CCNA Central Management Questions

Editing an applied SD-WAN template marks the FortiGate's configuration status as 'Modified', because the change is staged centrally rather than pushed immediately. An installation task must then run to commit the updated template settings to the device, satisfying the requirement that changes are not auto-applied.

Shared Objects in FortiManager are stored centrally and referenced by multiple templates, so a single definition propagates everywhere it is used. This satisfies the reuse requirement, avoiding duplicated configuration across SD-WAN templates and simplifying later updates.

The Device Manager tab supports selecting multiple managed FortiGates and assigning a single SD-WAN template to them in one operation, satisfying the stem's simultaneity requirement. Provisioning then pushes the shared configuration to each selected device.

When a new SD-WAN zone is added to a template, it is created on the FortiGate, but no interfaces are automatically assigned to it. The administrator must assign member interfaces to the new zone either through the template or manually. The performance SLA will also be created and can be referenced by rules.

Dynamic mapping in SD-WAN templates allows the template to reference variables such as $wan_ip, which are resolved per device during installation. This enables a single template to be used across all 80 devices while accommodating their unique WAN IP addresses. The health check settings are applied consistently, and the variables ensure the correct IP is used on each device.

SD-WAN rules specify the criteria for selecting an outgoing interface, such as best quality, lowest cost, or specific SLA targets. These rules must be configured to use the performance SLA results. Together with performance SLAs, they enable dynamic path selection.

When you modify a health check object, FortiManager updates the reference in all SD-WAN templates that use it. However, the managed FortiGates do not receive the update until an install operation is performed. This two-step process ensures that changes are reviewed and applied deliberately, preventing unintended configuration changes on production devices.

In FortiManager, you can create shared objects, such as health checks, that can be referenced by multiple SD-WAN templates. This ensures consistency and simplifies management. When the shared health check is updated, all templates referencing it inherit the change. This is the most efficient method to apply the same health check across all templates.

Ping is a supported health check protocol in FortiManager SD-WAN templates. It sends ICMP echo requests to a specified server to measure latency, jitter, and packet loss. This is a common method for basic reachability and performance monitoring, and it is configurable within the SD-WAN template's health check settings.

The SD-WAN Health Check object in FortiManager is used to define performance SLA probes, including ICMP, HTTP, and others. By configuring an ICMP health check, the administrator can monitor latency, jitter, and packet loss on the primary WAN link. This object is then referenced in SD-WAN rules to influence member selection.

Performance SLA defines the probe thresholds—latency, jitter, and packet loss—that FortiGate SD-WAN uses to grade each member link's quality. Members breaching those thresholds are marked dead or degraded, so the rule's path-selection strategy only steers traffic across links satisfying the configured criteria.

The SD-WAN template defines the member interfaces. To add a new VLAN interface, the template must be updated and then the configuration reinstalled to the FortiGate. This ensures the change is tracked in FortiManager and applied consistently, maintaining the template as the source of truth for SD-WAN settings.

Best Quality strategy selects the link with the best performance according to the SLA (e.g., lowest latency, jitter, packet loss). If the current link fails the SLA, the rule will automatically switch to the next best link that meets the SLA. This ensures traffic is always routed over a link that satisfies the SLA requirements, which is exactly what the administrator wants.

SD-WAN health checks are shared objects that define the monitoring parameters for performance SLAs, such as protocol, server, and thresholds. Referencing them in the SD-WAN template provides the necessary details for latency and packet loss monitoring. This is the correct object to use for defining health checks within a template.

The install wizard's Preview shows the configuration that FortiManager will push to the selected FortiGate, including SD-WAN template-derived members, zones, and performance SLA objects. Preview does not modify the device, so the administrator can confirm the resolved configuration before committing the install. This is the supported way to inspect template output per device prior to a production change.

fmg_debug.log captures FortiManager daemon debugging, including the specific CLI commands pushed to the FortiGate and the exact command that fails. It satisfies the stem's requirement to identify the failing CLI command during SD-WAN template troubleshooting.

An SD-WAN Health Check Template in FortiManager defines health check parameters that can be referenced by multiple SD-WAN templates. When the health check template is updated, all SD-WAN templates referencing it automatically inherit the changes, and upon installation, the managed FortiGates receive the updated configuration. This ensures consistency and centralized management of health checks across all devices.

Source and destination address are both valid SD-WAN rule match criteria, letting you steer traffic by subnet or host pair. This satisfies the stem's requirement for two selectable criteria, since FortiGate SD-WAN rules support source and destination as matching fields alongside application and service.

