EXAM

Refer to the exhibit. High Availability configuration status Which two statements about the output are true considering NGFW-1 and NGFW-2 have been up for a week? (Choose two.). A. If a configuration change is made to the secondary FortiGate, the Configuration Status will not change. B. If a configuration change is made to the primary FortiGate at this time, the secondary will initiate a synchronization reset. C. If FGVM...649 is rebooted, FGVM...650 will become the primary FortiGate and retain that role, even after FGVM...649 rejoins the cluster. D. If port7 becomes disconnected on the secondary FortiGate, both FortiGate devices will elect themselves as primary.

In a Security Fabric environment, which three actions must you take to ensure successful communication among the nodes? (Choose three.). A. You must authorize the downstream FortiGate on the root FortiGate. B. You must configure FortiGate in transparent mode. C. You must enable FortiTelemetry on the receiving interface of the upstream FortiGate. D. You must ensure that the port for Neighbor Discovery has been changed. E. You must ensure that TCP port 8013 is not blocked along the way.

What are two functions of automation stitches? (Choose two.). A. You can configure automation stitches to run diagnostic commands and attach the results to an email message when CPU or memory usage exceeds specified thresholds. B. You can configure automation stitches to insert a delay between actions if the automation stiches are set to execute actions in parallel. C. You can configure automation stitches to modify packet headers and payloads if specific traffic triggers an anomaly IPS event. D. You can configure automation stitches to take parameters from previous actions as input for the next action if the automation stitches are set to execute actions in sequence.

During the SAML negotiation process, in which section does the identity Provider (IdP) provide the SAML attributes utilized in the authentication process to the service provider (SP)?. A. Assertion dump. B. Bindings HTTP post. C. Authentication request. D. Authentication response.

Refer to the exhibit. Two entries that were generated in the FSSO collector agent log is shown. Which three conclusions can you draw from these log entries? (Choose three.). A. Remote registry is not running on the workstation. B. The user’s status shows as “not verified” in the collector agent. C. DNS resolution is unable to resolve the workstation name. D. A firewall is blocking traffic to port 139 and 445. E. The logged on user is part of a group that is not configured in the group filter.

Refer to the exhibit. Network topology and a partial routing table Network topology and a partial routing table is shown. FortiGate has already been configured with a firewall policy that allows all ICMP traffic to flow from port1 to port3. Which two changes can the administrator perform to ensure the server at 10.4.0.1/24 receives the echo reply from the laptop at 10.1.0.1/24? (Choose two.). A. Modify the default gateway on the laptop from 10.1.0.2 to 10.1.0.254. B. Change the FortiGate configuration from strict RPF check mode to feasible RPF check mode. C. Enable asymmetric routing under config system settings. D. Add a default static route on FortiGate to forward all traffic to port3.

Refer to the exhibit. The output of the get router info bgp summary command is shown. Which statement regarding adjacencies between the local router and its neighbors is correct?. A. The local router and neighbor 100.64.2.254 are unable to establish adjacency because AS 100 is already used by neighbor 100.64.1.254. B. The local router and neighbor 100.64.2.254 are unable to establish adjacency until the adjacency with neighbor 100.64.1.254 ceases. C. The local router and neighbor 100.64.2.254 are unable to establish adjacency because the TCP session could not be established. D. The local router and neighbor 100.64.1.254 established adjacency because the priority of 100.64.1.254 is higher than that of 100.64.2.254.

Refer to the exhibits. The configuration on FortiGate and partial internet session information from a user on the internal network are shown. An administrator would like to test session failover between the two service provider connections. Which two changes must the administrator make to force this existing session to immediately start using the other interface? (Choose two.). A. Modify the distance of the port1 route to 1. B. Change the priority of the port1 static route to 11. C. Configure set snat-route-change enable. D. Change the priority of the port2 static route to 5.

Refer to the exhibit. The output from a collector agent log is shown. The collector agent is showing the status of a workstation as “Not Verified”. What are two common causes for this message? (Choose two.). A. DNS cannot resolve the workstation name. B. Traffic to port 139 and 445 is blocked. C. The workstation remote registry is not running. D. The workstation has come out of hibernate mode.

