An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?
A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?
An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?
An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?
An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?
An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?
A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?
An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?
An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?
An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)
An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)
An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)
An administrator is deploying ADVPN 2.0 with IPsec tunnels between a hub and multiple spokes. The administrator wants to enable shortcut tunnels between spokes automatically when traffic between them exceeds a threshold. Which SD-WAN configuration element is required to trigger the creation of these on-demand shortcut tunnels?
An administrator is configuring an SD-WAN rule to steer traffic based on application control. The rule must prioritize Microsoft Teams traffic over other business applications. Which two configuration elements are required in the SD-WAN rule to achieve this? (Choose two.)
A FortiGate is configured with an SD-WAN zone named "virtual-wan-link" containing two IPsec tunnels to remote branches. The administrator needs to ensure that if both tunnels fail health checks, the FortiGate automatically disables the SD-WAN zone in the routing table so that a backup static route via a different interface can take over. Which configuration step accomplishes this?
An administrator is deploying an IPsec VPN tunnel between two FortiGates that will be members of an SD-WAN zone. The administrator wants the tunnel interface to be automatically assigned to the correct SD-WAN zone based on the tunnel's configuration, without manually adding it to the zone. Which configuration step is required to achieve this?
A FortiGate hub is configured with an IPsec VPN tunnel to a branch office. The branch FortiGate is behind a broadband router performing NAT, and the tunnel frequently drops after a period of inactivity. The administrator wants the tunnel to remain established even when no interesting traffic is present. Which configuration parameter should be enabled on the hub's Phase 1 configuration?
A network administrator is deploying ADVPN 2.0 between a hub and multiple spokes. The administrator wants to ensure that when a spoke-to-spoke shortcut tunnel is established, the routing protocol automatically installs the shortcut route without manual intervention. Which routing protocol feature must be enabled on the hub and spokes to support this dynamic shortcut route installation?
A network administrator has deployed an IPsec VPN tunnel between two FortiGate devices. The administrator wants to ensure that the tunnel only carries traffic from specific subnets, and that any other traffic is dropped. Which IPsec Phase 2 configuration parameter should be configured to achieve this?
An administrator has deployed an SD-WAN solution with two IPsec overlays (Overlay_A and Overlay_B) and one underlay MPLS circuit. A new SD-WAN rule is configured to route Microsoft 365 traffic exclusively over Overlay_A, while all other business traffic uses the underlay. Users report that Microsoft 365 is intermittently failing over to the underlay. Which FortiOS configuration element must the administrator verify to ensure that only the IPsec overlay is eligible for the Microsoft 365 rule?
An administrator is configuring an IPsec VPN tunnel as an SD-WAN member. The administrator wants to ensure that the tunnel is only used when the underlay path meets specific latency and jitter thresholds. Which SD-WAN component should be configured to monitor the tunnel's performance?
A FortiGate hub in an ADVPN 2.0 deployment uses IPsec tunnel templates to dynamically create spoke tunnels. Spoke A and Spoke B are behind the same NAT device and both establish tunnels to the hub. The administrator notices that only one spoke tunnel is active at a time, and when Spoke B connects, Spoke A's tunnel is torn down. Which configuration change on the hub resolves this issue?
A network administrator has configured an SD-WAN rule that uses a health check to steer traffic to the best link based on latency. The health check uses ICMP probes to two different destinations. The administrator notices that the SD-WAN rule is not switching to the backup link even when the primary link's latency exceeds the threshold. What could be the cause?
An administrator is troubleshooting an ADVPN 2.0 deployment where a spoke is not learning routes from other spokes via the hub. The administrator verifies that BGP is configured on all devices and that the hub is advertising routes. What is the most likely cause?
An administrator is configuring an SD-WAN rule to steer traffic based on application type. The rule uses the 'Application' strategy and includes multiple applications. The administrator wants to ensure that traffic for these applications is load-balanced across two IPsec tunnels. Which SD-WAN rule configuration parameter must be set to achieve load balancing?
An administrator is configuring an SD-WAN rule that uses a security profile to inspect traffic. The administrator wants to ensure that the security profile is applied only to traffic that matches the SD-WAN rule and is forwarded over a specific IPsec tunnel. Which FortiOS feature should be used to achieve this?
