NSE 7 - SD-WAN (NSE7_SDW) (NSE7_SDW) — Questions 1–75

Security profiles are applied within firewall policies. When an SD-WAN rule steers traffic, the traffic is still matched by a firewall policy that includes the SD-WAN zone as the outgoing interface. The security profiles (such as antivirus, IPS, web filtering) are configured in that policy. This ensures that the profiles are applied to all traffic egressing via the SD-WAN zone, regardless of which member tunnel is selected.

Editing an applied SD-WAN template marks the FortiGate's configuration status as 'Modified', because the change is staged centrally rather than pushed immediately. An installation task must then run to commit the updated template settings to the device, satisfying the requirement that changes are not auto-applied.

By placing the IPsec tunnel in an SD-WAN zone and enabling update-static-route in the health check, FortiOS will dynamically add or remove a static route for the tunnel based on health check status. This ensures that the tunnel is only used for routing when the health check passes, meeting the requirement.

The 'Lowest Cost (SLA)' strategy selects the lowest-cost member that meets the SLA defined in an associated Performance SLA. Without a Performance SLA, the rule cannot determine SLA compliance, so it may always use the lowest-cost member regardless of latency. Creating a Performance SLA with appropriate thresholds and linking it to the rule ensures failover to MPLS when broadband violates the SLA.

An SD-WAN zone is a logical grouping of member interfaces. It is required to apply SD-WAN rules and Performance SLAs to the members. Without a zone, the interfaces cannot be referenced collectively in SD-WAN policies. The zone simplifies configuration and allows rules to dynamically select among members. This is a fundamental step for any SD-WAN deployment that uses multiple links.

Shared Objects in FortiManager are stored centrally and referenced by multiple templates, so a single definition propagates everywhere it is used. This satisfies the reuse requirement, avoiding duplicated configuration across SD-WAN templates and simplifying later updates.

The firewall policy is where UTM profiles are enforced. When the policy's outgoing interface is an SD-WAN zone, the profiles apply to all traffic steered by the rule, regardless of which member is selected. This is the correct place to attach antivirus, IPS, web filtering, and other profiles.

An interface can only belong to one SD-WAN zone at a time. If port1 or port2 is already assigned to a different SD-WAN zone, the GUI will prevent adding them to a new zone. You must first remove them from the existing zone. This is a common oversight when reconfiguring SD-WAN zones, as the system enforces exclusive membership to avoid conflicts.

Session preservation, often exposed as a sticky-session setting in the SD-WAN rule, keeps established flows on their current member even when the preferred member changes. New sessions are still placed according to the current best member, which exactly matches the requirement to keep existing wan1 sessions while letting new ones follow the preferred link.

The Device Manager tab supports selecting multiple managed FortiGates and assigning a single SD-WAN template to them in one operation, satisfying the stem's simultaneity requirement. Provisioning then pushes the shared configuration to each selected device.

Raising the DPD retry count and interval lengthens the tolerance window before a peer is declared dead, absorbing satellite latency spikes so the tunnel stops flapping while failure detection remains active, unlike disabling DPD entirely.

When a new SD-WAN zone is added to a template, it is created on the FortiGate, but no interfaces are automatically assigned to it. The administrator must assign member interfaces to the new zone either through the template or manually. The performance SLA will also be created and can be referenced by rules.

An SD-WAN rule matches traffic by source, and a source IP address object is a valid source criterion, letting the rule identify traffic originating from specific hosts or subnets. Source port, destination and service objects serve other match fields, not the source selector.

Dynamic mapping in SD-WAN templates allows the template to reference variables such as $wan_ip, which are resolved per device during installation. This enables a single template to be used across all 80 devices while accommodating their unique WAN IP addresses. The health check settings are applied consistently, and the variables ensure the correct IP is used on each device.

SD-WAN rules specify the criteria for selecting an outgoing interface, such as best quality, lowest cost, or specific SLA targets. These rules must be configured to use the performance SLA results. Together with performance SLAs, they enable dynamic path selection.