Refer to the exhibit. The output of a BGP debug command is shown. Why has the local router at 172.16.23.58 been unable to establish adjacency with its only neighbor?. A. The local router has not received an OPEN message from the neighbor. B. There is no active route to the BGP neighbor. C. The neighbor router has become unreachable, which is evident by the low ratio of messages received to messages sent. D. The local router has not received a SYN/ACK packet from the neighbor.

Refer to the exhibit. An administrator has configured a firewall policy to use proxy-based inspection mode. What could explain the messages observed in the debug flow output?. A. The FTP protocol has not yet been mapped to port 211 under Protocol Options. B. FortiGate does not have enough free memory to perform proxy-based inspections. C. At least one protocol port under Protocol Options has been mapped to Any. D. SSL deep inspection is not configured.

Which two statements about Security Fabric communications are true? (Choose two.). A. The default ports for FortiTelemetry and Neighbor Discovery can be modified. B. Security Fabric communication is enabled by default among all Fortinet devices. C. FortiTelemetry must be manually enabled on the FortiGate interface. D. By default, the downstream FortiGate establishes a connection with the upstream FortiGate using TCP port 8013.

Refer to the exhibit. Debug output The output of the command diagnose vpn tunnel list is shown. Reviewing the debug command, what is the current status of the traffic flowing through the tunnel?. A. NP6 is handling the offloading. B. The inbound IPsec SA was copied to the NPU. C. The outbound IPsec SA was copied to the NPU. D. The inbound and outbound IPsec SAs were copied to the NPU.

Refer to the exhibit. Which three pieces of information does the diagnose sys top command provide? (Choose three.). A. The miglogd daemon is running on CPU core ID 0. B. The cmdbsvr process is occupying 2.4% of the total user memory space. C. The diagnose sys top command has been running for 18 minutes. D. If the newcli daemon continues to be in the R state, it will need to be manually restarted. E. The miglogd daemon would be on top of the list, if the administrator pressed m on the keyboard.

Refer to the exhibit. Real-time OSPF debug output Partial output of a real-time OSPF debug is shown. Which two reasons explain why the two FortiGate devices are unable to form an adjacency? (Choose two.). A. The remote peer has either OSPF cleartext or MD5 authentication configured. B. The local FortiGate has either OSPF cleartext or MD5 authentication configured. C. There is an OSPF authentication configuration mismatch. D. The local FortiGate does not have OSPF authentication configured.

Refer to the exhibit. Debug output Which two statements about FortiGate behavior relating to this session are correct? (Choose two.). A. FortiGate either initiated the session or the session terminates at FortiGate. B. FortiGate redirected the client to the captive portal to authenticate so that a correct policy match could be made. C. FortiGate forwarded this session without any inspection. D. FortiGate is performing a security profile inspection using the CPU.

Refer to the exhibits. Network topology OSPF database FGT-1 is an area border router (ABR) that has interfaces in OSPF areas 0.0.0.0 and 0.0.0.5. FGT-3 acts as an autonomous system border router (ASBR), importing static routes into OSPF. FGT-2 is an internal router with all its interfaces belonging to area 0.0.0.5. FGT-1 is receiving all advertised routes from FGT-2, however, FGT-3 is not receiving any of the advertised routes from FGT-1. What is the most likely reason for this?. A. Area 0.0.0.5 is configured not to propagate type 5 LSAs. B. FGT-2 is configured with a distribution list to block all advertised routes from FGT-3. C. FGT-3 and FGT-2 have not formed an OSPF adjacency yet. D. IP protocol 89 is blocked between FGT-1 and FGT-3.

What can cause an IKEv2 tunnel to go down after it was initially brought up successfully?. A. A mismatched proposal was detected during the IKE_AUTH exchange. B. A mismatched pre-shared key was detected during the IKE_AUTH exchange. C. Mismatched quick-mode selectors were detected during the Create_Child_SA exchange. D. A mismatched Diffie-Hellman group was detected during the IKE_SA_INIT exchange.

Refer to the exhibit. The output of the command get router info bgp neighbors 100.64.2.254 advertised-routes is shown. What can you conclude from the output?. A. The local router is advertising the 10.20.30.0/24 network to its BGP neighbor. B. The router ID of the neighbor is 100.64.2.254. C. The BGP state of the two BGP participants is OpenConfirm. D. The BGP neighbor is advertising the 10.20.30.0/24 network to the local router.

