Quick Answer
The correct ECMP load balancing method is source-destination-ip. This method distributes sessions by hashing both the source and destination IP addresses together, which guarantees that all packets belonging to the same traffic flow—defined by a unique source-destination pair—are forwarded over the same path, even when multiple equal-cost routes exist. On the Fortinet NSE 4 exam, this scenario tests your understanding of ECMP load balancing under `config system settings`, where the administrator’s goal is to use both ISP links simultaneously for outbound traffic while preserving per-session consistency. A common trap is confusing this with the `source-ip` method, which only hashes the source address and can cause asymmetric routing for return traffic. Remember the mnemonic: “Two IPs, one path—source-destination-ip keeps the session math.”
This NSE4 practice question tests your understanding of system and network administration. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate is configured with two equal-cost static default routes via two ISPs. The administrator wants to use both links simultaneously for outbound traffic, distributing sessions per source-destination pair. Which ECMP load balancing method should be configured under config system settings?
weighted-round-robin
Why wrong: This is not an ECMP method; ECMP uses hashing based on fields.
vip-inbound-grpc
Why wrong: This is not a valid ECMP method.
spillover
Why wrong: Spillover is a different feature for link load balancing.
source-destination-ip
Correct method to distribute sessions per source-destination IP pair.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
source-destination-ip
The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
weighted-round-robin
Why it's wrong here
This is not an ECMP method; ECMP uses hashing based on fields.
vip-inbound-grpc
Why it's wrong here
This is not a valid ECMP method.
spillover
Why it's wrong here
Spillover is a different feature for link load balancing.
source-destination-ip
Why this is correct
Correct method to distribute sessions per source-destination IP pair.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
The trap here is that candidates often confuse ECMP load balancing methods with general load balancing techniques, mistakenly selecting weighted-round-robin because it sounds like a standard load balancing algorithm, but it does not guarantee per-source-destination pair distribution in FortiGate's ECMP context.
Detailed technical explanation
ECMP (Equal-Cost Multi-Path) routing in FortiGate uses a hash algorithm based on the selected load balancing method to determine the egress interface for each session. The source-destination-ip method hashes the source and destination IP addresses together, providing deterministic path selection per flow, which is crucial for stateful firewalls to avoid asymmetric routing and session drops. In real-world scenarios, this method is ideal for environments with multiple WAN links where per-flow load balancing is required without the complexity of policy-based routing.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
System and Network Administration — study guide chapter
Learn the concepts, then practise the questions
System and Network Administration practice questions
Targeted practice on this topic area only
All NSE4 questions
1,000 questions across all exam domains
Fortinet NSE 4 Network Security Professional NSE4 study guide
Full concept coverage aligned to exam objectives
NSE4 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise NSE4 questions linked to System and Network Administration.
Practise NSE4 questions linked to Firewall Policies and NAT.
Practise NSE4 questions linked to Authentication and VPN.
Practise NSE4 questions linked to Security Profiles.
Practise NSE4 questions linked to High Availability and Diagnostics.
Practise NSE4 questions linked to NSE4 fundamentals.
Practise NSE4 questions linked to NSE4 scenario.
Practise NSE4 questions linked to NSE4 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
System and Network Administration — This question tests System and Network Administration — Read the scenario before looking for a memorised answer..
The correct answer is: source-destination-ip — The source-destination-ip method under ECMP load balancing distributes sessions based on both source and destination IP addresses, ensuring that all packets belonging to the same session (same source-destination pair) are forwarded via the same path. This meets the requirement of using both links simultaneously for outbound traffic while maintaining per-session consistency.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with two equal-cost static routes to the same destination network (0.0.0.0/0) via two different ISPs. The administrator wants to use both links simultaneously for load balancing. What must be enabled?
mediumWhy A: Equal Cost Multi-Path (ECMP) routing is the correct feature to enable because it allows a FortiGate to load-balance traffic across multiple static routes that have the same metric (distance) to the same destination (0.0.0.0/0). By default, FortiGate uses a single best route; enabling ECMP distributes sessions across both ISP links based on a hash algorithm (e.g., source-destination IP), achieving simultaneous utilization without requiring dynamic routing protocols.
Variation 2. A FortiGate has two WAN interfaces (wan1, wan2) configured with ECMP routes to the same destination. The administrator notices that traffic for a single session is being load-balanced across both links, causing performance issues. What should be configured to ensure sessions stick to one link?
hardWhy B: Option B is correct because changing the ECMP load balancing method to 'source-ip-based' or 'source-dst-ip-based' ensures that all packets belonging to the same session (identified by source IP or source-destination IP pair) are hashed to the same egress interface. This prevents a single session from being split across multiple WAN links, which can cause out-of-order packets and performance degradation. FortiGate’s ECMP hash algorithm uses the configured method to compute a hash value that deterministically selects the outgoing interface for each flow.
Keep practising
Last reviewed: Jun 24, 2026
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.