You are deploying a new FortiGate SD-WAN solution with two WAN links. You want the FortiGate to automatically detect link degradation and dynamically steer traffic away from the failed link without manual intervention. Which feature must you configure to achieve this?
An administrator is configuring an SD-WAN member on a FortiGate. The member uses a physical WAN interface with a dynamic IP address from the ISP. The design requires that the FortiGate use a specific public IP address for the overlay tunnel source, which differs from the interface IP assigned by the ISP. Which SD-WAN member setting should the administrator configure to achieve this?
You are configuring a Performance SLA to monitor an SD-WAN member. You want to ensure that the SLA accurately reflects the link's ability to carry business-critical traffic. Which two parameters must you configure to define the SLA thresholds? (Choose two.)
You are setting up a new SD-WAN deployment on a FortiGate. You have two WAN interfaces, wan1 and wan2, that you want to combine into an SD-WAN zone called 'virtual-wan-link'. After creating the zone, you attempt to add wan1 to it, but the interface is not available in the member list. What is the most likely reason?
You have two SD-WAN members, wan1 and wan2, in separate zones. You want sessions that egress wan1 to return through wan1 even when wan2 has a lower-cost route to the return destination. Which member setting enforces this?
A FortiGate is configured with SD-WAN, and the administrator notices that a specific application is not being steered by an SD-WAN rule even though the rule matches the application signature. What is the most likely reason?
An administrator is configuring an SD-WAN rule that uses the 'Manual' strategy. The rule must ensure that traffic is load-balanced across two members, but only when both members meet the performance SLA. If one member fails the SLA, all traffic should use the remaining member. Which two configuration steps are required to achieve this? (Choose two.)
You are deploying a FortiGate SD-WAN solution with two internet links, wan1 and wan2, in the same SD-WAN zone named 'virtual-wan-link'. You want to ensure that if the primary link's Performance SLA fails, traffic automatically uses the secondary link, but if both fail, traffic is still allowed on the primary. Which configuration should you use?
You are configuring SD-WAN on a FortiGate and need to add a new interface to an SD-WAN zone. Which two prerequisites must be met before the interface can be added to the zone? (Choose two.)
You are configuring an SD-WAN member on a FortiGate running FortiOS 7.2. The member is a 5G/LTE modem interface that gets its IP address dynamically from the carrier. You need to enable the FortiGate to build a secure SD-WAN overlay with a remote FortiGate over that dynamic interface. Which SD-WAN member setting must you configure to identify the remote peer when the local address is not statically assigned?
You are deploying a new FortiGate SD-WAN solution at a branch office. The branch has two ISP connections: a 100 Mbps fiber link and a 50 Mbps cable link. You want to add both interfaces to an SD-WAN zone so that SD-WAN rules can select between them. After configuring the interfaces with static IP addresses and default gateways, you attempt to create an SD-WAN zone and add the interfaces, but the interfaces do not appear in the available list. Which configuration step is missing?
You are configuring a Performance SLA on a FortiGate to monitor the quality of your WAN links. You want to ensure that the SLA probe uses HTTP to check the availability of a critical web application. Which configuration parameter must you set to specify the protocol used for the probe?
An administrator is configuring an SD-WAN rule to route traffic based on the lowest latency to a critical application. The rule uses the 'lowest latency' strategy and includes two members: 'wan1' and 'wan2'. Both members have Performance SLAs configured. After applying the configuration, the administrator notices that traffic is not being distributed as expected and always uses 'wan1' even when 'wan2' has lower latency. What is the most likely cause?
You are configuring an SD-WAN rule to route traffic from the 'Finance' department to a critical cloud application. The rule uses the 'lowest-cost (SLA)' strategy. You have two members: wan1 (cost 10) and wan2 (cost 20). Both meet the SLA. You want to ensure that traffic from Finance always uses wan1 unless wan1 fails its SLA. What should you do?
An engineer is deploying a new FortiGate SD-WAN solution. The design requires that the WAN interfaces be grouped into an SD-WAN zone so that different rules can reference the zone. The interfaces are already configured with static IP addresses and are passing traffic. According to Fortinet best practice, which step must be completed before adding the interfaces to the SD-WAN zone?
You are configuring an SD-WAN rule to route traffic based on the lowest latency. You have three members: port1, port2, and port3. You want the rule to select the member with the best latency among those that meet the SLA. Which strategy should you use?