SD-WAN templates in FortiManager support metadata variables that can be assigned per device, allowing interface names to be dynamically substituted during provisioning. This enables a single template to adapt to different interface naming conventions across branches, eliminating manual edits and ensuring consistency. The template defines the SD-WAN structure, and variables map device-specific values, which is exactly what the administrator needs for heterogeneous environments.

The installation preview shows the exact CLI commands that FortiManager will send to the FortiGate. By reviewing it, the administrator can identify syntax errors, missing objects, or conflicts with existing configuration. This is a primary troubleshooting step for failed installs.

Dynamic Mapping lets one template object resolve to differing physical interfaces or settings per device, so a single SD-WAN template deploys across heterogeneous hardware without duplication. This satisfies the stem's deployment constraint: device-specific values are bound at push time rather than hard-coded, keeping the template portable.

SD-WAN traffic steering requires member interfaces to be defined in the template, since these are the physical or overlay links across which rules direct traffic. Without members, no eligible paths exist for steering decisions, so the template cannot enforce the required forwarding behaviour.

SD-WAN templates are FortiManager-managed objects, so the manager must push the revised template to the FortiGate for it to take effect. This satisfies the stem's requirement for changes requiring a manager-initiated push rather than local device configuration.

The SD-WAN Monitor in FortiManager reports the operational state of each SD-WAN member interface, showing whether individual links are up or down. This satisfies the stem's requirement for member status, one of the three displayed items, alongside SLA performance and traffic steering information.

If the SD-WAN template installation failed or was not performed on that specific FortiGate, the device would keep its previous SD-WAN configuration, including rule order. This can happen if the device was offline during installation or if it was not included in the installation target. The result is a mismatch compared to other devices.

After modifying an SD-WAN template in FortiManager, the changes are not automatically pushed to managed devices. The administrator must initiate an installation of the template to the affected FortiGates. This process updates the devices with the new SLA probe interval while preserving other configuration. Installation can be done per device or in bulk, and it ensures the change is applied consistently across all 30 devices.

FortiManager SD-WAN templates support metadata variables, which allow administrators to use placeholders like $hostname or $wan_ip that are resolved per device during installation. This enables a single template to be used across devices with different settings, such as WAN IP addresses or interface names. This feature is essential for scalability and reducing manual configuration.

FortiManager requires an explicit install action to push configuration changes to a managed FortiGate. Even if the device is offline during the template modification, the changes are not applied until a subsequent install operation is performed. The FortiGate will continue using its last installed configuration until then.

After modifying an SD-WAN template, the administrator must install the policy package to the managed FortiGates that use the template. FortiManager allows selecting multiple devices for installation, which pushes the updated configuration to all of them simultaneously. This ensures the new SD-WAN member is applied consistently across all devices.

Modifying the SD-WAN template in FortiManager and re-applying it will propagate the changes to all managed devices that use the template. FortiManager tracks which devices are assigned to the template and can update them automatically, ensuring consistency. This is the most efficient method for bulk updates.

SD-WAN templates in FortiManager define policy centrally, then push it to managed devices. This guarantees every device receives identical SD-WAN rules, eliminating per-device drift and satisfying the requirement for consistent policy application across the estate.

This is a shared object in FortiManager that defines health check parameters such as protocol, server, and interval. When referenced in an SD-WAN template, it ensures consistent health check settings across all managed devices. This directly meets the requirement of standardizing health check settings for a specific SLA target without redefining them per device.

Packet loss threshold directly feeds the Performance SLA calculations: SD-WAN templates compare measured loss against this configured threshold to decide whether a member link breaches the SLA and should be removed from the active path.

The SD-WAN Template object in FortiManager is specifically designed to define and manage SD-WAN configurations centrally. It allows administrators to create a template that can be applied to multiple FortiGates, and any changes to the template are automatically propagated to the devices. This meets the requirement of easy future modifications without manual updates per device.

SD-WAN rules are evaluated in a top-down sequence.

An SD-WAN Template in FortiManager defines the SD-WAN configuration, including member interfaces, health checks, and rules. It allows administrators to specify logical interface names that are then mapped to physical interfaces on the target device during installation. This template-based approach ensures consistent configuration across multiple devices and simplifies the deployment of SD-WAN.

Modifying the SD-WAN template is the correct first step because the template serves as the centralized definition for SD-WAN rules across all managed devices. By adding the new application category to the template's rules, the administrator ensures that the change is standardized and can be propagated to all branches. This approach minimizes effort and maintains consistency, as the template is the single source of truth for SD-WAN configuration.

The Install Wizard in FortiManager allows you to push configuration changes, including SD-WAN template updates, to multiple managed FortiGates at once. After modifying the template, you must run the Install Wizard and select the devices or groups to update. This ensures the new health check settings are deployed consistently across all branches, maintaining uniform SD-WAN behavior.

A Centralized Policy in FortiManager pushes one consistent rule set to every managed FortiGate, so security and traffic routing stay uniform across the large SD-WAN deployment. Local policies would require per-device configuration and risk drift between sites.

Shared objects are referenced, not copied, so editing the health check changes the definition used by every template referencing it. FortiGates inherit the updated object only when the policy package is installed, which is why the effect appears after an install rather than immediately.

After modifying a health check object, the changes are only in FortiManager's database. The managed FortiGates will not reflect the new IP until an install operation is performed. If some FortiGates still show the old IP, it means the updated configuration has not been installed on those devices, possibly because they were offline or not included in the last install.

Dynamic Mapping in FortiManager SD-WAN templates allows you to map template interface placeholders to actual device interfaces. This is essential when FortiGates have different interface naming conventions. When the template is installed, FortiManager replaces the placeholders with the mapped interfaces, ensuring the configuration is valid for each device.

The Install Wizard in FortiManager allows you to select multiple FortiGates and install configuration changes, including SD-WAN template updates, in a single operation. This is the most efficient method to push changes to all managed devices at once. It ensures consistency and saves time, directly addressing the requirement to update all devices efficiently.

SD-WAN Templates let FortiManager define SD-WAN settings once and assign them across many managed devices, meeting the constraint of standardising configuration for 50 branch offices without per-device editing. Provisioning templates alone lack the SD-WAN-specific interface, health check and rule objects required.

FortiManager populates its SD-WAN monitor by parsing the FortiGate's local traffic and event logs, so log forwarding to FortiManager must already be configured and active. Without that log stream, the SD-WAN dashboard stays empty, since FortiManager holds no independent telemetry channel for SD-WAN health.

In FortiManager, an SD-WAN health check is a reusable object that can be referenced by multiple SD-WAN templates. When you modify the health check, all templates that reference it automatically inherit the change, ensuring consistent monitoring across managed FortiGates. This centralized approach simplifies management and reduces configuration drift.

In FortiManager SD-WAN templates, you must map the template's abstract interfaces (e.g., $wan1, $wan2) to the actual physical interfaces on the FortiGate. If this mapping is not done or is incomplete, the installation will fail with an interface mapping error. This is a common oversight when deploying templates to devices with different interface names.

Metadata variables allow the SD-WAN template to reference device-specific values, such as a health check destination. By defining a variable like $health_check_dest and assigning it per device or device group based on region, the administrator can use a single template while customizing the destination for each branch. This is efficient, scalable, and maintains centralized management without creating multiple templates.

For an SD-WAN rule to use an overlay interface, that interface must be a member of the SD-WAN zone. If the interface was added to the template but not properly mapped or included in the zone on the FortiGate, the rule will not match or forward traffic correctly. This is a common configuration oversight.

Performance SLA is the correct element for defining health checks that monitor link quality. It supports various protocols including HTTP, and allows you to specify a URL as the target. The SLA sends probes and measures latency, jitter, and packet loss, providing the data needed for SD-WAN routing decisions. This directly fulfills the requirement of monitoring an internet link with HTTP requests.

The 'lowest latency' strategy in an SD-WAN rule selects the member with the lowest measured latency among those that satisfy the SLA. By referencing the latency SLA, the rule ensures that only members meeting the SLA are considered, and among them, the one with the lowest latency is chosen. This directly fulfills the requirement.

FortiManager maintains a revision history for each managed device. When the Install Wizard successfully installs an SD-WAN template, it records the change as a new revision. This enables administrators to view previous configurations and roll back to an earlier revision if issues arise, which is essential for maintaining stability in large deployments.

The SD-WAN template in FortiManager includes a 'Performance SLA' section where health check servers are defined. By configuring the server IP address here, the administrator ensures that all devices using this template will have the same health check server, achieving consistency across the managed FortiGates.

Dynamic mapping in FortiManager allows administrators to assign templates or template variables based on device attributes such as tags. By using dynamic mapping, the SD-WAN rule can be conditionally applied only to devices that match the specified tag. This provides granular control over which devices receive which configuration.

FortiManager pushes configuration to managed FortiGates and reports the outcome per device; the Device Manager installation status column shows whether the change was installed successfully or failed. This directly confirms the policy package was applied, satisfying the need to verify the SD-WAN change took effect.

The Performance SLA in an SD-WAN template defines the thresholds for latency, jitter, and packet loss that determine link quality. When a link's health check results exceed these thresholds, the link is considered out of SLA, and SD-WAN rules can then route traffic to an alternate link. This is exactly what the engineer needs to trigger failover based on performance degradation. The SLA is referenced by SD-WAN rules to make routing decisions.

