How to Configure FortiExtender as an SD-WAN Member on FortiGate
An administrator is integrating a FortiExtender with a FortiGate. The FortiExtender is connected to port5 and configured with a cellular WAN connection. What must be configured on the FortiGate to allow the FortiExtender to provide WAN connectivity as an SD-WAN member?
Quick Answer
The correct answer is to enable the 'fortiextender' option on port5 and then configure the FortiExtender as an SD-WAN member using the virtual wan interface. This is required because the FortiExtender acts as a physical extension of the FortiGate’s WAN capabilities, and the port it connects to must be explicitly set to recognize the attached cellular modem as a valid WAN link. By enabling the fortiextender option, the FortiGate treats the connected device as a logical SD-WAN member, allowing traffic policies and load-balancing rules to apply to the cellular connection just like any physical WAN interface. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how SD-WAN integrates with external modem devices, often appearing in questions about hybrid WAN deployments. A common trap is forgetting that the physical port itself must be configured with the fortiextender flag before the virtual wan interface can reference it. Memory tip: think of it as “flag the port, then link the member”—the port must first be told it’s hosting an extender before the SD-WAN can use it.
⚠ Common exam trap
Test-takers frequently assume the FortiExtender must be configured as a separate router or that SIM details must be entered on the FortiGate, when in fact the FortiGate only needs to enable the 'fortiextender' option to treat the FortiExtender as a logical SD-WAN member.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.
To integrate a FortiExtender as an SD-WAN member, the FortiGate must enable the 'fortiextender' option on the physical port (port5) to which the FortiExtender is connected. This creates a virtual wan interface that represents the FortiExtender's cellular WAN connection, allowing it to be added as an SD-WAN member for load balancing and failover policies. No static route or SIM card configuration is needed on the FortiGate, as the FortiExtender handles cellular authentication and routing internally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a static route to the FortiExtender's management IP to use it as a gateway.
Why it's wrong here
The FortiExtender acts as a modem, not a gateway; it is managed by FortiGate and needs to be configured as an SD-WAN member.
- ✗
Configure port5 as a physical member and assign the FortiExtender's SIM card details.
Why it's wrong here
The FortiExtender is managed via a dedicated interface (wan or lte) not as a physical port member.
- ✓
Enable the 'fortiextender' option on port5 and configure the FortiExtender as an SD-WAN member using the virtual wan interface.
Why this is correct
The FortiExtender creates a virtual interface (e.g., wan or lte) that can be added as an SD-WAN member. Port5 must have the FortiExtender feature enabled.
- ✗
Use the FortiExtender as a standalone router and configure policy-based routing on the FortiGate.
Why it's wrong here
The integration requires the FortiExtender to be managed by the FortiGate, not as a separate router.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to integrate a FortiExtender with a FortiGate to provide WAN connectivity. Which interface type is used on the FortiGate to connect to the FortiExtender?
easy- ✓ A.wan
- B.lan
- C.dmz
- D.loopback
Why A: The FortiGate uses a dedicated 'wan' interface type to connect to a FortiExtender, as this interface is specifically designed to manage the cellular or broadband WAN link provided by the extender. The FortiExtender appears as a WAN-facing device, and the 'wan' interface type allows the FortiGate to apply SD-WAN rules, load balancing, and failover policies directly to that connection.
Variation 2. An administrator connects a FortiExtender to the FortiGate's USB port. The FortiGate detects the FortiExtender and creates a virtual interface 'wwan1'. However, the link status shows 'down'. The SIM card is inserted and the cellular plan is active. What should the administrator check?
medium- ✓ A.The APN settings are not configured under the FortiExtender interface
- B.The FortiGate needs a security policy allowing traffic from wwan1
- C.The FortiExtender firmware is not compatible with the FortiGate
- D.The FortiExtender is not powered on
Why A: The link status of the wwan1 interface remains 'down' because the FortiExtender requires the Access Point Name (APN) to be configured to establish a cellular data connection. Without the correct APN, the modem cannot attach to the mobile network, even with an active SIM card and power. The APN is configured under the FortiExtender interface settings on the FortiGate, not on the FortiExtender itself.
Variation 3. An administrator wants to integrate a FortiExtender into an existing SD-WAN deployment. Which TWO steps are required for proper integration?
medium- A.Disable all other WAN interfaces
- ✓ B.Authorize the FortiExtender on the FortiGate
- C.Enable NAT on the FortiExtender interface
- D.Configure a separate VDOM for the FortiExtender
- ✓ E.Configure the FortiExtender as an SD-WAN member
Why B: The FortiExtender must first be authorized on the FortiGate to establish a secure management and data plane connection. Once authorized, it must be added as an SD-WAN member interface so that SD-WAN rules and load-balancing algorithms can be applied to traffic traversing the FortiExtender's cellular or LTE link.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.