SD-WAN rules reference SD-WAN zones or members, not raw interfaces. You must first configure wan1 and wan2 as SD-WAN members and assign them to a zone (for example, virtual-wan-link). This makes them available for rule selection and performance SLA monitoring. Without this step, the interfaces cannot be used in SD-WAN rules.

The Performance SLA holds the probe type, probe target, and the threshold values such as latency, jitter, and packet loss. When the SD-WAN rule references that SLA, the FortiGate compares each member's live measurements against these targets and marks a member out of SLA when latency exceeds the configured value, which drives the required fallback behavior.

The Inbound setting binds an SD-WAN rule to traffic entering through a specified interface, so the rule matches only flows originating from that member link. This scopes policy enforcement to the intended ingress path rather than all traffic.

The 'Weighted Load Balance' strategy distributes traffic across members based on their configured weight values. This allows the administrator to allocate a larger share of traffic to a higher-capacity link and a smaller share to a lower-capacity link, achieving proportional utilization. It is the only strategy that directly uses weights for load balancing, making it the correct choice for this scenario.

When you modify a health check object, FortiManager updates the reference in all SD-WAN templates that use it. However, the managed FortiGates do not receive the update until an install operation is performed. This two-step process ensures that changes are reviewed and applied deliberately, preventing unintended configuration changes on production devices.

In FortiManager, you can create shared objects, such as health checks, that can be referenced by multiple SD-WAN templates. This ensures consistency and simplifies management. When the shared health check is updated, all templates referencing it inherit the change. This is the most efficient method to apply the same health check across all templates.

Priority rules let SD-WAN steer traffic by ranking member links, so latency-sensitive flows such as voice take the preferred circuit while lower-priority traffic falls back to remaining links. This satisfies the requirement for valid SD-WAN rule strategies alongside service, SaaS and application-based criteria.

Ping is a supported health check protocol in FortiManager SD-WAN templates. It sends ICMP echo requests to a specified server to measure latency, jitter, and packet loss. This is a common method for basic reachability and performance monitoring, and it is configurable within the SD-WAN template's health check settings.

Internet service database entries represent known services and their associated addresses and protocols, allowing rules to match traffic destined for a specific cloud or SaaS service. This gives precise classification for critical services without maintaining manual address objects. It is a supported match condition and complements application-category matching for the described requirement.

A Performance SLA defines the latency threshold and probe parameters. When attached to the SD-WAN zone, the FortiGate continuously measures latency on each member. The SD-WAN rule can then use the SLA target to select the member that meets the threshold. If port1 exceeds 150 ms, it is considered out of SLA, and the rule automatically fails over to port2, achieving the desired behavior.

An SD-WAN member must reference an interface that exists with an IP address, and for an IPsec tunnel this means the tunnel must be established and the tunnel interface must have its IP configured. Without an address, the interface cannot be added as a member or used for routing decisions. This is a foundational requirement for any SD-WAN member.

FortiManager provides a dedicated SD-WAN template object that holds zones, member interface mappings, Performance SLA health checks, and SD-WAN rules. Because it is a normalized object, per-site values such as WAN IP addresses stay in the interface or device settings, while the template references the interfaces by name. This lets one template be assigned to many FortiGates without embedding site-specific addressing.

Point-to-point OSPF network type removes DR/BDR election and its timers, so a flapping backup IPsec link cannot trigger repeated adjacency resets from election churn. This directly addresses the intermittent packet loss constraint described in the stem.

The 'Gateway' setting in an SD-WAN member configuration allows you to override the next-hop IP address for that member. By specifying 192.168.1.254, all traffic routed through this member will use that next-hop instead of the interface's default gateway. This is exactly what the ISP requires. It is a common configuration when the ISP provides a separate next-hop for specific services.

The 'Priority' strategy allows the administrator to assign a priority order to members. The FortiGate will use the highest-priority member that meets the SLA. If it fails the SLA, the next priority member is used, and so on. This exactly matches the requirement: port1 first, then port2, then port3. The priority is configured on each member within the SD-WAN zone or in the rule.