An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for an SD-WAN deployment. The tunnel must carry traffic for multiple overlapping subnets from different tenants. The administrator needs to ensure that the tunnel comes up and that traffic is routed correctly without conflicts. Which Phase 2 configuration parameter should the administrator use to allow multiple subnets to be selected for the tunnel?
A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec VPN tunnels. The health check is configured with a ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule is not failing over when the primary tunnel experiences high latency, even though the SLA target for latency is 100ms. What is the most likely cause?
A FortiGate is configured with an SD-WAN rule that uses the 'Best Quality' strategy based on an SLA health check that monitors latency and jitter. The rule includes two IPsec tunnels: Tunnel_A and Tunnel_B. Currently, Tunnel_A is the preferred member. The administrator notices that Tunnel_A is experiencing high jitter, but the SD-WAN rule is not failing over to Tunnel_B. What is the most likely cause?
An administrator has configured an SD-WAN rule to steer traffic to an IPsec tunnel based on an SLA health check. The health check uses ICMP probes to a remote server. The administrator notices that the tunnel is marked as down even though the tunnel is up and passing traffic. What is a possible reason?
A FortiGate is configured as an ADVPN hub with an IPsec tunnel template and BGP over the overlay. Spokes establish dynamic tunnels to each other, but a spoke administrator reports that traffic to a remote spoke subnet is still hairpinning through the hub. BGP sessions are up and routes are exchanged. Which configuration item on the hub is most likely preventing the shortcut tunnel from being used for that traffic?
An administrator has configured an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy with two IPsec tunnels as members. The administrator notices that traffic is being sent over the tunnel with higher cost even though both tunnels meet the SLA. What could explain this behavior?
A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check uses both ping and HTTP probes. The administrator wants to ensure that the SD-WAN rule only selects a tunnel when both probes succeed. Which two statements about the health check configuration are true? (Choose two.)
A FortiGate is configured with an SD-WAN rule that uses an SLA health check to select between two IPsec tunnels. The administrator wants to ensure that if both tunnels fail the SLA, traffic is dropped rather than sent over a non-compliant tunnel. Which SD-WAN rule configuration achieves this?
A network administrator has configured an SD-WAN rule that uses the 'lowest-cost' strategy with two IPsec tunnels: Tunnel A (cost 10) and Tunnel B (cost 20). Both tunnels are up and passing health checks. However, the administrator notices that all traffic is being sent over Tunnel B instead of Tunnel A. What is the most likely cause?
A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with 'sla' criteria for latency and jitter. The administrator notices that traffic is not failing over to the secondary tunnel when the primary tunnel's latency exceeds the SLA threshold. What is the most likely cause?
An administrator is deploying ADVPN 2.0 with BGP on a hub-and-spoke topology. The hub must advertise a default route to all spokes, but spokes should not advertise the default route to each other. Which two BGP configurations on the hub are required to achieve this? (Choose two.)
An administrator deploys ADVPN 2.0 with BGP on a hub and multiple spokes. Spokes must dynamically learn routes to other spokes' LAN subnets so that direct shortcut tunnels can be established. Which BGP configuration on the hub enables this behavior?
An administrator is configuring an IPsec VPN tunnel between two FortiGates for an SD-WAN deployment. The administrator wants to ensure that the tunnel is highly available and can fail over to a secondary WAN link if the primary link fails. Which two configuration steps are required to achieve this? (Choose two.)
An administrator applies an IPsec tunnel template to a FortiGate hub in an ADVPN 2.0 deployment. A spoke behind a NAT device fails to establish an IKEv2 Phase 1 with the hub, while spokes with public IPs succeed. Which Phase 1 setting must be adjusted on the hub to allow the NATed spoke to connect?
An administrator is configuring an IPsec VPN tunnel between two FortiGate devices to securely connect two sites. The administrator wants to ensure that the tunnel uses strong encryption and authentication. Which two parameters should be configured in Phase 1 to achieve this? (Choose two.)
An administrator configures an SD-WAN rule that uses a health check with two SLA targets: one for latency below 100 ms and one for packet loss below 2%. The rule is set to use the 'Best Quality' strategy. After a brief ISP outage, the administrator notices that traffic is still being steered to a member that violates the packet loss SLA. What is the most likely reason the member remains in use?
