How to Configure FortiExtender as an SD-WAN Member on FortiGate
An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?
Quick Answer
The correct answer is to enable the 'fortiextender' option on port5 and then configure the FortiExtender as an SD-WAN member using the virtual wan interface. This is required because the FortiExtender acts as a physical extension of the FortiGate’s WAN capabilities, and the port it connects to must be explicitly set to recognize the attached cellular modem as a valid WAN link. By enabling the fortiextender option, the FortiGate treats the connected device as a logical SD-WAN member, allowing traffic policies and load-balancing rules to apply to the cellular connection just like any physical WAN interface. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how SD-WAN integrates with external modem devices, often appearing in questions about hybrid WAN deployments. A common trap is forgetting that the physical port itself must be configured with the fortiextender flag before the virtual wan interface can reference it. Memory tip: think of it as “flag the port, then link the member”—the port must first be told it’s hosting an extender before the SD-WAN can use it.
⚠ Common exam trap
Test-takers frequently assume the FortiExtender must be configured as a separate router or that SIM details must be entered on the FortiGate, when in fact the FortiGate only needs to enable the 'fortiextender' option to treat the FortiExtender as a logical SD-WAN member.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.
To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a static route to the FortiExtender's management IP to use it as a gateway.
Why it's wrong here
A static route to the management IP cannot carry user traffic, since the FortiExtender's cellular interface must be added as an SD-WAN member with its own gateway. Static routing tempts when the extender is treated as a next-hop router, which applies to routed deployments rather than integrated SD-WAN membership.
- ✗
Configure port5 as a physical member and assign the FortiExtender's SIM card details.
Why it's wrong here
SIM details are configured on the FortiExtender itself, not on the FortiGate, so entering them there does not create an SD-WAN member. The temptation arises because cellular parameters are essential to the link, yet the FortiGate needs port5 registered as an interface member instead.
- ✓
Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.
Why this is correct
Enabling the fortiextender option on port5 lets the FortiGate discover and manage the device, while the virtual wan interface represents the cellular link so it can join the SD-WAN. Both are required for WAN connectivity.
- ✗
Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.
Why it's wrong here
Standalone router mode with policy-based routing bypasses FortiGate SD-WAN orchestration, so the cellular link cannot participate as a member with health checks and SLA rules. It tempts when the extender is deployed independently, which suits branch routing but not integrated SD-WAN membership on port5.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to integrate a FortiExtender with a FortiGate to provide WAN connectivity. Which interface type is used on the FortiGate to connect to the FortiExtender?
easy- ✓ A.wan
- B.lan
- C.dmz
- D.loopback
Why A: The FortiGate uses a dedicated 'wan' interface type to connect to a FortiExtender, as this interface is specifically designed to manage the cellular or broadband WAN link provided by the extender. The FortiExtender appears as a WAN-facing device, and the 'wan' interface type allows the FortiGate to apply SD-WAN rules, load balancing, and failover policies directly to that connection.
Variation 2. An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?
medium- ✓ A.The APN settings are not configured under the FortiExtender interface
- B.The FortiGate needs a security policy allowing traffic from wwan1
- C.The FortiExtender firmware is not compatible with the FortiGate
- D.The FortiExtender is not powered on
Why A: The link status of the wwan1 interface remains 'down' because the FortiExtender requires the Access Point Name (APN) to be configured to establish a cellular data connection. Without the correct APN, the modem cannot attach to the mobile network, even with an active SIM card and power. The APN is configured under the FortiExtender interface settings on the FortiGate, not on the FortiExtender itself.
Variation 3. An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?
medium- A.Disable all other WAN interfaces
- ✓ B.Authorize the FortiExtender on the FortiGate
- C.Enable NAT on the FortiExtender interface
- D.Configure a separate VDOM for the FortiExtender
- ✓ E.Configure the FortiExtender as an SD-WAN member
Why B: The FortiExtender must first be authorized on the FortiGate to establish a secure management and data plane connection. Once authorized, it must be added as an SD-WAN member interface so that SD-WAN rules and load-balancing algorithms can be applied to traffic traversing the FortiExtender's cellular or LTE link.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.