An SLA Target measures per-link jitter against a defined threshold and steers traffic to the member satisfying it. This satisfies the lowest-jitter constraint because forwarding decisions follow measured link quality, keeping VoIP on the interface with acceptable delay variation.

The 'Lowest Cost (SLA)' strategy selects the member with the lowest cost among those that meet the SLA health check. Since both tunnels pass SLA, Tunnel-1 with cost 10 is chosen over Tunnel-2 with cost 20. This strategy is designed to prefer the most cost-effective path while ensuring SLA compliance.

The SD-WAN Health Check object in FortiManager is used to define performance SLA probes, including ICMP, HTTP, and others. By configuring an ICMP health check, the administrator can monitor latency, jitter, and packet loss on the primary WAN link. This object is then referenced in SD-WAN rules to influence member selection.

A site-to-site IPsec VPN with full tunneling and a default route pointing through the tunnel ensures that all traffic from the branch, including internet-bound traffic, is sent to the hub. The hub then routes it to the internet. This configuration meets the requirement of accessing the internet through the hub while also accessing headquarters resources. It is commonly used for centralized internet access and security enforcement.

These thresholds define the pass/fail criteria for the probe. A member is considered healthy only while its measured latency, jitter, and packet loss stay within the configured limits. For voice steering, tuning these values tightly ensures a member that cannot sustain real-time quality is marked down and excluded from selection by the rule.

The best quality strategy ranks all in-SLA members by their Performance SLA measurements and selects the one with the best value for the monitored criteria, such as latency or jitter. Because the evaluation is continuous, a degrading member is replaced by the next-best healthy member automatically, which matches the requirement for dynamic reselection based on measured quality.

Performance SLA defines the probe thresholds—latency, jitter, and packet loss—that FortiGate SD-WAN uses to grade each member link's quality. Members breaching those thresholds are marked dead or degraded, so the rule's path-selection strategy only steers traffic across links satisfying the configured criteria.

The SD-WAN template defines the member interfaces. To add a new VLAN interface, the template must be updated and then the configuration reinstalled to the FortiGate. This ensures the change is tracked in FortiManager and applied consistently, maintaining the template as the source of truth for SD-WAN settings.

With Lowest Cost (SLA), FortiGate first filters members meeting the SLA targets, then breaks ties by the configured interface cost value in the SD-WAN member settings. The lowest-cost member among those passing SLA becomes the selected outgoing interface.

Best Quality strategy selects the link with the best performance according to the SLA (e.g., lowest latency, jitter, packet loss). If the current link fails the SLA, the rule will automatically switch to the next best link that meets the SLA. This ensures traffic is always routed over a link that satisfies the SLA requirements, which is exactly what the administrator wants.

Enabling 'sla' in the health check and setting a latency threshold allows the FortiGate to monitor latency and trigger failover if the threshold is exceeded. This is the correct configuration to meet the requirement. The health check will continuously measure latency and compare it to the threshold, ensuring that failover occurs only when latency is too high. This directly addresses the issue of unnecessary failover due to high latency.

SD-WAN health checks are shared objects that define the monitoring parameters for performance SLAs, such as protocol, server, and thresholds. Referencing them in the SD-WAN template provides the necessary details for latency and packet loss monitoring. This is the correct object to use for defining health checks within a template.

The SLA strategy selects members that currently satisfy the referenced Performance SLA and distributes sessions across those members, so both links are used only while each meets the 100 ms latency threshold. If a member stops meeting the SLA, it is removed from the eligible set, preserving the guarantee. This matches the requirement for load balancing with a per-link SLA guarantee.

The install wizard's Preview shows the configuration that FortiManager will push to the selected FortiGate, including SD-WAN template-derived members, zones, and performance SLA objects. Preview does not modify the device, so the administrator can confirm the resolved configuration before committing the install. This is the supported way to inspect template output per device prior to a production change.

