According to the exhibit, the wireless guest users are getting a certificate error while loading the

captive portal login page. This means that the browser cannot verify the identity of the server that is

hosting the login page. Therefore, option A is true because the external server FQDN is incorrect,

which means that it does not match the common name or subject alternative name of the server

certificate. Option B is also true because the wireless user’s browser is missing a CA certificate, which

means that it does not have the root or intermediate certificate that issued the server certificate.

Option C is false because the FortiGate authentication interface address is using HTTPS, which is a

secure protocol that encrypts the communication between the browser and the server. Option D is

false because the user address is not in DDNS form, which is not related to the certificate error.

According to the FortiOS CLI Reference Guide, “The diagnose debug application foauthd command

enables debugging of certificate verification process in real time.” Therefore, option A is true

because it describes the CLI command that an administrator should use to view the certificate

verification process in real time. Option B is false because diagnose debug application radiusd -1

enables debugging of RADIUS authentication process, not certificate verification process. Option C is

false because diagnose debug application authd -1 enables debugging of authentication daemon

process, not certificate verification process. Option D is false because diagnose debug application

fnbamd -1 enables debugging of FSSO daemon process, not certificate verification process.

Fortinet’s official documentation, including the FortiOS Handbook and NSE 7 training materials,

provides detailed guidance on troubleshooting RADIUS authentication issues. The three tools listed

below are explicitly supported for diagnosing RADIUS-related problems in FortiOS:

B. You can use the diagnose test authserver radius command to verify RADIUS server configuration,

user credentials, and user group membership.

This command is a well-documented troubleshooting tool in the FortiOS CLI Reference and Technical

Documentation. It allows administrators to manually test RADIUS authentication by specifying the

RADIUS server, username, and password. The output provides details on whether the authentication

succeeds or fails, along with information about group membership and server reachability. For

example:

bash

CollapseWrapCopy

diagnose test authserver radius

This is a critical tool for verifying the RADIUS server's configuration and user authentication flow.

D. You can enable debug for the fnbamd process to view RADIUS authentication details.

The fnbamd process (FortiNet Authentication Daemon) handles non-local authentication protocols

like RADIUS and LDAP in FortiOS. Enabling debug for this process provides real-time logs of the

authentication exchange between the FortiGate and the RADIUS server. This is officially

recommended in Fortinet’s troubleshooting guides for advanced diagnostics. The command

sequence is:

bash

CollapseWrapCopy

diagnose debug application fnbamd -1

diagnose debug enable

After testing, you can disable debugging with diagnose debug disable. This tool is invaluable for

identifying issues such as misconfigured shared secrets, timeouts, or attribute mismatches.

E. You can use the diagnose test application radiusd command to verify the RADIUS server

configuration, user credentials, and user group membership.

The radiusd process relates to the RADIUS daemon on the FortiGate, and this diagnostic command

tests the RADIUS server’s operational status and authentication functionality. While less commonly

highlighted than diagnose test authserver radius, it is referenced in Fortinet’s CLI documentation for

deeper troubleshooting of the RADIUS service itself. It provides detailed output about the server’s

response and can help isolate issues specific to the RADIUS protocol implementation.

Why not A and C?

A. You can enable debug for the fssod process to view RADIUS authentication details.

The fssod process relates to FortiSSO (Single Sign-On) and is primarily used for FSSO-based

authentication, not direct RADIUS troubleshooting. While it may log some authentication-related

events in specific SSO scenarios, it is not a standard tool for RADIUS diagnostics according to

Fortinet’s official documentation. Thus, it is not a correct choice here.

C. You can check the Firewall Users widget to view the list of active RADIUS users.

While the Firewall Users widget (available in the FortiOS GUI under User & Authentication > Firewall

Users) shows a list of authenticated users, it is a monitoring tool, not a troubleshooting tool. It does

not provide diagnostic details about RADIUS authentication failures or server issues, making it

insufficient for this purpose per Fortinet’s troubleshooting methodology.

Source Verification

The answers are derived from official Fortinet resources, including:

FortiOS 7.0 CLI Reference (diagnose commands section)

FortiOS Handbook: Authentication (RADIUS troubleshooting section)

NSE 7 - LAN Edge 7.0 training materials (authentication diagnostics module)

These tools (B, D, E) align with Fortinet’s recommended practices for diagnosing RADIUS

authentication issues effectively.

According to the FortiAuthenticator Administration Guide2, “Windows Active Directory domain

authentication enables FortiAuthenticator to join a Windows Active Directory domain as a machine

entity and proxy authentication requests using Kerberos.” Therefore, option D is true because it

describes the purpose of enabling Windows Active Directory domain authentication on

FortiAuthenticator. Option A is false because FortiAuthenticator does not need Windows

administrator credentials to perform an LDAP lookup for a user search. Option B is false because

FortiAuthenticator does not use a Windows CA certificate when authenticating RADIUS users, but

rather its own CA certificate. Option C is false because FortiAuthenticator does not import users from

Windows AD, but rather synchronizes them using LDAP or FSSO.

According to the exhibit, the DHCP server scope for the FortiLink interface has a vci-string setting

with the value “Cisco AP c2700”. This setting is used to match the vendor class identifier (VCI) of the

DHCP clients that request an IP address from the DHCP server. The VCI is a text string that uniquely

identifies a type of vendor device. Therefore, option C is true because the vci-string setting restricts

the IP address assignment to FortiSwitch and FortiExtender devices, which use the VCI “Cisco AP

c2700”. Option A is false because the vci-string setting does not ignore DHCP requests coming from

FortiSwitch and FortiExtender devices, but rather accepts them. Option B is false because the vci-

string setting does not reserve IP addresses for FortiSwitch and FortiExtender devices, but rather

assigns them dynamically. Option D is false because the vci-string setting does not restrict the IP

address assignment to devices that have FortiSwitch or FortiExtender as their hostname, but rather

to devices that have “Cisco AP c2700” as their VCI.