You are preparing a FortiGate for SD-WAN deployment. The FortiGate has two WAN interfaces, wan1 and wan2, and you want to create an SD-WAN zone named 'virtual-wan-link' that includes both. Which configuration step is required before you can add wan1 and wan2 to the SD-WAN zone?
You have configured an SD-WAN rule with the 'Priority' strategy to route VoIP traffic. The rule includes two members: wan1 (priority 1) and wan2 (priority 2). Both members are currently meeting their SLA targets. However, you notice that some VoIP traffic is being routed out wan2 instead of wan1. What is the most likely explanation?
You are deploying a FortiGate SD-WAN hub with two members, wan1 and wan2, and you must ensure that the SD-WAN configuration is deterministic and survives a FortiGate reboot even if the physical link status changes during startup. You want to configure the SD-WAN member interface order and priority manually, and you also want to prevent the SD-WAN from automatically adding interfaces to a zone. Which two configuration actions should you take? (Choose two.)
You are setting up a new FortiGate SD-WAN deployment. You have created an SD-WAN zone named 'sdwan-zone' and added two interfaces, port1 and port2. You now need to create an SD-WAN rule to route traffic from the internal network to the internet. Which configuration object must you reference in the SD-WAN rule to specify the destination?
A FortiGate at a branch office is being prepared for SD-WAN. The administrator wants to add the physical wan1 and wan2 interfaces as SD-WAN members so they can be referenced by SD-WAN rules. Which step must be completed before wan1 and wan2 can be added to an SD-WAN zone?
A network administrator is configuring a Performance SLA to monitor the quality of two WAN links used for SD-WAN. The SLA must send probes that can measure latency, jitter, and packet loss to a target server. Which protocol should be selected for the Performance SLA probes to meet this requirement?
You have configured an SD-WAN rule that uses the 'Manual' strategy with port1 as the preferred member and port2 as standby. You notice that traffic is not failing over to port2 when port1 becomes unavailable. What could be the reason?
You are configuring a Performance SLA to monitor the quality of a WAN link for SD-WAN. The SLA will use UDP probes to a remote server. You want the SLA to mark the link as failed if packet loss exceeds 5% or if jitter exceeds 30 ms. You configure the SLA with the appropriate thresholds. However, after applying the configuration, you notice that the link is never marked as failed even when packet loss is high. What is the most likely reason?
You are configuring an SD-WAN member on a FortiGate. The member uses a WAN interface that is also used for other services. You need to ensure that the SD-WAN member can monitor link health and that the FortiGate can correctly forward traffic out of the member. (Choose two.)
You are setting up a new SD-WAN deployment on a FortiGate. You want to ensure that the SD-WAN configuration is applied to traffic from a specific VLAN. Which step must you take to include the VLAN interface in the SD-WAN configuration?
You are deploying a new FortiGate SD-WAN solution at a site with two internet links: wan1 (static IP) and wan2 (DHCP). You want to add both interfaces to an SD-WAN zone named 'virtual-wan-link'. You have already created the zone in the GUI. Which step must you complete before the interfaces can be added to the zone?
An administrator is setting up a new SD-WAN deployment on a FortiGate running FortiOS 7.4. The ISP provides a single physical WAN link, but the administrator needs to run separate SD-WAN rules for voice and guest traffic. Which FortiGate configuration object must be created BEFORE the physical interface can be referenced in an SD-WAN rule?
An administrator is configuring a Performance SLA on a FortiGate to monitor the health of SD-WAN members. The SLA will be used to trigger failover when thresholds are breached. Which two parameters must be configured in the Performance SLA to define the health check? (Choose two.)
A FortiGate is configured with an SD-WAN rule that uses the 'Lowest Cost (SLA)' strategy. The rule includes two members: wan1 (cost 10) and wan2 (cost 20). Both members meet the SLA. However, the administrator observes that all matching traffic is being sent out wan2. What is the most likely reason for this behavior?
You are configuring an SD-WAN rule to steer traffic based on application signatures. You want to ensure that the rule matches traffic for Microsoft 365 and selects the best link based on performance. Which configuration step is necessary to enable application-based matching in the SD-WAN rule?
You are configuring a new SD-WAN Performance SLA to monitor the quality of a WAN link. You want the SLA to send probes to a public DNS server at 8.8.8.8 and measure round-trip time. Which protocol should you select for the Performance SLA probes to achieve this with minimal overhead?