SSL/TLS full inspection makes the FortiGate re-sign traffic with its own CA certificate. Clients only trust that certificate if the FortiGate's CA certificate is installed in their trusted root store, otherwise browsers raise untrusted-certificate warnings.

The 'maximize-bandwidth (SLA)' strategy selects the tunnel with the highest bandwidth among those that meet the SLA criteria. If the higher bandwidth tunnel is not meeting the SLA (e.g., due to latency, jitter, or packet loss), it is excluded from selection, and the lower bandwidth tunnel that meets SLA is used. This is the expected behavior and likely the reason for the observed routing. The administrator should check the SLA status of the higher bandwidth tunnel.

In FortiOS, security profiles are applied within firewall policies. To filter only traffic steered by a specific SD-WAN rule, you create or use a firewall policy that references the SD-WAN zone and matches the intended source, destination, and service. The SD-WAN rule determines the outgoing member, but the Web Filtering profile is enforced by the firewall policy. This achieves selective filtering without affecting other traffic.

Applying the IPS sensor to a firewall policy that uses the IPsec tunnel as the incoming interface ensures that traffic is inspected after decryption and before routing. This is the correct placement because the tunnel interface represents the decrypted traffic. The sensor will then inspect the clear-text packets as they enter the FortiGate from the tunnel.

In FortiOS, an interface must belong to an SD-WAN zone before it can be referenced by an SD-WAN member. The zone groups one or more interfaces logically, and members are created within a zone. Without zone membership, the interface cannot participate in SD-WAN rules, health checks, or steering.

The 'Manual' strategy allows the administrator to define the order of preference for member interfaces. By placing the MPLS interface first and the internet interface second, traffic will use MPLS when available and fall back to the internet link if MPLS fails, as determined by health checks.

fmg_debug.log captures FortiManager daemon debugging, including the specific CLI commands pushed to the FortiGate and the exact command that fails. It satisfies the stem's requirement to identify the failing CLI command during SD-WAN template troubleshooting.

An SD-WAN Health Check Template in FortiManager defines health check parameters that can be referenced by multiple SD-WAN templates. When the health check template is updated, all SD-WAN templates referencing it automatically inherit the changes, and upon installation, the managed FortiGates receive the updated configuration. This ensures consistency and centralized management of health checks across all devices.

Source and destination address are both valid SD-WAN rule match criteria, letting you steer traffic by subnet or host pair. This satisfies the stem's requirement for two selectable criteria, since FortiGate SD-WAN rules support source and destination as matching fields alongside application and service.

SD-WAN templates in FortiManager support metadata variables that can be assigned per device, allowing interface names to be dynamically substituted during provisioning. This enables a single template to adapt to different interface naming conventions across branches, eliminating manual edits and ensuring consistency. The template defines the SD-WAN structure, and variables map device-specific values, which is exactly what the administrator needs for heterogeneous environments.

The installation preview shows the exact CLI commands that FortiManager will send to the FortiGate. By reviewing it, the administrator can identify syntax errors, missing objects, or conflicts with existing configuration. This is a primary troubleshooting step for failed installs.

The restoretime setting defines how many consecutive successful probes must occur before FortiOS marks a failed SD-WAN member healthy again. This hysteresis prevents flapping, and it is one of the three criteria governing performance SLA state transitions.

For an SD-WAN member to be used, it must pass its associated Performance SLA health check. A VLAN sub-interface requires a valid next-hop gateway for the health check probes to reach the SLA target. Without a reachable gateway, the member is marked down and traffic will not be steered to it. This is the most common oversight when adding a new member to an existing zone.

Grouping physical interfaces into one SD-WAN zone lets a single firewall policy govern all member interfaces, since policy is applied per zone rather than per link. This satisfies the stem's aim of simplified, consistent policy enforcement across multiple WAN links.

Dynamic Mapping lets one template object resolve to differing physical interfaces or settings per device, so a single SD-WAN template deploys across heterogeneous hardware without duplication. This satisfies the stem's deployment constraint: device-specific values are bound at push time rather than hard-coded, keeping the template portable.