Refer to the exhibit. VPN tunnel details Partial output of the get vpn ipsec tunnel details command is shown. Based on the output, which two statements are correct? (Choose two.). A. Anti-replay is enabled. B. The npu_flag for this tunnel is 03. C. The npu_flag for this tunnel is 02. D. Different SPI values are a result of auto-negotiation being disabled for phase2 selectors.

Refer to the exhibit. Partial output of a diagnose command The partial output of a diagnose command is shown. Which two conclusions can you draw from the output shown in the exhibit? (Choose two.). A. FortiGate will drop the expected traffic if it does not arrive within 23 seconds. B. The packets that belong to this session are checked against firewall policy ID 25. C. The TCP session is not established. D. This is a pinhole session to allow traffic for a TCP protocol that dynamically assigns TCP ports.

Refer to the exhibit. Partial output of the fssod daemon real-time debug command is shown Which two conclusions can you draw from the output? (Choose two.). A. Fortinet Single Sign-On (FSSO) is using DC Agent mode to detect logon events. B. FSSO cannot verify if the user is still logged in. C. FortiGate polled this event through TCP port 8000. D. FSSO is using agentless polling mode to detect logon events. E. FortiGate is frequently polling the workstation in case the user has logged out.

Which two protocol states indicate that traffic is bidirectional? (Choose two.). A. proto_state=05 for a TCP session. B. proto_state=01 for a TCP session. C. proto_state=01 for a UDP session. D. proto_state=00 for an ICMP session.

While troubleshooting a FortiGate web filter issue, users report that they cannot access any websites, even though those sites are not explicitly blocked by any web filter profiles that are applied to firewall policies. What are the three most likely reasons for this behavior? (Choose three.). A. The webfilter-force-off setting has been enabled under config system fortiguard. B. The FortiGuard Web Filtering license has expired, causing FortiGate to apply the default block action. C. The SSL/TLS deep inspection was configured but the browsers do not have the FortiGate certificate installed. D. The web filter cache has been cleared causing all websites to take longer to be rated. E. The DNS server is unreachable, preventing URL resolution.

When FortiGate enters conserve mode because of memory pressure, which action can FortiGate perform to preserve memory?. A. FortiGate begins dropping all new sessions to protect system resources. B. FortiGate reduces or stops non-essential processes like logging and antivirus scanning. C. FortiGate switches to a less memory-intensive inspection mode, such as flow-based inspection. D. FortiGate automatically reboots to clear memory and restore full operation.

Refer to the exhibit. What can you conclude if you are accessing the FortiSwitch ports menu on FortiManager?. A. The ADOM is configured to support FortiSwitch central management. B. FortiSwitch is in standalone mode. C. The ADOM is configured to support FortiSwitch per-device-management. D. FortiSwitch is in transparent mode.

Refer to the exhibit. Diagnose output - Partial output of command diagnose debug rating command is shown. Which FDS server will the FortiGate algorithm choose?. A. 64.26.151.37. B. 209.22.147.36. C. 96.45.33.65. D. 208.91.112.194.

36 Refer to the exhibit. Debug output - A partial output from an IKE real-time debug is shown. The administrator does not have access to the remote gateway. Based on the debug output, which two conclusions can you draw? (Choose two.). A. There is a Diffie-Hellman group mismatch. B. This is a phase1 negotiation. C. The remote peer is the initiating peer. D. This is a phase2 negotiation.

Consider the scenario where the server name indication (SNI) does not match either the common name (CN) or any of the subject alternative names (SAN) in the server certificate. Which two actions will FortiGate take when using the default settings for SSL certificate inspection? (Choose two.). A. FortiGate uses the SNI from the user’s web browser. B. FortiGate does not decrypt the traffic if the traffic is blocked by the web filter profile. C. FortiGate uses the CN information from the Subject field in the server certificate. D. FortiGate does not decrypt the traffic if the traffic is allowed by the web filter profile.

Refer to the exhibit. Partial output of a real-time LDAP debug is shown. Which two conclusions can you draw from the output? (Choose two.). A. FortiOS performs a bind to the LDAP server using the user’s credentials. B. FortiOS is performing the second step (Search Request) in the LDAP authentication process. C. The user was found in the LDAP tree whose root is TAC.ottawa.fortinet.com. D. FortiOS collects the user group information.