A FortiGate is configured as an SD-WAN hub with two overlay members, one using IPsec and one using ADVPN. An administrator wants SD-WAN to automatically prefer the ADVPN shortcut for branch-to-branch traffic, but the shortcut path is not being selected. Which SD-WAN member setting must be enabled to allow the shortcut to be considered as a valid egress path?
An administrator is configuring an SD-WAN zone with three members: two wired WAN links and one LTE backup. The LTE member is expensive per gigabyte, so it must only be used when both wired links fail. Which SD-WAN rule configuration achieves this requirement with the least manual intervention?
An administrator is configuring SD-WAN on a FortiGate and needs to define the members of an SD-WAN zone. Which two interface types can be added as SD-WAN members? (Choose two.)
You are configuring a Performance SLA to monitor reachability to a SaaS application. Which parameter determines the threshold for an interface to be considered 'unhealthy' in the SD-WAN routing table?
An SD-WAN rule is configured with 'Lowest Cost (SLA)' strategy. If all members in the SLA meet the requirements, how does the FortiGate select the outgoing interface?
You are configuring an SD-WAN rule to load-balance traffic across three WAN links. You want to ensure that the rule uses all available links while respecting the SLA status of each member. Which strategy should you select?
A network engineer is deploying a new SD-WAN on a FortiGate. The design requires a single overlay tunnel that carries multiple VLANs between the branch and the hub, and each VLAN must be mapped to its own SD-WAN zone so that different SD-WAN rules can steer traffic per VLAN. Which configuration element must the engineer create on the overlay interface to support this design?
An engineer is configuring an SD-WAN member on a FortiGate to use a static gateway that differs from the interface's detected next-hop. Which CLI configuration correctly applies this override?
An administrator is validating a new SD-WAN deployment before going live. The design requires that the FortiGate detect link degradation before users notice it and that failover decisions be based on measured path quality rather than physical link state. Which two configuration elements are required to meet these goals? (Choose two.)
A network administrator is adding a new WAN interface to an existing SD-WAN deployment. The interface is currently not referenced by any SD-WAN zone. What is the required first step before the interface can be used as an SD-WAN member?
You are configuring an SD-WAN rule that must load-balance traffic across two WAN links while guaranteeing that both links meet a 100 ms latency SLA. Which strategy should you select for the rule?
An engineer needs to configure an SD-WAN rule that sends traffic out the member with the lowest latency for a specific application, but also wants the rule to automatically fail over to the next-best member if the primary member's latency exceeds a threshold. Which SD-WAN strategy and configuration should be used?
A network administrator is setting up an SD-WAN rule to steer traffic to a SaaS application. The rule uses a performance SLA that monitors the SaaS application's IP address. The administrator wants the SD-WAN rule to prefer the member with the lowest latency. Which SD-WAN rule strategy should be selected?
You are deploying an SD-WAN rule that must prioritize VoIP traffic over the best available link based on real-time performance. You have configured a Performance SLA with strict latency and jitter thresholds. Which SD-WAN rule strategy ensures that VoIP traffic uses the link with the lowest jitter that meets the SLA?
You are configuring an SD-WAN rule to route traffic to a critical SaaS application. You want the rule to select the best link based on multiple performance metrics: latency, jitter, and packet loss. You have created a Performance SLA that monitors these metrics. Which SD-WAN rule strategy should you use to achieve this?
You are adding a new physical interface to an existing SD-WAN deployment. Which step must be completed before the interface can be referenced by an SD-WAN rule?
You are deploying a new SD-WAN topology and must ensure that SD-WAN rules can distinguish business-critical traffic from bulk traffic. Which two rule match conditions can you configure to classify traffic for this purpose? (Choose two.)
A network engineer is adding a new WAN link to an existing SD-WAN deployment on a FortiGate. The physical interface 'wan3' has been configured with an IP address and is up, but it does not appear in the list of available interfaces when the engineer tries to add it to an SD-WAN zone. Which action should the engineer take to resolve this?
A Performance SLA bound to an SD-WAN zone is configured with a 200 ms latency threshold and a 5% packet-loss threshold. A member reports 180 ms latency but 8% packet loss. What is the member's SLA state, and how does it affect rule selection?