Health-based strategies and failover decisions depend on Performance SLA results, so an SLA object must exist and be referenced by the rule when link quality matters. It supplies the probe type, servers, and thresholds that determine whether a member is in or out of SLA, making it essential for any deployment that steers on measured conditions.

SD-WAN traffic steering requires member interfaces to be defined in the template, since these are the physical or overlay links across which rules direct traffic. Without members, no eligible paths exist for steering decisions, so the template cannot enforce the required forwarding behaviour.

SD-WAN templates are FortiManager-managed objects, so the manager must push the revised template to the FortiGate for it to take effect. This satisfies the stem's requirement for changes requiring a manager-initiated push rather than local device configuration.

SLA health checks in FortiOS SD-WAN allow administrators to define performance thresholds such as latency, jitter, and packet loss. When an SD-WAN rule references an SLA health check, the rule only considers members that meet those thresholds. This is the correct feature to enforce the specified latency and packet loss limits.

Matching on source IP or user lets the rule identify which traffic the SD-WAN policy governs, so only flows originating from the specified address or identity are steered. This satisfies the requirement to define the traffic source before applying path selection and SLA actions.

The diagnose sys sdwan service command lists each SD-WAN service rule with its hit counters, showing which rules traffic is matching. This directly satisfies the requirement to view active rule hit counts and verify traffic matching a specific rule.

The SD-WAN Monitor in FortiManager reports the operational state of each SD-WAN member interface, showing whether individual links are up or down. This satisfies the stem's requirement for member status, one of the three displayed items, alongside SLA performance and traffic steering information.

If the SD-WAN template installation failed or was not performed on that specific FortiGate, the device would keep its previous SD-WAN configuration, including rule order. This can happen if the device was offline during installation or if it was not included in the installation target. The result is a mismatch compared to other devices.

The gateway parameter under config system sdwan members explicitly sets the next-hop used for health checks and traffic steering on that member. It is the supported way to override the auto-detected gateway when the ISP uses an atypical topology, such as a routed subnet where the FortiGate must send probes to a specific upstream address.

For an SD-WAN rule to take effect, the traffic must be allowed by a firewall policy that references the SD-WAN zone as the outgoing interface. If the existing firewall policy uses a physical interface or the default route instead of the SD-WAN zone, the SD-WAN rule will not be applied. This is a common oversight: the SD-WAN rule only influences member selection within the zone, but the zone must be referenced in the firewall policy to be used at all.

`diagnose vpn tunnel list` enumerates all IPsec tunnels on the hub, including ADVPN shortcut tunnels, showing their names, source and destination addresses, and state. This directly satisfies the stem's requirement to verify active shortcuts and view shortcut state information, whereas other commands lack this per-tunnel IPsec visibility.

Creating 802.1Q VLAN sub-interfaces on the IPsec tunnel interface lets one overlay carry multiple VLANs. Each sub-interface can be placed in its own SD-WAN zone, so SD-WAN rules and performance SLAs can be scoped per VLAN. This matches the design requirement of one tunnel with per-VLAN steering.

After modifying an SD-WAN template in FortiManager, the changes are not automatically pushed to managed devices. The administrator must initiate an installation of the template to the affected FortiGates. This process updates the devices with the new SLA probe interval while preserving other configuration. Installation can be done per device or in bulk, and it ensures the change is applied consistently across all 30 devices.

FortiManager SD-WAN templates support metadata variables, which allow administrators to use placeholders like $hostname or $wan_ip that are resolved per device during installation. This enables a single template to be used across devices with different settings, such as WAN IP addresses or interface names. This feature is essential for scalability and reducing manual configuration.

The 'lowest cost (SLA)' strategy first filters members that satisfy the SLA criteria, then chooses the one with the lowest configured cost. If both meet the SLA, the lower-cost tunnel is selected. This provides a deterministic preference for cost while ensuring quality thresholds are met.

The diagnose sys sdwan health-check command displays per-member SLA statistics, including latency, jitter and packet loss, for each configured health check. It directly satisfies the requirement to inspect real-time performance of individual health check members.