device configuration, including device-level changes made from FortiManager. It does not display the changes caused by applying the system template. Also, ADOM-level configuration changes made from FortiManager, such as firewall policies and objects, are not displayed. These changes are applied (copied) to the device-level database at the installation.

35
Q

Display individual object config

A

Exe fmpolicy print-device-object

Does not display any ADOM level (fw policy and related objects) changes made from FMG

36
Q

view the policies and objects at the ADOM level

A

Exe fmpolicy print-adom-database
Exe fmpolicy print-adom-package
Exe fmpolicy print-adom-object

37
Q

If you view the policies for the Local-FortiGate at the device level, is the newly configured firewall policy shown?

A

At the device level, ADOM-level (firewall policy and related objects) configuration changes that have been made from FortiManager are not displayed until after the Policy & Objects installation is performed.

38
Q

Which command is useful when troubleshooting ADOM level issues

A. Execute fmpolicy print-device-object
B. execute fmpolicy print-adom-database

A

B. execute fmpolicy print-adom-database

39
Q

Which FGT configuration setting is part,of device-level database on FMG

A. Routing
B. Firewall policies

A

A. Routing

40
Q

What happens When you execute the reload failure command?

A

FortiManager connects to FortiGate and downloads its configuration file. Then, FortiManager performs a reload operation on the device database.

There are two possible outcomes:
- If there are no errors in the FortiGate configuration, the reload is successful, and the device-level databaseis updated with the FortiGate configuration. However, note that a new revision history entry is not created.
- If there are errors in the FortiGate configuration, the output of the reload command indicates the point in the configuration at which the device-level database failed to update.

41
Q

What is Failed reload

A

An operation that fails to update device-level database from revision history database

Typically from inconsistent or failed FortiGate configuration

42
Q

Troubleshooting reload failure

A

Diag test deploymanager reloadconf {dev id}

Device id get from
Diag dvm device list output

43
Q

Dynamic mapping for an address object

A

FortiManager can create a dynamic mapping for an address object, if the address object name is the same, but contains a different value locally.
However, there is one restriction—the associated interface cannot be different. This is because, at the ADOM level, this address object might be used by other policy packages, which might not have the same interfaces.

44
Q

How to approach Import issues

A
  1. Verify that policies and objects have been imported into ADOM database (no failures)
  2. Check download import report for reason on failed import
  3. If local logging set to debug level, local event logs will contain failed import details
45
Q

Installation of policy with failed import objects

A

attempt to install it using the installation wizard for Policy & Objects, FortiManager deletes the failed objects and
policies. This is because the policy package is not aware of missing or failed policies and objects.

46
Q

Ways to fix failed import issues due to interface binding

A
  1. You can remove the interface binding to make it the same as the FortiManager ADOM object.
  2. If there is a need to keep the interface binding for FortiGate that is having issues with a partial policy import, you can rename the address object to a unique name that is not part of the ADOM database

In either case run a script from FortiManager using the Remote FortiGate Directly (Via CLI) option, or you can locally log in to FortiGate to make the configuration change.

47
Q

Copy operation during installation

A

copy operation is the first operation that FortiManager performs, before you perform the actual installation.
It is the operation in which FortiManager tries to copy the ADOM-level object or policy to the device database. It is the opposite of the import operation.

48
Q

What is the reason for Copy failure. What to check for tips to identify issue

A

Copy failure issues are usually caused by having incorrect or missing object dependencies when copying from the ADOM database to the device database. The incorrect or missing object dependencies are caused by corruption or inconsistencies in the FortiManager database.

View Progress Report section helps you to identify the failing issue.

49
Q

Default behaviour when copy failure happens

A

When a copy failure happens, the device database is restored to its original state, prior to the copy attempt

50
Q

3 main reasons why installation may fail

A
  1. An ADOM and FGT version mismatch
  2. Incorrect object attribute modification caused by ADOM version upgrade
  3. Incorrect order of operations on FMG
51
Q

Remote original

A

Value configured on FGT after installation attempt

52
Q

What is To be installed value?

A

Value that was expected to be installed based on changes from FMG

53
Q

Verification report shows

A

differences between the configuration that was expected to be installed and what was installed on the FortiGate device

54
Q

Failed installation resolution

A

First, verify that the FortiGate version is the same as, or supported by, the ADOM version.
If the FortiGate version is not supported by the ADOM version, or if FortiManager doesn’t support some FortiGate CLI features, then:
1. Move the FortiGate device to the supported ADOM, or use the script to resolve the issue.
2. Perform the installation again.

If the ADOM version is correct or the ADOM upgrade was performed, then:
1. Retrieve the FortiGate configuration so that FortiManager updates the device database with the correct syntax.
2. Make a small device-level change and install it to ensure that there is not a device-database issue.
• If the installation is unsuccessful, check and fix the device-level settings.
• If the installation is successful, check and, if needed, recreate the object or policy.
3. Perform the installation again

As a last resort, to isolate and fix the installation failure issues, you can:
1. Create a new ADOM with matching firmware on FortiGate.
2. Move FortiGate to the new ADOM.
3. Retrieve the configuration and import policy packages.
4. Recreate the object or policy from the FortiManager GUI (if supported), or using a script, and perform the installation

55
Q

What does status Copy Failed indicate

A. Operation that failed to copy device database from revision history
B. Operation that failed to copy ADOM level policy or object to device database

A

B. Operation that failed to copy ADOM level policy or object to device database

56
Q

Admin configured new policy on FMG and had not pushed changes to managed FGT. In which DB changes will be saved

A. ADOM level database
B. Device level database

A

A. ADOM level database

d-AG-NSE5-FMG 7.0 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions