Why SD-WAN Failback Fails After Link Restoration
A FortiGate is configured with SD-WAN and has two WAN members: Member1 (ISP1) with priority 10, and Member2 (ISP2) with priority 5. The SD-WAN rule for traffic from the internal network uses the 'best quality' strategy. During normal operation, traffic flows through Member1. After a link failure on Member1, traffic correctly fails over to Member2. However, when Member1 is restored, traffic does not fail back. What is the most likely cause?
Quick Answer
The answer is a health-check configuration using 'set probe-mode passive' combined with 'set update-static-route disable'. This is the most likely cause because passive probe mode means the FortiGate only monitors the link without actively sending probe traffic, so it never detects the restored link as healthy enough to trigger failback. Additionally, disabling static route updates prevents the route for Member1 from being re-enabled after the link comes back, leaving it inactive in the routing table even though the physical interface is up. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of how SD-WAN failback behavior depends on both active probing and route re-activation, not just link status. A common trap is assuming failback happens automatically when the link is restored, but without active probes and route updates, the SD-WAN rule using 'best quality' strategy will never see Member1 as a viable candidate. Memory tip: "Passive probes, passive routes—no failback, no doubt."
⚠ Common exam trap
Watch out — candidates often assume failback is automatic with SD-WAN, but FortiGate requires explicit configuration of route updates or probe modes to re-enable a restored link; the 'best quality' strategy alone does not handle failback without proper health-check settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.
When 'set probe-mode passive' is configured, the health-check server only monitors the link without actively generating probe traffic, and 'set update-static-route disable' prevents the static route associated with Member1 from being re-enabled after the link is restored. This means the route remains inactive, so SD-WAN cannot fail back to Member1 even though the physical link is up.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The static route for Member1 has a higher administrative distance than Member2.
Why it's wrong here
SD-WAN member selection does not rely on static route distance; it uses SD-WAN rules and health-check status.
- ✓
The health-check for Member1 is configured with 'set probe-mode passive' and 'set update-static-route disable'.
Why this is correct
Passive monitoring does not trigger fallback; update-static-route must be enabled for the route to be reinstated when the link recovers.
- ✗
The SD-WAN rule is configured with 'set fallback' disabled.
Why it's wrong here
There is no 'fallback' setting in SD-WAN rules; fallback is controlled by health-check and route updates.
- ✗
The priority of Member2 is higher than Member1.
Why it's wrong here
Member1 has higher priority (10 > 5), so it should be preferred when available; this is not the cause.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with two WAN members in an SD-WAN zone. The performance SLA monitors latency to a probe server. The rule uses 'best quality' strategy. After some time, one member fails the SLA. Which action does the FortiGate take for existing sessions that were using that member?
hard- A.All sessions are dropped and the member is removed from the zone
- B.Existing sessions are re-evaluated and may be moved based on policy
- C.Existing sessions are immediately moved to another member
- ✓ D.Existing sessions continue on the failed member until they timeout
Why D: When a WAN member fails the performance SLA in an SD-WAN 'best quality' strategy, FortiGate does not disrupt existing sessions that were already using that member. Instead, those sessions continue on the failed member until they naturally timeout or are torn down, because the SD-WAN rule only influences the path selection for new sessions. This behavior is by design to avoid breaking active connections due to transient SLA fluctuations.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.