NSE 7 - SD-WAN (NSE7_SDW) (NSE7_SDW) — Questions 76–150

SD-WAN is a core feature of FortiOS and is available on all FortiGate models without any extra license. Administrators can configure SD-WAN zones, members, performance SLAs, and rules directly from the GUI or CLI. No subscription or add-on is needed to enable or use SD-WAN functionality.

In FortiOS, even if an IPsec tunnel is up, traffic will not pass without a firewall policy that permits the source, destination, and service, and that includes the IPsec tunnel as an outgoing interface. This is a common oversight when configuring SD-WAN with IPsec.

FortiManager requires an explicit install action to push configuration changes to a managed FortiGate. Even if the device is offline during the template modification, the changes are not applied until a subsequent install operation is performed. The FortiGate will continue using its last installed configuration until then.

Adding the IPsec interface to an SD-WAN zone lets the FortiGate treat the tunnel as a member interface, enabling health checks and steering rules. Without a valid interface and IP configuration, the tunnel cannot participate in zone-based path selection, breaking SD-WAN operation.

This command prints the current state of every Performance SLA health check and the per-member measurements it has collected, including latency, jitter, packet loss, and whether each member is up or down. It is the primary CLI tool for confirming that SD-WAN members are passing their SLA thresholds and for seeing the exact values used by the rule engine.

After modifying an SD-WAN template, the administrator must install the policy package to the managed FortiGates that use the template. FortiManager allows selecting multiple devices for installation, which pushes the updated configuration to all of them simultaneously. This ensures the new SD-WAN member is applied consistently across all devices.

Correct. This command displays the routes being advertised by the FortiGate to a specific BGP neighbor.

Modifying the SD-WAN template in FortiManager and re-applying it will propagate the changes to all managed devices that use the template. FortiManager tracks which devices are assigned to the template and can update them automatically, ensuring consistency. This is the most efficient method for bulk updates.

SD-WAN templates in FortiManager define policy centrally, then push it to managed devices. This guarantees every device receives identical SD-WAN rules, eliminating per-device drift and satisfying the requirement for consistent policy application across the estate.

This is a shared object in FortiManager that defines health check parameters such as protocol, server, and interval. When referenced in an SD-WAN template, it ensures consistent health check settings across all managed devices. This directly meets the requirement of standardizing health check settings for a specific SLA target without redefining them per device.

Packet loss threshold directly feeds the Performance SLA calculations: SD-WAN templates compare measured loss against this configured threshold to decide whether a member link breaches the SLA and should be removed from the active path.

Destination address is a supported SD-WAN rule matching criterion, allowing traffic steering based on the target IP subnet or address object. This satisfies the traffic-matching requirement by identifying flows destined for particular remote networks or services.

Lowest Latency (SLA) selects the member with the lowest latency among those that meet the SLA. This directly matches the requirement to route VoIP over the link with the lowest latency (MPLS) and automatically fail over to the next best member (internet VPN) if MPLS fails the SLA. It is the most appropriate strategy for latency-sensitive traffic like VoIP.

The lowest-latency strategy selects the SD-WAN member that has the lowest measured latency among those that meet the Performance SLA. This directly matches the requirement to use the lowest-latency path for Microsoft 365 traffic. The FortiGate continuously monitors latency through the Performance SLA and dynamically switches to the best member, ensuring that real-time applications like Microsoft 365 get the best possible network performance.

The Gateway IP is configured per member under Network > SD-WAN > SD-WAN Members, where each member's interface settings include the gateway address. This satisfies the stem's requirement by placing the gateway at the member level, not the interface or template level, matching FortiManager SD-WAN member configuration.

The priority strategy selects the member with the lowest priority number among those that satisfy the SLA, and it fails over to the next priority when the preferred member degrades. Assigning wan2 the lower priority value makes it the preferred egress while wan1 remains the standby. Changing the strategy is required because the lowest-cost strategy ranks by cost, not by an explicit preference.