A network engineer is adding a new physical interface to an existing SD-WAN zone on a FortiGate. The interface is currently used for management access. Which prerequisite must be met before the interface can be added to the SD-WAN zone?
You are deploying an SD-WAN solution with two WAN links: port1 (primary) and port2 (secondary). You need to ensure that when port1 fails its Performance SLA, the FortiGate automatically removes it from the SD-WAN zone until it recovers. Which configuration step is required to achieve this behavior?
A FortiGate is deployed in an SD-WAN environment with two WAN links: port1 (static, 100 Mbps) and port2 (DHCP, 50 Mbps). The administrator wants SD-WAN rules to automatically prefer port1 for all traffic unless its measured latency exceeds 150 ms, in which case traffic should fail over to port2. Which configuration element must be defined and referenced by the SD-WAN rule to achieve this behavior?
You are configuring an SD-WAN rule to route business-critical traffic (HTTP and HTTPS) over the best available link based on lowest latency. You have two members in the SD-WAN zone: WAN1 and WAN2. You create a Performance SLA named 'Latency-SLA' that monitors 8.8.8.8 using ICMP probes with a threshold of 150 ms. You apply this SLA to both members. In the SD-WAN rule, you set the strategy to 'Lowest Latency' and select the SLA. After applying the configuration, you notice that HTTP traffic is still using WAN1 even though WAN2 has lower latency according to the SLA monitor. What is the most likely cause?
You are building a new SD-WAN template in FortiManager to push to 40 branch FortiGates. The template must define two SD-WAN zones, the member interfaces, and the Performance SLA health checks, but the branch WAN IP addresses differ per site and must not be part of the template. Which FortiManager object type should you use to package the shared SD-WAN configuration?
An administrator is setting up a new SD-WAN deployment on a FortiGate. They have two interfaces, port1 and port2, that will be part of the SD-WAN. They want to group these interfaces into a single SD-WAN zone named 'virtual-wan-link' to simplify rule configuration. Which step is required before adding the interfaces to the SD-WAN zone?
An engineer is configuring a new SD-WAN deployment on a FortiGate running FortiOS 7.2. The SD-WAN zone named 'virtual-wan-link' already exists with two members, but the engineer needs to add a third member that is a VLAN sub-interface named 'WAN3_VLAN'. After adding the interface to the zone, traffic still does not traverse the new member. What is the most likely reason?
You are setting up an SD-WAN configuration on a FortiGate. You want to ensure that the SD-WAN rules you create will be able to use the WAN interfaces. You have already configured the interfaces with IP addresses and default gateways. Which additional configuration object must you create to group the interfaces for use in SD-WAN rules?
An SD-WAN rule uses the lowest-cost (SLA) strategy with two members, wan1 and wan2. wan1 has a lower configured cost than wan2, and both currently meet the SLA. A network engineer observes that all matching traffic egresses wan1. The engineer now wants traffic to prefer wan2 whenever wan2 meets the SLA, while still failing over to wan1 if wan2 degrades. What should the engineer change?
A network administrator is deploying SD-WAN on a FortiGate and needs to ensure that the SD-WAN zone can be referenced in firewall policies. Which configuration step is mandatory before the zone can be used in a policy?
A network administrator is configuring an SD-WAN rule to steer traffic from the internal network to a critical cloud application. The rule uses the 'SLA' strategy and references a Performance SLA that monitors latency and jitter. The administrator notices that traffic is intermittently being sent over a WAN link that does not meet the SLA thresholds. The Performance SLA is configured with a probe interval of 5 seconds and a failure threshold of 3. What is the most likely reason for this intermittent behavior?
You are configuring an SD-WAN rule to steer traffic to a business-critical application. The rule uses the 'Lowest Cost (SLA)' strategy with two members: a low-cost broadband link and an expensive MPLS link. The broadband link meets the SLA most of the time but occasionally experiences high latency. You want traffic to prefer the broadband link but fail over to MPLS when broadband violates the SLA. Which additional configuration is required to ensure the rule behaves as intended?
You are setting up an SD-WAN zone and need to add two interfaces, port1 and port2. However, the FortiGate GUI does not allow you to add them to the zone. What is the most likely cause?