A FortiGate is configured with an IPsec VPN tunnel used in an SD-WAN zone. The administrator wants to enable ADVPN 2.0 and ensure that shortcut tunnels are established between spokes. Which two configuration elements are required on the hub to support ADVPN 2.0 shortcut negotiation? (Choose two.)
A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec VPN overlay zone. The administrator wants to ensure that only traffic matching a specific application is allowed through the tunnel and that all other traffic is dropped. Which SD-WAN rule configuration should be used?
A FortiGate has two IPsec tunnels in an SD-WAN zone. The administrator configures a health check using ping probes to a public IP. Users report that VoIP traffic is sometimes routed over a tunnel with high jitter even though the other tunnel is healthy. What is the most likely cause?
An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel can recover quickly from a failure and that routing information is exchanged dynamically. Which two protocols or features should be configured to achieve these goals? (Choose two.)
An administrator is implementing an SD-WAN solution with IPsec tunnels between a hub and multiple spokes. The administrator wants to ensure that the SD-WAN rules can dynamically select the best tunnel based on performance metrics. Which two configuration steps are required to enable SD-WAN to monitor and select tunnels based on SLA? (Choose two.)
A FortiGate hub in an ADVPN 2.0 topology uses IPsec tunnel templates to dynamically create spoke tunnels. A newly onboarded spoke completes Phase 1 and Phase 2 negotiation, but the hub's routing table never installs the spoke's remote subnet, even though the spoke advertises it over BGP. The administrator confirms the spoke's BGP session is Established. What is the most likely cause?
An administrator is configuring an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The administrator wants the rule to prefer the tunnel with the lowest latency. Which SD-WAN rule strategy should be selected?
An administrator has configured an ADVPN 2.0 network with a hub and multiple spokes. The hub uses BGP to exchange routes with the spokes. A spoke wants to advertise its local subnet to other spokes. Which BGP configuration on the spoke is required to ensure that the route is propagated to other spokes via the hub?
An administrator configures an SD-WAN rule that uses the 'Maximize Bandwidth (SLA)' strategy across two IPsec tunnels. The rule includes a health check that monitors latency and jitter. After deployment, traffic is not load-balanced as expected; instead, all traffic uses a single tunnel. What is the most likely cause?
An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The tunnel must use IKEv2 and support multiple Phase 2 selectors for different subnets. Which Phase 1 configuration parameter is required to allow multiple Phase 2 selectors?
An administrator is configuring an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. The hub must support dynamic spoke-to-spoke shortcuts and allow spokes to exchange BGP routes. Which two configuration settings are required on the hub to enable ADVPN shortcut negotiation and BGP route exchange? (Choose two.)
A FortiGate is configured with an SD-WAN rule that uses the 'lowest-cost' strategy based on latency. The administrator notices that traffic is not switching to the backup link when the primary link's latency exceeds the SLA threshold. What could be the cause?
An administrator configures an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the tunnel only comes up when there is interesting traffic, and goes down after a period of inactivity to save resources. Which Phase 2 setting should be configured?
An administrator is deploying ADVPN 2.0 with IPsec tunnel templates on a FortiGate hub. Which two configuration elements are required on the hub's tunnel template to allow spokes to establish dynamic tunnels and have their subnets reachable? (Choose two.)
An administrator is troubleshooting an IPsec VPN tunnel used in an SD-WAN overlay. The tunnel is up, but traffic is not passing. The administrator suspects a Phase 2 selector mismatch. Which command should be used to verify the Phase 2 selectors?
An administrator is configuring an SD-WAN rule that uses the 'Best Quality' strategy to select among three IPsec tunnels. The health check monitors latency, jitter, and packet loss. Which two parameters must be configured in the health check to ensure the SD-WAN rule can properly evaluate the quality of each tunnel? (Choose two.)
An administrator is troubleshooting an SD-WAN rule that uses the 'lowest cost (SLA)' strategy with two IPsec overlays. The rule is not selecting the expected overlay even though both members pass health checks. The administrator notices that the rule's priority values are both set to 1. What is the most likely reason the rule is not steering traffic as expected?
