Exam NSE4_FGT-6.4 topic 1 question 119 discussion

B and D Infra page 39

C and D - FG Infra page 39

B & D - as mentioned by a few other good people here :) https://kb.fortinet.com/kb/documentLink.do?externalID=FD51279

B and D is Correct

B&D https://kb.fortinet.com/kb/documentLink.do?externalID=FD51279

As of today, there is no available option to disable RPF at the interface level however there are other possibilities: "asymetric routing enable" : Configuring the vdom in asymetric mode (set asymroute enable) is one of them but also it also disables the packet state inspection which may not be wanted. "strict-src-check disable" + adding a supernet route as "feasible patch" A route with a larger prefix can be added pointing to interface where packet egresses. Since best match applies, the most specific route will be used to route packets. This "non-priority" route is added to provide a "feasible path". 'strict-src-check' should be set to 'disable'. "strict-src-check disable" + adding the same route as the best matching one (same subnet, same prefix, same distance) but having a higher priority value than the best match one. This will force the route to be injected in the routing table as a second choice. Note : the lower priority, the best . If not defined, priority is set to '0' per default

B and D Infra page 39