NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate has two WAN links and uses ECMP load balancing for default routes. The administrator wants to ensure that all packets belonging to the same TCP session go out the same interface. Which setting should be enabled?
⚠ Common exam trap
Watch out — candidates often confuse 'source-ip hash' or 'source-destination-ip hash' with session-based stickiness, but FortiOS requires the 'session-based' algorithm to include Layer 4 port information in the hash, which is the only way to guarantee per-session path consistency in ECMP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ECMP with 'session-based' algorithm
The 'session-based' algorithm (also known as 'source-ip-based' or 'ECMP with session-based' in FortiOS) ensures that all packets belonging to the same TCP session are forwarded out the same interface by hashing the 5-tuple (source IP, destination IP, source port, destination port, protocol). This guarantees session stickiness across ECMP paths, preventing out-of-order delivery and TCP retransmissions. Option D is correct because it directly addresses the requirement for per-session interface consistency.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Persistent NAT
Why it's wrong here
Persistent NAT is for source NAT stickiness, not for routing symmetry.
- ✗
ECMP source-destination-ip hash
Why it's wrong here
Source-destination-ip hash uses IP addresses, not TCP session, so different ports may cause different paths.
- ✗
ECMP with source-ip hash
Why it's wrong here
Source-ip hash uses only source IP, but still does not guarantee per-session stickiness if multiple sessions from same source IP with different dest IPs.
- ✓
ECMP with 'session-based' algorithm
Why this is correct
Session-based ECMP uses a hash of the 5-tuple (src IP, dst IP, protocol, src port, dst port) to ensure all packets of a session use the same interface.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.