An administrator is configuring an SD-WAN rule that must route traffic based on application control and also apply a security profile. Which two actions are required to ensure the security profile is applied to the traffic? (Choose two.)
An administrator is deploying ADVPN 2.0 with BGP on a FortiGate hub. The administrator wants to ensure that spoke-to-spoke shortcut tunnels are established dynamically. Which two BGP-related configurations are required on the hub to support this? (Choose two.)
An administrator has configured an SD-WAN rule that routes traffic to an IPsec overlay zone. The administrator wants to ensure that if the primary IPsec tunnel fails, traffic is automatically redirected to a backup IPsec tunnel. Which SD-WAN rule setting should be configured to achieve this?
An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?
An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?
An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?
When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?
When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?
An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?
An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?
In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?
An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?
An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?
An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?
An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?
A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?
An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?
An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)
An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)
An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)
When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)
An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)
An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)
An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)
An administrator wants to route traffic from a specific source subnet through an SD-WAN zone that contains two member interfaces: a dedicated internet link and an MPLS link. The administrator needs to ensure that traffic from that subnet always uses the MPLS link when it is available, but falls back to the internet link if the MPLS link fails. Which SD-WAN rule configuration should be used?
An administrator configures an IPsec VPN tunnel between two FortiGates for SD-WAN use. The tunnel is up, but traffic from the local subnet 10.10.10.0/24 to the remote subnet 10.20.20.0/24 is not passing. The administrator verifies that the Phase 2 selectors are configured with the correct local and remote subnets. What is the most likely cause?
An administrator is configuring an IPsec VPN tunnel that will be used as an SD-WAN member. The tunnel must be able to carry multicast traffic for OSPF. Which IPsec Phase 2 configuration parameter must be enabled to support this requirement?
A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec overlay tunnel. A security administrator needs to inspect the traffic with an IPS sensor before it egresses the tunnel. Where must the IPS sensor be applied so that it inspects traffic matching the SD-WAN rule?
A network administrator has deployed SD-WAN with two IPsec overlays and one internet breakout on a FortiGate. The administrator wants to ensure that traffic from a specific source subnet uses the VPN overlay for a business-critical application, while all other traffic follows the default route. The SD-WAN rule must also verify that the overlay meets an SLA for jitter. Which SD-WAN configuration object should the administrator use to define the source subnet and application criteria?
An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?
A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with a single ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule fails over to the secondary tunnel even when the primary tunnel is up, but with high latency. The administrator wants the health check to consider latency and only fail over when latency exceeds a threshold. What should the administrator configure to achieve this?
An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?
An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel interface is not used for routing until the IPsec tunnel is fully established and the health check passes. Which configuration step should be taken?
An administrator is setting up an IPsec VPN tunnel between a FortiGate hub and a branch office FortiGate. The administrator wants to ensure that the branch office can access the internet through the hub's internet connection while also accessing resources at the headquarters. Which type of IPsec VPN configuration should the administrator use to achieve this?
An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link, which has lower latency. The administrator wants to ensure that if the MPLS link fails the SLA for latency, the traffic is automatically routed over the internet VPN. Which SD-WAN strategy should be used to achieve this?
An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?
A FortiGate is configured with an SD-WAN rule that uses a health check to monitor an IPsec tunnel. The health check is configured with a ping probe to a remote IP. The administrator notices that the tunnel is marked as down even though the remote IP is reachable via the tunnel. What is a possible cause?
An administrator has configured an SD-WAN rule to steer traffic based on the "maximize bandwidth (SLA)" strategy. The rule uses two IPsec tunnels: one with 100 Mbps and one with 50 Mbps. The administrator expects traffic to be load-balanced proportionally to the bandwidth. However, all traffic is going through the 100 Mbps tunnel. What is the most likely reason?
A network administrator is configuring a static route on a FortiGate to direct traffic to a remote subnet through an IPsec VPN tunnel. The tunnel interface is named 'VPN_Tunnel'. Which of the following is the correct way to configure the static route?
A FortiGate is configured with an SD-WAN rule that steers traffic based on application control. The administrator applies a security profile (Antivirus and IPS) to the SD-WAN zone. However, they notice that traffic matching the SD-WAN rule is not being inspected by the security profiles. What is the most likely reason?