The SD-WAN Template object in FortiManager is specifically designed to define and manage SD-WAN configurations centrally. It allows administrators to create a template that can be applied to multiple FortiGates, and any changes to the template are automatically propagated to the devices. This meets the requirement of easy future modifications without manual updates per device.

The Participant is the SD-WAN member that generates the probe traffic, so the SLA measures reachability and quality from that specific device's perspective. Choosing the correct member ensures the health check reflects the actual path and egress point being monitored.

Maximize Bandwidth (SLA) distributes traffic across all members that meet the SLA, aggregating their bandwidth. It load-balances sessions across the eligible links, ensuring that all available capacity is used while avoiding links that fail the SLA. This directly matches the requirement to use all links while respecting SLA status.

SD-WAN rules are evaluated in order, and the first matching rule is applied. If a rule above the intended rule matches the same traffic, it will take precedence, causing traffic to use a different member. Verifying rule order is the first step because a higher rule can override the 'Best Quality' selection. This is a common cause of unexpected member selection.

FortiOS treats an SD-WAN zone as a route gateway by intercepting the route lookup, then applying SD-WAN rules to choose the member interface dynamically. Selection is driven by performance SLA measurements, satisfying the requirement for SLA-based path selection rather than a fixed next hop.

In FortiOS, SD-WAN rules are used within firewall policies. The security profiles must be applied to the firewall policy that references the SD-WAN rule. If the policy that matches the traffic does not have security profiles enabled, inspection will not occur. Even if profiles are applied to the SD-WAN zone, the policy must also have them. This is the most likely cause.

An interface must have an IP address and be administratively up before it can be added to an SD-WAN zone. The SD-WAN member requires an operational interface to send and receive traffic and to participate in health checks. This is a basic prerequisite for any SD-WAN member.

To have an interface removed from the SD-WAN zone upon SLA failure, you must first create a Performance SLA and then associate it with the SD-WAN member. The FortiGate then monitors the SLA and, if the member fails, it is dynamically removed from the zone. This is the standard method for link health-based membership control.

BGP is the routing protocol most commonly used in Fortinet SD-WAN deployments to exchange routes between hub and spoke over IPsec tunnels. It is scalable, supports policy-based routing, and integrates well with ADVPN for dynamic shortcut tunnels. BGP allows the spoke to advertise its local subnets to the hub and learn hub routes, facilitating dynamic routing. Its flexibility and widespread use in SD-WAN make it the preferred choice. This is the correct answer.

'Best Quality' is a strategy that selects the member with the best overall performance based on the Performance SLA metrics, including latency and jitter. For VoIP traffic, which is sensitive to both, this strategy is appropriate. It dynamically chooses the link that meets the quality criteria, ensuring voice quality. This is a required configuration step to achieve the desired behavior.

SD-WAN rules are evaluated in a top-down sequence.

SD-WAN rules are evaluated sequentially by priority, so the first matching rule wins and subsequent rules are never assessed. If a higher-priority rule already matches the traffic, the intended rule cannot take effect regardless of its own criteria. This directly explains why traffic bypasses the expected rule.

Best Quality selects the member that meets the SLA and has the best overall quality, which is determined by the lowest latency, jitter, and packet loss. For VoIP, jitter is critical, and Best Quality will favor the member with the lowest jitter, satisfying the requirement without manual priority settings.

An SD-WAN Template in FortiManager defines the SD-WAN configuration, including member interfaces, health checks, and rules. It allows administrators to specify logical interface names that are then mapped to physical interfaces on the target device during installation. This template-based approach ensures consistent configuration across multiple devices and simplifies the deployment of SD-WAN.

Modifying the SD-WAN template is the correct first step because the template serves as the centralized definition for SD-WAN rules across all managed devices. By adding the new application category to the template's rules, the administrator ensures that the change is standardized and can be propagated to all branches. This approach minimizes effort and maintains consistency, as the template is the single source of truth for SD-WAN configuration.

