ECMP Load Balancing Method: source-destination-ip
A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?
Quick Answer
The correct ECMP load balancing method is source-destination-ip. This method distributes sessions by hashing both the source and destination IP addresses together, which guarantees that all packets belonging to the same traffic flow—defined by a unique source-destination pair—are forwarded over the same path, even when multiple equal-cost routes exist. On the Fortinet NSE 4 exam, this scenario tests your understanding of ECMP load balancing under `config system settings`, where the administrator’s goal is to use both ISP links simultaneously for outbound traffic while preserving per-session consistency. A common trap is confusing this with the `source-ip` method, which only hashes the source address and can cause asymmetric routing for return traffic. Remember the mnemonic: “Two IPs, one path—source-destination-ip keeps the session math.”
⚠ Common exam trap
A common mix-up: candidates confuse ECMP load balancing methods with general load balancing techniques, mistakenly selecting weighted-round-robin because it sounds like a standard load balancing algorithm, but it does not guarantee per-source-destination pair distribution in FortiGate's ECMP context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
source-destination-ip
The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
weighted-round-robin
Why it's wrong here
This is not an ECMP method; ECMP uses hashing based on fields.
- ✗
vip-inbound-grpc
Why it's wrong here
This is not a valid ECMP method.
- ✗
spillover
Why it's wrong here
Spillover is a different feature for link load balancing.
- ✓
source-destination-ip
Why this is correct
Correct method to distribute sessions per source-destination IP pair.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with two equal-cost static routes to the same destination network (0.0.0.0/0) via two different ISPs. The administrator wants to use both links simultaneously for load balancing. What must be enabled?
medium- ✓ A.ECMP (Equal Cost Multi-Path) routing
- B.SD-WAN
- C.Link load balancing
- D.Policy routing
Why A: Equal Cost Multi-Path (ECMP) routing is the correct feature to enable because it allows a FortiGate to load-balance traffic across multiple static routes that have the same metric (distance) to the same destination (0.0.0.0/0). By default, FortiGate uses a single best route; enabling ECMP distributes sessions across both ISP links based on a hash algorithm (e.g., source-destination IP), achieving simultaneous utilization without requiring dynamic routing protocols.
Variation 2. A FortiGate has two WAN interfaces (wan1, wan2) configured with ECMP routes to the same destination. The administrator notices that traffic for a single session is being load-balanced across both links, causing performance issues. What should be configured to ensure sessions stick to one link?
hard- A.Set policy routing to use source-based routing.
- ✓ B.Change ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based'.
- C.Configure SD-WAN rules to enforce per-session stickiness.
- D.Disable ECMP and use a single default route.
Why B: Changing the ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based' ensures that all packets belonging to the same session (identified by source IP or source-destination IP pair) are hashed to the same egress interface. This prevents a single session from being split across multiple WAN links, which can cause out-of-order packets and performance degradation. FortiGate’s ECMP hash algorithm uses the configured method to compute a hash value that deterministically selects the outgoing interface for each flow.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.