A FortiGate is running SD-WAN with two IPsec tunnels to different data centers. The administrator wants to apply a Web Filtering profile only to HTTP/HTTPS traffic that is steered by a specific SD-WAN rule, while other traffic on the same tunnels remains unfiltered. Where should the Web Filtering profile be applied?
An administrator configures an SD-WAN rule that matches traffic to a specific destination subnet and sets the strategy to 'Lowest Cost (SLA)'. The rule includes two members: 'Tunnel-1' with cost 10 and 'Tunnel-2' with cost 20. Both tunnels pass their SLA health checks. Which tunnel will be selected for the traffic?
An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?
A FortiGate is configured with an IPsec VPN tunnel to a remote peer. The administrator wants to apply an IPS sensor to traffic traversing the tunnel. However, the IPS sensor must inspect traffic after decryption but before it is routed to the internal network. Where should the IPS sensor be applied?
An administrator is configuring an SD-WAN rule to route traffic from a specific source subnet to a destination subnet over a preferred IPsec tunnel. The administrator wants to ensure that if the preferred tunnel fails, traffic automatically switches to a backup tunnel. Which SD-WAN rule configuration is required to achieve this?
An administrator configures an SD-WAN rule with an SLA target that includes latency, jitter, and packet loss. The rule uses the 'lowest cost (SLA)' strategy. Both tunnels meet the SLA, but one tunnel has a lower configured cost. How does FortiOS select the egress interface for a new session?
An administrator is troubleshooting an SD-WAN setup where traffic is not being routed through the preferred IPsec tunnel despite the tunnel being up and passing health checks. The administrator reviews the SD-WAN rule and notices that the rule is configured with the 'maximize-bandwidth (SLA)' strategy and includes two tunnels with different bandwidths. The administrator expects traffic to use the tunnel with higher bandwidth, but it is using the lower bandwidth tunnel. What could be the reason for this behavior?
An administrator wants to ensure that an SD-WAN rule only selects a member if its measured latency is below 100 ms and packet loss is below 2%. Which SD-WAN feature should be configured to enforce these thresholds?
A FortiGate is configured with an SD-WAN rule that uses an SLA target and includes two IPsec tunnels. The administrator wants to ensure that security profiles are applied to traffic steered by this rule. Which two statements are correct regarding the enforcement of security profiles for SD-WAN traffic? (Choose two.)
A network administrator is deploying SD-WAN with IPsec tunnels and wants to ensure that if a tunnel goes down, traffic is automatically redirected to another member. The administrator has configured two IPsec tunnels in the same SD-WAN zone and a health check for each. Which SD-WAN rule configuration ensures that traffic uses the tunnel with the lowest latency and fails over when the primary tunnel fails the health check?
A network administrator needs to apply a security profile to traffic that matches a specific SD-WAN rule. The SD-WAN rule steers traffic out of two IPsec tunnels based on application detection. Where should the administrator apply the security profile?
An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?
A network administrator wants to ensure that IPsec traffic between two FortiGate SD-WAN members is encrypted with a specific set of algorithms. The administrator configures Phase 2 selectors on both peers. Which Phase 2 parameter must match on both ends for the tunnel to come up?
A FortiGate is configured with two IPsec overlays in an SD-WAN zone. The administrator wants to ensure that return traffic from the remote subnet arrives on the same overlay that the original session used, but the remote gateway IP is the same on both overlays. Which SD-WAN member setting should be configured to achieve this?
An administrator is configuring an SD-WAN rule that uses the 'SLA' strategy with two members: a primary MPLS link and a backup LTE link. The SLA target is latency < 100 ms and packet loss < 1%. The administrator notices that when the MPLS link fails the SLA, traffic is not failing over to LTE. What could be the cause?
A network administrator is configuring an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the spoke can dynamically learn routes from the hub and also advertise its local subnets. Which routing protocol is most commonly used in Fortinet SD-WAN deployments to achieve this?
An administrator is configuring a new SD-WAN rule to steer traffic based on application signatures. The administrator wants to ensure that the rule only matches traffic for Microsoft Teams and prioritizes it over other traffic. Which SD-WAN rule configuration should be used?