You are configuring an SD-WAN rule to route VoIP traffic. You want the rule to select the member with the best quality for voice, considering both latency and jitter. You have enabled Performance SLA on both WAN1 and WAN2, monitoring latency and jitter. You need to ensure the rule uses the appropriate strategy and that the SLA is correctly referenced. Which two actions must you perform to achieve this? (Choose two.)
You are deploying a new FortiGate SD-WAN solution with two WAN links: wan1 and wan2. You want SD-WAN rules to be able to select members based on performance SLAs, but you also need to ensure that the SD-WAN configuration is synchronized across a pair of FortiGates in an HA cluster. Which configuration step is required before you can create an SD-WAN rule that references wan1 and wan2?
An engineer is configuring an SD-WAN rule that must load-balance traffic across two members based on the volume of traffic, but also must ensure that if one member's health check fails, traffic is redistributed to the remaining healthy member. Which strategy should be selected in the SD-WAN rule?
You are configuring an SD-WAN rule that must use a specific member interface only when its measured latency is below 50 ms, and otherwise fall back to another member. Which configuration element directly defines the latency threshold that the FortiGate evaluates for that member?
A company has an SD-WAN deployment with three members: port1 (MPLS), port2 (Broadband), and port3 (LTE). The administrator wants to ensure that business-critical traffic uses port1 whenever it meets the SLA, but if port1 fails the SLA, traffic should use port2. If both port1 and port2 fail, traffic should use port3. Which SD-WAN rule strategy should be used to achieve this?
You are troubleshooting an SD-WAN deployment where a rule configured with the 'Best Quality' strategy is not selecting the expected member. The Performance SLA shows that member1 has lower latency and jitter than member2, yet traffic is using member2. Which factor should you verify first?
You are configuring an SD-WAN rule to route business-critical traffic. You want to ensure that the rule uses the best available link based on performance SLAs, and that it can fail over to a secondary link if the primary link's SLA is violated. Which two configuration elements are required to achieve this? (Choose two.)
An engineer is troubleshooting an SD-WAN rule that is not steering traffic as expected. The rule is configured with the 'Lowest Cost (SLA)' strategy and includes two members: member1 (cost 10) and member2 (cost 20). Both members are passing their SLA health checks. However, all traffic is going out member1, and member2 is not used. What is the most likely explanation?
A network engineer is adding two WAN links to a new SD-WAN deployment on a FortiGate. The interfaces are already configured with IP addresses and default gateways. What must be done before these interfaces can participate in SD-WAN rules?
An administrator is configuring SD-WAN on a FortiGate with two WAN interfaces: port1 and port2. They need to ensure that the SD-WAN can properly direct traffic based on application type and link performance. Which two configuration steps are required to enable application-based steering with SLA enforcement? (Choose two.)
You are deploying a new FortiGate for an SD-WAN branch. The branch uses a single physical WAN link that is delivered as a VLAN-tagged subinterface on port1 (VLAN ID 100). You want to add this link to an SD-WAN zone named 'virtual-wan-link'. Which configuration step must be completed before the VLAN subinterface can be selected as an SD-WAN member?
You are configuring an SD-WAN rule for a branch office that must use the lowest-latency path for Microsoft 365 traffic. You have already created a Performance SLA named 'M365_SLA' that measures latency to several Microsoft 365 endpoints. You want the SD-WAN rule to select the member with the best latency among those that meet the SLA. Which SD-WAN rule strategy should you configure?
You are configuring a Performance SLA on a FortiGate to monitor the quality of two WAN links. You need to ensure that the SLA probe uses HTTP to check a specific URL and that it considers the link healthy only if the round-trip time is below 100 ms and packet loss is below 2%. Which two parameters must you configure in the Performance SLA? (Choose two.)
A security administrator needs to allow branch users to reach an internal application server through the SD-WAN overlay. The SD-WAN rule already matches the correct source and destination, and both members pass their Performance SLA checks. Traffic is still being dropped before it reaches the SD-WAN rule. Which configuration must the administrator verify?
An administrator wants an SD-WAN rule to select the member with the best measured quality for Microsoft 365 traffic, and also to ensure that if the best member degrades, traffic moves to the next-best member without manual intervention. The rule must continuously evaluate all eligible members. Which strategy satisfies these requirements?
A FortiGate is configured with an SD-WAN zone containing two members: 'wan1' (static IP, gateway 203.0.113.1) and 'wan2' (DHCP, learned gateway 198.51.100.1). You need to verify the current SD-WAN member health and the measured latency, jitter, and packet loss for each member from the CLI. Which command displays the live SD-WAN health-check results for all members?