The Install Wizard in FortiManager allows you to push configuration changes, including SD-WAN template updates, to multiple managed FortiGates at once. After modifying the template, you must run the Install Wizard and select the devices or groups to update. This ensures the new health check settings are deployed consistently across all branches, maintaining uniform SD-WAN behavior.

SD-WAN is a feature that must be enabled in Feature Visibility before the SD-WAN menu and configuration options become available. Without enabling it, the administrator cannot create or manage SD-WAN zones, members, or rules. This is a mandatory first step in any SD-WAN deployment on FortiGate, and it is often overlooked when setting up a new device.

Best Quality selects the member with the best measured quality according to the SLA metrics, which include latency and jitter. For VoIP, jitter is critical, so this strategy will choose the link with the lowest jitter that still meets the SLA. It dynamically adapts to changing conditions, ensuring optimal voice quality. This directly matches the requirement.

The Maximize Bandwidth (SLA) strategy distributes traffic across all members that meet the SLA, proportionally to their available bandwidth. It provides load balancing based on volume and automatically removes failed members from the pool. This matches the requirement to load-balance while maintaining resilience to health-check failures.

A probe timeout directly breaches the SLA health-check threshold: FortiGate marks a member down when consecutive probes receive no reply within the configured interval, exhausting the retry count. This satisfies the stem's requirement for an SLA-triggered down state, since the member's measured latency, jitter and packet loss become unverifiable.

SD-WAN service rules (also called SD-WAN rules) allow matching on source address, destination, application, and other criteria. By defining a service rule with the source subnet and application, and attaching an SLA target referencing a health check, the FortiGate steers matching traffic over members that meet the jitter SLA. This is the standard method to implement application-aware routing with SLA enforcement.

A Centralized Policy in FortiManager pushes one consistent rule set to every managed FortiGate, so security and traffic routing stay uniform across the large SD-WAN deployment. Local policies would require per-device configuration and risk drift between sites.

Best Quality strategy selects the member with the best quality metric, such as lowest latency, among those that meet SLA targets. When the primary tunnel fails the health check, it is marked out-of-SLA and the other member is chosen. This matches the requirement for lowest latency selection and automatic failover based on health check results.

FortiGate applies BGP MD5 authentication per neighbour using the set password command inside the config router bgp neighbour block, which the cloud provider's peering requirement demands. This CLI location binds the shared secret to each specific peering session.

Packet loss is one of the three metrics a Performance SLA monitors, alongside latency and jitter. It measures the percentage of dropped packets across the SD-WAN member link, satisfying the stem's requirement to identify a valid Performance SLA parameter.

SD-WAN members are grouped into zones, and an interface must belong to a zone before SD-WAN rules can reference it. Creating the zone and adding the interfaces establishes them as SD-WAN members, which is the required step that makes them eligible for steering, health checks, and rule membership in this deployment.

SD-WAN rules choose among members, but a firewall policy must permit the traffic and use the SD-WAN zone as its destination interface for that selection to apply. If no policy references the zone, or the policy is placed after a deny, traffic is dropped before SD-WAN logic matters. Verifying the permitting policy and its position is the correct check.

Shared objects are referenced, not copied, so editing the health check changes the definition used by every template referencing it. FortiGates inherit the updated object only when the policy package is installed, which is why the effect appears after an install rather than immediately.

After modifying a health check object, the changes are only in FortiManager's database. The managed FortiGates will not reflect the new IP until an install operation is performed. If some FortiGates still show the old IP, it means the updated configuration has not been installed on those devices, possibly because they were offline or not included in the last install.

Application Control signatures inspect payload and protocol behaviour, matching the specific application regardless of port, IP or user. This satisfies the stem's constraint of identifying traffic for a specific application, since SD-WAN rules can reference application signatures directly, unlike port-based or address-based definitions.

