FCP-FGT-AD - VPN - Section 5.1

Configure and implement different SSL VPN modes to provide secure remote access to the private network.

Configure SSL VPN in web mode for browser-based access and in tunnel mode for full network connectivity via the FortiClient, and customise the SSL VPN portal for each user group. Apply split tunnelling to control which traffic routes through the VPN versus exits directly to the internet.

SSL VPNtunnel modeweb modeSSL VPN portalsplit tunnelling

Practice question for this objective

Free sampleVPNmedium

A tunnel-mode SSL VPN portal has split tunnelling disabled. A remote client connects, authenticates, and receives an address from the tunnel pool. How is the client's traffic routed while the tunnel is up?

  • AOnly traffic destined for the configured internal routing addresses crosses the tunnel; all other traffic uses the client's local default gateway.
  • BAll of the client's traffic, including general internet browsing, is sent through the tunnel to the FortiGate for forwarding and inspection. Correct
  • CInternal traffic crosses the tunnel while DNS queries alone are sent to the client's local resolver to speed up name lookups.
  • DTraffic is load-balanced between the tunnel and the local gateway based on which path reports lower latency at connect time.
When split tunnelling is disabled, the SSL VPN client routes all traffic, including internet-bound traffic, through the FortiGate as a full tunnel. Disabling split tunnelling makes the portal push a default route over the virtual tunnel interface to the client. The client therefore sends every packet, internal and internet-bound, into the tunnel, and the FortiGate forwards and inspects all of it.

Why A is wrong: Tempting because this is exactly what split tunnelling does, but it describes split tunnelling ENABLED, the opposite of the disabled state in the stem.

Why B is correct: Correct: with split tunnelling disabled the client installs a default route over the tunnel interface, so every destination including the internet is carried to the FortiGate (full tunnel).

Why C is wrong: Tempting because split-DNS sounds related, but DNS handling is a separate setting and does not define the full-tunnel routing behaviour described here.

Why D is wrong: Tempting because it sounds like an optimisation, but SSL VPN tunnel mode performs no such per-path load balancing; the split tunnel setting alone decides what enters the tunnel.

See more FCP-FGT-AD practice questions, answers explained.

More in this domain

Back to all VPN objectives, or the FCP-FGT-AD cert hub.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.