Question 250
A managed environment will use FGFM IPv4 TCP 541 path diagnosis to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails. Which preparation check makes the chosen change viable?
Explanation
Correct Answer
The specific preparation for FGFM IPv4 TCP 541 path diagnosis is to confirm bidirectional TCP 541 reachability toward the actual FortiManager receiving interface. This addresses the stated need to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails, and later acceptance is demonstrated when the FortiGate establishes the management SSL session on its expected protocol endpoint.
Incorrect Answers
That step belongs to FortiManager hostname mismatch after address change, used to fix registered FortiGates still trying an obsolete manager destination. It is not the mechanism-specific setup for FGFM IPv4 TCP 541 path diagnosis required to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails.
That step belongs to FortiGate-initiated FGFM session, used to troubleshoot a manager that cannot initiate a persistent session back to the gateway. It is not the mechanism-specific setup for FGFM IPv4 TCP 541 path diagnosis required to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails.
That step belongs to NAT port forwarding to FortiManager, used to register a FortiGate outside a private manager network when the manager sits behind NAT. It is not the mechanism-specific setup for FGFM IPv4 TCP 541 path diagnosis required to restore the FortiGate-initiated secure management tunnel when GUI HTTPS works but device onboarding fails.



Fortinet NSE 5 - FortiManager 7.6 Administrator (FCP_FMG_AD-7.6) Practice Tests