When every SD-WAN member in a rule breaches its SLA, FortiGate falls back to using all members rather than dropping the traffic, preserving connectivity. This default satisfies the stem's scenario where no member meets its SLA threshold, so forwarding continues across the full member set.

FortiOS only allows interfaces that already exist and have an IP address to be added as SD-WAN members. A VLAN subinterface must first be defined under the parent physical interface with a VLAN ID and then given an IP address (static or DHCP). Until it exists as an addressable interface, it cannot be referenced by the SD-WAN member list.

For the SLA strategy to trigger failover, the SD-WAN rule must reference a health check that monitors the members. If the health check is not assigned to the rule, the FortiGate cannot evaluate the SLA criteria and will not detect that MPLS has failed the SLA. Consequently, no failover occurs. Assigning the correct health check to the rule is essential for SLA-based steering. This is the correct cause because without it, the rule has no SLA data to act upon.

An interface can belong to only one SD-WAN zone at a time. If it is already a member of another zone, it will not appear as available when editing a different zone's member list. Removing it from the other zone first makes it selectable again. This exclusivity is the most likely reason the interface is missing here.

If the rule is set to 'Lowest Latency' but the members are also assigned a priority or manual order that takes precedence, or if the rule's match criteria (e.g., service) do not correctly identify HTTP/HTTPS traffic, the rule will not select the lower-latency member. Additionally, if the rule is not the first matching rule, another rule may be handling the traffic. The most likely cause is a misconfiguration in the rule's match or an overriding strategy.

Maximize Bandwidth (SLA) distributes traffic proportionally across member interfaces according to their configured bandwidth weights, provided SLA targets are met. This directly satisfies the stem's requirement to spread traffic based on bandwidth weights rather than latency or link priority.

IPS performs deep packet payload inspection, which consumes significant CPU cycles per packet, reducing throughput through the IPsec tunnel. Switching to flow-based inspection and enabling hardware offloading where the platform supports it shifts that processing load, restoring tunnel performance while retaining IPS coverage.

FortiOS 7.x supports SD-WAN on the broad range of current FortiGate physical appliances and virtual machines. There is no separate SD-WAN license or special hardware module required; the feature is part of the standard FortiOS feature set. This makes platform support essentially universal across supported models, which is the accurate prerequisite.

Dynamic Mapping in FortiManager SD-WAN templates allows you to map template interface placeholders to actual device interfaces. This is essential when FortiGates have different interface naming conventions. When the template is installed, FortiManager replaces the placeholders with the mapped interfaces, ensuring the configuration is valid for each device.

If the health check probe is configured to use a source interface that is not the tunnel interface, the probe traffic may be routed outside the tunnel, failing to reach the remote IP. This would cause the health check to mark the tunnel down even though the remote IP is reachable via the tunnel. Specifying the correct source interface (the tunnel interface) is crucial.

To achieve automatic failover, the SD-WAN rule must include both the preferred and backup interfaces. A health check must be associated with the rule to monitor the status of these interfaces. If the preferred interface fails the health check, the rule will use the backup interface. This is the standard configuration for failover in SD-WAN.

Volume strategy balances traffic by byte count, distributing sessions proportionally to each member's configured weight or bandwidth ratio. With Tunnel A at 100 Mbps and Tunnel B at 50 Mbps, FortiOS assigns roughly twice the volume to Tunnel A, satisfying the stem's differing-capacity constraint rather than equalising per-session load.

Peering BGP sessions to loopback or tunnel-specific addresses decouples routing adjacencies from physical interface state, so a single WAN link failure does not tear down the session. This satisfies the requirement for robust dynamic routing across multiple SD-WAN IPsec tunnels.

An interface must belong to an SD-WAN zone before SD-WAN rules can reference it, because rules match on zones rather than raw interfaces. Adding the member to a zone makes it a candidate for rule selection and health checking. Until that assignment is done, the interface is invisible to the SD-WAN rule engine.

