SD-WAN Source-Destination IP Hash
An administrator wants to load balance traffic across two ISP links using SD-WAN. The requirement is that sessions from the same source IP address must always use the same ISP link. Which SD-WAN load balancing algorithm should be used?
Quick Answer
The answer is source-destination IP hash. This SD-WAN load balancing algorithm is correct because it computes a hash based on both the source and destination IP addresses of each session, ensuring that all traffic sharing the same source-destination IP pair is consistently mapped to the same ISP link. Unlike round-robin or simple source IP hashing, this method preserves session persistence for bidirectional flows, which is critical when an administrator requires that sessions from the same source IP address always use the same link, as stated in the requirement. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of how SD-WAN rules and load balancing algorithms interact with session stickiness—a common trap is confusing source IP hash (which only considers the source) with source-destination IP hash. Remember the mnemonic “Pair to Path”: the source-destination pair locks the path, ensuring consistent link selection for every session between those two hosts.
⚠ Common exam trap
Many candidates confuse 'source IP persistence' with 'session-based load balancing' and select 'Sessions' (Option B), not realizing that Sessions algorithm distributes individual sessions arbitrarily and does not guarantee that all sessions from the same source IP use the same link.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Source-destination IP
The Source-destination IP algorithm creates a hash based on both the source and destination IP addresses, ensuring that all packets belonging to sessions from the same source IP to the same destination IP are consistently forwarded over the same ISP link. This meets the requirement of session persistence for traffic from a given source IP without relying on stateful inspection or session tracking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Source-destination IP
Why this is correct
This algorithm hashes source and destination IP to consistently select the same member for flows between the same two hosts.
- ✗
Sessions
Why it's wrong here
Sessions algorithm distributes sessions evenly, but does not guarantee source IP stickiness.
- ✗
Volume
Why it's wrong here
Volume algorithm balances based on actual traffic volume, not session persistence.
- ✗
Spillover
Why it's wrong here
Spillover sends traffic to a secondary link when the primary exceeds a threshold.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with ECMP routing to balance traffic across two default routes via two ISPs. The administrator wants to ensure that traffic from the same source-destination pair always uses the same ISP. Which ECMP load balancing method should be configured?
easy- ✓ A.source-dest-ip
- B.source-ip
- C.per-packet
- D.session
Why A: The source-dest-ip method hashes the source and destination IP addresses to compute a consistent path for all packets in a given flow. This ensures that traffic from the same source-destination pair always uses the same ISP, meeting the requirement for flow-based persistence without per-packet load balancing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.