39 Refer to the exhibit. An IPsec VPN tunnel using IKEv2 was brought up successfully, but when the tunnel rekey takes place the tunnel goes down. The debug command for IKE was enabled and, in the exhibit, you can review the partial output of the debug IKE while attempting to bring the tunnel up. What is causing the tunnel to be down?. A. A mismatch in the Phase 2 negotiations. B. A Diffie-Hellman mismatch. C. Blocked traffic on UDP port 500. D. A mismatch in the Phase 1 negotiations.

Refer to the exhibit. The port1 interface configuration on FortiGate and partial session information for ICMP traffic are shown. Which two things happen to the session information if a routing change occurs that affects this session? (Choose two.). A. The session information will not change even when the active route has been removed from the routing table. B. The session information will not change unless the current route has been removed from the routing table. C. The session will be flagged as dirty but no route lookups will be performed. D. This session will be unaffected by routing changes. The routing changes will apply only to new sessions.

Refer to the exhibit. The exhibit shows the output of a session. Which two statements are correct? (Choose two.). A. The session was initiated from an authenticated user. B. The TCP session has been successfully established. C. The gateway to the destination is 10.1.10.1. D. The session did not match a firewall policy.

Refer to the exhibit. The output of a BGP debug command is shown. What is the most likely reason that the local FortiGate is not receiving any prefixes from its neighbors?. A. The RIB-OUT configuration for router 10.127.0.75 prevents any route advertisement lo the local router. B. The router 100.64.3.1 is waiting for the OPEN message from the local router. C. The local router is waiting for the keepalive message from the router 10.125.0.60. D. None of the three neighbors has successfully established the TCP three-way handshake with the local router.

Refer to the exhibit. The exhibit shows a session entry. Which statement about this TCP session is true?. A. The session will expire in one second. B. The session is offloaded using NP7. C. Return traffic to the initiator is sent to 10.9.31.117. D. It is a TCP session from 10.9.31.117 to 10.1.0.3.

Refer to the exhibit. Which two observations can you make about the web filter traffic captured using the flow tool? (Choose two.). A. The web filter profile is configured with proxy-based inspection mode. B. The HTTPS port is mapped to 443 in the SSL/SSH Inspection Profile. C. The firewall policy is configured with proxy-based inspection mode. D. The session is offloaded to the NPU.

Refer to the exhibit. Which route will traffic take to get to the 100.65.0.0/24 network considering the routes are all configured with the same distance?. A. The static route. B. The OSPF route. C. The policy route. D. The BGP route.

Which two troubleshooting steps should you perform if you encounter issues with intermittent web filter behavior? (Choose two.). A. Check that the correct port is mapped to HTTP in the Protocol Options. B. Check that the communication between FortiGate and FortiGuard is stable. C. Check that the inspection mode configured for the web filter profile matches that of the firewall policy where it is applied. D. Check that FortiGate is not entering conserve mode.

Refer to the exhibits. Partial configurations of two VPNs on FortiGate are shown. An administrator has configured two VPNs for two different user groups. Users who are in the Users-2 group are not able to connect to the VPN. After running a diagnostics command, the administrator discovers that FortiGate is not matching the user-2 VPN for members of the Users-2 group. Which two changes must the administrator make to fix the issue? (Choose two.). A. Change to aggressive mode on both VPNs. B. Enable XAuth on both VPNs. C. Set up specific peer IDs on both VPNs. D. Use different pre-shared keys on both VPNs.

Refer to the exhibit. The output of diagnose automation test command is shown. Which two observations can you make from the output? (Choose two.). A. The test was unsuccessful. B. The automation stitch test is not being logged. C. A high availability (HA) failover occurred. D. The configuration was backed up.

Refer to the exhibit. If the default settings are in place, what can you conclude about the conserve mode shown in the exhibit?. A. FortiGate is currently allowing new sessions that require flow-based or proxy-based content inspection, but is not performing inspection on those sessions. B. FortiGate is currently blocking all new sessions regardless of the content inspection requirements or configuration settings because of high memory use. C. FortiGate is currently allowing new sessions that require flow-based content inspection and blocking sessions that require proxy-based content inspection. D. FortiGate is currently allowing new sessions and will continue to allow sessions if memory increases another 6%.