The Install Wizard in FortiManager allows you to select multiple FortiGates and install configuration changes, including SD-WAN template updates, in a single operation. This is the most efficient method to push changes to all managed devices at once. It ensures consistency and saves time, directly addressing the requirement to update all devices efficiently.

SD-WAN Templates let FortiManager define SD-WAN settings once and assign them across many managed devices, meeting the constraint of standardising configuration for 50 branch offices without per-device editing. Provisioning templates alone lack the SD-WAN-specific interface, health check and rule objects required.

FortiManager populates its SD-WAN monitor by parsing the FortiGate's local traffic and event logs, so log forwarding to FortiManager must already be configured and active. Without that log stream, the SD-WAN dashboard stays empty, since FortiManager holds no independent telemetry channel for SD-WAN health.

In FortiManager, an SD-WAN health check is a reusable object that can be referenced by multiple SD-WAN templates. When you modify the health check, all templates that reference it automatically inherit the change, ensuring consistent monitoring across managed FortiGates. This centralized approach simplifies management and reduces configuration drift.

In a route-based IPsec VPN, the static route should specify the remote subnet as the destination, 0.0.0.0 as the gateway (since the tunnel interface handles the next-hop), and the tunnel interface as the outgoing interface. This directs traffic for the remote subnet into the tunnel. This is the standard configuration for route-based VPNs in FortiOS.

SD-WAN zones are configured under Network > SD-WAN > SD-WAN Zones in the FortiGate GUI, where members and zone membership are defined. This location is where the zone objects referenced by SD-WAN rules are created and edited.

In FortiManager SD-WAN templates, you must map the template's abstract interfaces (e.g., $wan1, $wan2) to the actual physical interfaces on the FortiGate. If this mapping is not done or is incomplete, the installation will fail with an interface mapping error. This is a common oversight when deploying templates to devices with different interface names.

The Best Quality strategy selects the member with the best performance based on the configured SLA metrics, such as latency, jitter, and packet loss. It evaluates all members and chooses the one with the optimal score, making it ideal for critical applications that require the best available link quality.

SD-WAN rules are evaluated top-down, and the first matching rule wins. A broader earlier rule matching the same source and destination IP addresses captures the traffic before the service-specific HTTPS rule is evaluated, so steering falls back to the default static route member.

The Gateway override sets a static next-hop address for the SD-WAN member, bypassing the gateway learned dynamically from the interface's DHCP or routing table. This satisfies the scenario's requirement to force traffic through a specific upstream device when automatic gateway detection selects an unsuitable path.

If the 50 Mbps tunnel fails to meet the SLA (e.g., latency, jitter, or packet loss thresholds), it will be marked as out-of-SLA and not used for traffic steering. This would cause all traffic to use the 100 Mbps tunnel, which meets the SLA. Checking the health check status of the 50 Mbps tunnel is essential.

The 'Multicast' option in Phase 2 enables the IPsec tunnel to carry multicast and broadcast traffic. This is required for routing protocols like OSPF that use multicast hellos. Without it, the tunnel will drop multicast packets, preventing OSPF adjacencies from forming over the VPN.

SD-WAN zones require interfaces free of existing references, so firewall policy, static route, and DHCP bindings must be detached first. This satisfies the mandatory prerequisite before zone membership can be assigned, since the interface must be unbound from those configurations to be claimed by the zone.

Metadata variables allow the SD-WAN template to reference device-specific values, such as a health check destination. By defining a variable like $health_check_dest and assigning it per device or device group based on region, the administrator can use a single template while customizing the destination for each branch. This is efficient, scalable, and maintains centralized management without creating multiple templates.

A member must meet every configured threshold to be in SLA; exceeding any single threshold marks it out of SLA. With 8% loss against a 5% limit, the member fails, and SD-WAN rules that reference this SLA will not select it while it remains out of SLA. This protects traffic from being placed on a lossy link.