An SD-WAN Health Check object defines the probe type, target, interval and failure thresholds used to judge link quality. It must exist in the template before a service rule can reference it, since the rule binds to that object's SLA criteria.

SD-WAN template changes are propagated to managed FortiGates through a policy package installation. Once the template is modified and saved in FortiManager, the administrator must install the associated policy package to the device for the changes to take effect. This is the standard workflow for deploying template modifications in FortiManager.

In FortiManager, SD-WAN templates are created and managed under Policy & Objects > SD-WAN Templates. This centralized location allows administrators to define reusable templates that include SD-WAN interfaces, health checks, and rules. From here, templates can be assigned to policy packages for deployment to managed FortiGates.

CLI scripts execute arbitrary FortiOS commands on managed devices via FortiManager, letting administrators modify SD-WAN policy objects and rules across all devices in one push. This satisfies the requirement to update policies fleet-wide without manually editing each device.

The Install Wizard in FortiManager allows you to select multiple managed FortiGates and install configuration changes, including updated SD-WAN templates. After modifying the health check, the administrator can run the Install Wizard, select all affected devices, and push the changes in one operation, ensuring consistency and saving time.

SD-WAN zones are used to group member interfaces in an SD-WAN configuration. They simplify policy and routing by allowing rules to reference the zone instead of individual interfaces. In FortiManager, when creating an SD-WAN template, the administrator defines zones and assigns interfaces to them, which is the correct way to group members.

An SD-WAN Zone groups interfaces and overlay members sharing identical routing and policy treatment, letting administrators apply one rule set across them. This satisfies central management's need to route traffic by logical segment rather than per-link, so FortiGate policies reference the zone and members inherit consistent steering without duplicated configuration.

SD-WAN member interfaces must exist before they can be referenced within a template. The template binds these individual interfaces into the SD-WAN zone and defines their participation, so the member interfaces are the prerequisite object that must be defined first.

SD-WAN templates permit physical ports, VLAN interfaces and VPN tunnels as members, letting overlays and underlays share the same SD-WAN fabric. Loopback and management-only interfaces are excluded, so this option matches the supported membership set.

Central management pushes one SD-WAN template to many FortiGates, so inheritance propagates configuration and policy changes consistently. This removes per-device drift and manual repetition, which is the scalability constraint the stem contrasts against local configuration.

Dynamic interface mapping allows the use of metadata variables for interface names, enabling a single template to be applied to devices with different interface naming conventions. This is the correct feature for reusability across heterogeneous devices, as it resolves the variables based on each device's metadata during installation.

FortiManager allows per-device overrides or metadata variables that can replace template values. If a device has a specific health check server defined via metadata or a local override, it will use that instead of the template's value. This is the most likely cause for the discrepancy, as it explains why the expected server is not used despite the template being correct.

SD-WAN rules define how traffic is steered based on criteria such as source, destination, and application. They also specify the action when a health check fails, such as selecting an alternate member or using a specific strategy. The rule references the Performance SLA to determine link health and then applies the configured action to redirect traffic.

In FortiManager, SD-WAN health checks are used to define performance SLA probes. You can specify the protocol (HTTP, ICMP, DNS, etc.), target, and other parameters. This is the correct object to configure HTTP probe settings for monitoring WAN link quality within an SD-WAN template.

Latency, jitter and packet loss are precisely the metrics FortiManager's SD-WAN Monitor reports under Health Check status, satisfying the stem's requirement for performance data per monitored SLA target. These three values drive FortiGate's SLA calculations, so displaying them confirms whether each health-check probe currently meets its configured thresholds.

When an SD-WAN template is assigned to a managed FortiGate and the policy package is installed, the template's configuration replaces the device's local SD-WAN settings. FortiManager provisions the device with the template content, so any pre-existing local SD-WAN configuration is discarded. This ensures consistency but requires that the template be complete before installation.

FortiManager validates the template against the target device's interface list before pushing. A referenced interface absent on that FortiGate causes the install to abort with a configuration error, rather than silently skipping the reference or applying a partial config.

Installing the configuration pushes the prepared SD-WAN policy and settings from FortiManager down to the managed FortiGate devices. Without this install step, the centralised configuration never reaches the devices, so the SD-WAN deployment cannot take effect on the network.

In FortiManager, the SD-WAN Performance SLA object defines health check parameters, including the protocol (such as HTTP), server address, interval, and thresholds. This object must be created first, then referenced in the SD-WAN template. It is the correct object type for defining an HTTP health check that can be reused across multiple templates.