A FortiGate administrator is troubleshooting a VPN that is failing to establish. As a first step, the administrator is attempting to sniff the traffic using the command: # diagnose sniffer packet any "udp port 500 or udp port 4500 or esp" 4. After several minutes there is still no output. What is the most likely reason for this?. A. The ISP is blocking all VPN traffic. B. esp is not a valid sniffer argument. C. Mismatched IKE versions are detected on the VPN peers. D. The VPN is configured to use IKE over TCP.

51 Refer to the exhibit. The output of the command diagnose vpn tunnel list is shown. Which two statements accurately describe the status of the tunnel? (Choose two.). A. Phase 1 is down. B. Both Phase 1 and Phase 2 were negotiated successfully. C. Phase 2 is down. D. There is currently no traffic traversing the tunnel.

Refer to the exhibit. Partial output of diagnose sys session stat command is shown. An administrator has noticed unusual behavior from FortiGate. It appears that sessions are randomly removed. Which two reasons could explain this? (Choose two.). A. FortiGate is flushing sessions because of high memory usage. B. FortiGate is deleting sessions because the kernel cannot allocate more memory pages. C. FortiGate is not accepting sessions because the device has been down 16 out of 120 seconds. D. FortiGate is dropping all TCP sessions with incomplete three-way handshakes.

53 Refer to the exhibit. A partial output of diagnose npu np6 port-list on FortiGate 2000E is shown. An administrator is unable to analyze traffic flowing between port1 and port17 using the diagnose sniffer command. Which two commands allow the administrator to view the traffic? (Choose two.). A. diagnose npu np6 port-list disable 5 17. B. diagnose npu np6 fastpath disable 1. C. config system npu set fastpath disable end. D. config firewall policy edit 5 set auto-asic-offload disable end next edit 17 set auto-asic-offload disable end.

Refer to the exhibits. An administrator is attempting to advertise the network configured on port3. However, FGT-A is not receiving the prefix. Which two actions can the administrator take to fix this problem? (Choose two.). A. Modify the prefix using the network command and specify le 16 to include the 172.16.54.0/24 subnet. B. Modify the prefix using the network command from 172.16.0.0/16 to 172.16.54.0/24. C. Use the set network-import-check disable command. D. Restart BGP using a soft reset to force both peers to exchange their complete BGP routing tables.

What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow? (Choose two.). A. The packet was dropped because the trusted host list is misconfigured. B. The packet was dropped because it is not allowed by any firewall policy. C. The packet was dropped because the requested service is not enabled on FortiGate. D. The packet was dropped because there is no route to the source.

Refer to the exhibit. The modified output of the routing kernel is shown. Which two statements about the output are true? (Choose two.). A. The BGP route to 10.0.4.0/24 is not in the forwarding information base. B. FortiGate is performing ECMP using both default static routes. C. The local FortiGate is receiving only one LSA from one OSPF neighbor. D. The default static route through 10.200.1.254 is in the forwarding information base.

Refer to the exhibit. The administrator did not override the FortiGuard FQDN or IP address in the FortiGate configuration. Which IP address did FortiGate get when resolving the service.fortiguard.net name?. A. 64.26.151.37. B. 209.22.147.36. C. 208.91.112.194. D. 96.45.33.65.

What are two reasons that an OSPF router does not have any type 5 link-state advertisements (LSAs) in its link-state database (LSDB)? (Choose two.). A. IP protocol 89 is blocked between the local router and its peer. B. The local router is located in a stub area. C. There is no autonomous system border router (ASBR) in the network. D. The peer of the local router is using a prefix-list-out configuration to prevent all type 5 LSAs to be advertised.

What is the correct order of the IKEv2 request-and-response protocol?. A. Create_Child_SA, IKE_AUTH, IKE_SA_INIT. B. IKE_AUTH, IKE_SA_INIT, Create_Child_SA. C. Create_Child_SA, IKE_SA_INIT, IKE_AUTH. D. IKE_SA_INIT, IKE_AUTH, Create_Child_SA.

Refer to the exhibit. An IPsec VPN tunnel is dropping, as shown by the debug output. Analyzing the debug output, what could be causing the tunnel to go down?. A. The local FortiGate is dropping the incoming IKE packets from the peer. B. The NAT-T negotiation was unsuccessful. C. Dead Peer Detection is not receiving its acknowledge packet. D. There is no active route to the remote peer.

