FCP-FGT-AD - VPN (20% of the exam) - Section 5.1

Configure and implement different SSL VPN modes to provide secure remote access to the private network.

Configure SSL VPN in web mode for browser-based access and in tunnel mode for full network connectivity via the FortiClient, and customise the SSL VPN portal for each user group. Apply split tunnelling to control which traffic routes through the VPN versus exits directly to the internet.

SSL VPNtunnel modeweb modeSSL VPN portalsplit tunnelling

Practice question for this objective

Free sampleVPNmedium

A tunnel-mode SSL VPN portal has split tunnelling disabled. A remote client connects, authenticates, and receives an address from the tunnel pool. How is the client's traffic routed while the tunnel is up?

AOnly traffic destined for the configured internal routing addresses crosses the tunnel; all other traffic uses the client's local default gateway.
BAll of the client's traffic, including general internet browsing, is sent through the tunnel to the FortiGate for forwarding and inspection. Correct
CInternal traffic crosses the tunnel while DNS queries alone are sent to the client's local resolver to speed up name lookups.
DTraffic is load-balanced between the tunnel and the local gateway based on which path reports lower latency at connect time.

When split tunnelling is disabled, the SSL VPN client routes all traffic, including internet-bound traffic, through the FortiGate as a full tunnel. Disabling split tunnelling makes the portal push a default route over the virtual tunnel interface to the client. The client therefore sends every packet, internal and internet-bound, into the tunnel, and the FortiGate forwards and inspects all of it.

Why A is wrong: Tempting because this is exactly what split tunnelling does, but it describes split tunnelling ENABLED, the opposite of the disabled state in the stem.

Why B is correct: Correct: with split tunnelling disabled the client installs a default route over the tunnel interface, so every destination including the internet is carried to the FortiGate (full tunnel).

Why C is wrong: Tempting because split-DNS sounds related, but DNS handling is a separate setting and does not define the full-tunnel routing behaviour described here.

Why D is wrong: Tempting because it sounds like an optimisation, but SSL VPN tunnel mode performs no such per-path load balancing; the split tunnel setting alone decides what enters the tunnel.

See more FCP-FGT-AD practice questions, answers explained.

Exam traps in VPN

Answers that look right on this material and are not. Each one is a distractor from a different question in the FCP-FGT-AD bank for this domain.

Disable split tunnelling on the tunnel-mode portal so all client traffic is routed through the FortiGate
Why it is wrong: Tempting because disabling the feature sounds like it removes the restriction, but disabling split tunnelling forces every packet through the tunnel, which is exactly the behaviour the administrator wants to stop.
The FortiGate forces every user onto tunnel mode first and only falls back to web mode if FortiClient is missing, regardless of how they connect.
Why it is wrong: There is no mandatory tunnel-first fallback sequence; the access the user gets depends on how they connect, so this invents a forced order that does not exist.
Source interface is the WAN interface, and the source is the public address range of the remote ISPs the clients connect from.
Why it is wrong: The WAN interface carries the encrypted SSL VPN session itself, not the decrypted tunnel traffic; matching on remote ISP ranges is unworkable and would not classify tunnel users.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.