You are configuring an SD-WAN rule that uses the 'lowest-cost (SLA)' strategy. You have three members: wan1 (cost 10), wan2 (cost 20), and wan3 (cost 30). All have Performance SLAs configured. Currently, wan1 and wan2 meet their SLAs, but wan3 does not. Which member will be selected for traffic matching this rule?
An SD-WAN rule is configured with the Best Quality strategy and includes two members: WAN1 and WAN2. The Performance SLA for both members is set to monitor latency, jitter, and packet loss. The SLA thresholds are latency 100 ms, jitter 20 ms, and packet loss 1%. Currently, WAN1 has latency 80 ms, jitter 10 ms, and packet loss 0.5%; WAN2 has latency 90 ms, jitter 25 ms, and packet loss 0.2%. Both members are up. Which member will be selected by the Best Quality strategy?
A network engineer is designing an SD-WAN rule that must steer real-time voice traffic to the member with the best measured quality rather than a fixed link. The rule will use Performance SLA results to make the decision. Which two Performance SLA configuration elements directly influence whether a member is considered healthy for this voice rule? (Choose two.)
You are preparing a FortiGate for SD-WAN and need to verify that the underlying system settings will support SD-WAN rule processing and health monitoring. Which two configuration items must be present for SD-WAN to function? (Choose two.)
You are configuring an SD-WAN member for an IPsec tunnel that terminates on a remote FortiGate. The tunnel interface is named 'vpn_to_dc'. You want the SD-WAN member to be usable and to be monitored by a Performance SLA. Which two configuration elements must be present for this member to function correctly in the SD-WAN zone? (Choose two.)
A network engineer is configuring an SD-WAN rule to route VoIP traffic. The requirement is to always use the member with the lowest jitter, even if other members have higher bandwidth. The engineer wants to avoid manual priority configuration. Which SD-WAN strategy should be selected for this rule?
A FortiGate has two SD-WAN members, wan1 and wan2, both in the same zone. The administrator wants sessions that already use wan1 to remain on wan1 even if wan2 becomes the preferred member due to better SLA results, while new sessions should follow the preferred member. Which setting controls this behavior?
You are configuring SD-WAN on a FortiGate that will be managed by FortiManager. You want to ensure that the SD-WAN configuration is consistent across multiple devices and that changes can be deployed centrally. Which action must you take in FortiManager to support SD-WAN configuration?
You are preparing a FortiGate for SD-WAN deployment and need to confirm that the device supports the required features. Which FortiGate hardware or virtual platform characteristic is required to use SD-WAN on FortiOS 7.x?
You are troubleshooting an SD-WAN deployment where a rule configured for VoIP traffic is not being matched. The rule uses a Performance SLA named 'VoIP_SLA' and is set to use the lowest-latency strategy. You have verified that the traffic matches the source and destination criteria, and that the SLA is up on both members. However, the traffic is still using the default route instead of the SD-WAN rule. What is the most likely cause?
You have an SD-WAN zone named 'virtual-wan-link' with members 'wan1' and 'wan2'. You notice that a member interface is administratively up and has a valid IP address, but it is not appearing as a selectable member when you edit the SD-WAN member list. Which condition most likely explains why the interface cannot be added?
An administrator needs to configure an SD-WAN rule that load-balances traffic across two WAN links based on the volume of traffic, ensuring that both links are utilized proportionally to their configured weights. Which SD-WAN rule strategy should be selected?
An administrator is configuring an SD-WAN rule that must ensure business-critical traffic always uses the best path based on measured latency and jitter, while also allowing the rule to fail over to a secondary link if the primary link's SLA is violated. The rule includes three members: wan1, wan2, and wan3. Which two actions must be performed to achieve this? (Choose two.)
An administrator is configuring an SD-WAN member on a FortiGate. The member's interface has a default gateway of 192.168.1.1, but the ISP requires that all traffic from this member be sent to a next-hop of 192.168.1.254 instead. Which SD-WAN member setting should the administrator configure to meet this requirement?
A network administrator is deploying a new FortiGate for SD-WAN and needs to verify that the FortiGate has the required license to use SD-WAN features. Which license is required to enable SD-WAN on a FortiGate?