Refer to the exhibit. The output of a policy route table entry is shown. Which type of policy route does the output show?. A. An SD-WAN rule. B. A regular policy route, which is associated with an active static route in the FIB. C. An ISDB route. D. A regular policy route, which is not associated with an active static route in the FIB.

Refer to the exhibit, which contains the output of a debug command. If the default settings are in place, what can you conclude about the conserve mode shown in the exhibit?. A. FortiGate is currently allowing new sessions that require flow-based content inspection and blocking sessions that require proxy-based content inspection. B. FortiGate is currently allowing new sessions that require flow-based or proxy-based content inspection but is not performing inspection on those sessions. C. FortiGate is currently blocking all new sessions regardless of the content inspection requirements or configuration settings because of high memory use. D. FortiGate is currently allowing new sessions that require flow-based or proxy-based content inspection and is performing inspection on those sessions.

Refer to the exhibit. The partial output of diagnose hardware sysinfo memory command is shown. Which two memory allocations could help you troubleshoot a potential resource issue? (Choose two.). A. The user space, which has 708880 kB of physical memory that is not used by the system. B. The 98908 kB of memory that will never be used. C. The I/O cache, which has 641364 kB of memory allocated to it. D. The unused cache page, which is represented by the value indicated next to the Inactive heading.

Refer to the exhibit. An administrator deployed FSSO in DC Agent mode but FSSO is failing on FortiGate. Pinging FortiGate from where the collector agent is deployed is successful. The administrator then produces the debug output shown in the exhibit. Which two components could be causing this error message? (Choose two.). A. The collector agent preshared password is mismatched. B. FortiGate and the collector agent are using different TCP ports. C. The connection is blocked by the Windows firewall. D. TCP port 445 is blocked between FortiGate and the collector agent.

Which three common FortiGate-to-collector-agent connectivity issues can you identify using the FSSO real-time debug? (Choose three.). A. FortiGate cannot reach the IP address of the collector agent. B. The pre-shared key does not match. C. The SSL certificate used for FSSO over SSL has expired. D. The group filters do not match. E. The connection was refused. There may be a mismatch of the TCP port.

Refer to the exhibit, which shows the output of a BGP debug command. What is the reason that the local FortiGate is not receiving any prefixes from its neighbors?. A. The RIB-OUT configuration for router 10.127.0.75 prevents any route advertisement to the local router. B. The router 100.64.3.1 needs to update the local AS number to 65060 to become adjacent with the local router. C. The local router is waiting for the keepalive message from the router 10.125.0.60. D. None of the three neighbors have successfully established the TCP three-way handshake with the local router.

Refer to the exhibit. The output of diagnose sys session list command is shown. If the HA ID for the primary device is 0, what happens if the primary falils and the secondary becomes the primary?. A. The session is synchronized with the secondary device, however, because application control is applied, the session is marked dirty and has to be re-evaluated after failover. B. The session state is preserved but the kernel will re-evaluate the session because the routing information will be flushed. C. The session will be removed from the session table of the secondary device because the TCP session is not yet fully established. D. The session continues to permit traffic on the new primary device after failover, without requiring the client to restart the session with the server.

Refer to the exhibit. FortiGate is showing continuous high CPU usage. During a maintenance window, the CLI command diagnose sys top displays the output shown in the exhibit. The CLI command diagnose test application ipsmonitor 5 was run, but the CPU usage by daemon ipsengine did not drop. Which immediate action can you take to reduce the CPU usage effectively?. A. Reduce the number of IPS signatures enabled on the active IPS profiles. B. Bypass all IPS engines. C. Execute diagnose test application ipsmonitor 2 instead. D. Disable IPS on all firewall policies.

Refer to the exhibit, which shows the output of the BGP database. Which two statements are correct? (Choose two.). A. The output shows all prefixes advertised by all neighbors as well as the local router. B. The advertised prefix of 10.20.30.0/24 was configured using the network command. C. The advertised prefix of 10.20.30.0/24 is being advertised through the redistribution of another routing protocol. D. The first prefixes are being advertised using a legacy route advertisement.

Which two actions does FortiGate take after an administrator enables the auxiliary session setting? (Choose two.) Answer: CD. A. FortiGates creates a new auxiliary session for each packet it receives. B. FortiGate only offloads auxiliary sessions. C. FortiGate creates two sessions in case of a routing change. D. FortiGate accelerates all ECMP traffic to the NP6 processor.