Advanced Networking and SD-WAN practice questions

The static route for Member1 has a higher administrative distance than Member2.

Why it fails: SD-WAN member selection does not rely on static route distance; it uses SD-WAN rules and health-check status.

The SD-WAN rule is configured with 'set fallback' disabled.

Why it fails: There is no 'fallback' setting in SD-WAN rules; fallback is controlled by health-check and route updates.

The priority of Member2 is higher than Member1.

Why it fails: Member1 has higher priority (10 > 5), so it should be preferred when available; this is not the cause.

Increase the priority of Link A to ensure it remains the preferred link.

Why it fails: Increasing priority would not address the performance degradation; it would keep traffic on Link A despite poor quality.

Disable link-quality-measurement to reduce overhead on Link A.

Why it fails: Disabling link-quality-measurement would remove the ability to monitor performance, not improve it.

Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Why it fails: Lowest cost strategy does not consider quality; it would not improve voice quality.

The strategy ensures that all traffic uses the member with the highest bandwidth.

Why it fails: Maximize-bandwidth spreads traffic across all eligible members to utilize total bandwidth, not just the highest bandwidth.

Traffic from a single session can be split across multiple members for better performance.

Why it fails: Session traffic is not split; each session is assigned to a single member.

Traffic is distributed based on session count to keep each link equally utilized.

Why it fails: Maximize-bandwidth uses weight or volume-based load balancing, not session count.

Configure an SD-WAN rule for voice with strategy 'maximize bandwidth' and members MPLS and broadband.

Why it fails: Maximize bandwidth spreads traffic, not failover.

Configure an SD-WAN rule for voice with strategy 'lowest cost' and members MPLS and broadband.

Why it fails: Lowest cost may route voice to broadband if cheaper, not preferred.

Configure an SD-WAN rule for voice with strategy 'manual' and members MPLS and broadband.

Why it fails: Manual strategy requires manual link selection.

The SD-WAN rule is not matching the traffic.

Why it fails: If rule not matching, traffic wouldn't be load-balanced at all.

The SD-WAN members have different bandwidths.

Why it fails: Bandwidth differences affect load but not distribution by hash.

Traffic is using a single destination IP and port.

Why it fails: Source IP hashing ignores destination/port; source IP alone determines.

The route with priority 20 will be used.

Why it fails: Higher priority number is lower preference.

The route with lower distance will be used.

Why it fails: Distance is equal, so not a factor.

Both routes will be used for load balancing.

Why it fails: Equal distance but different priority; only the higher priority route is used.

SD-WAN cannot be applied to routes learned via BGP.

Why it fails: SD-WAN can be applied to any route.

SD-WAN can modify BGP MED values to influence path selection.

Why it fails: SD-WAN does not modify BGP attributes.

SD-WAN rules always follow the BGP best path selection.

Why it fails: SD-WAN rules can override BGP best path.

SD-WAN automatically fails over all sessions to the backup member if the primary member exceeds the SLA threshold.

Why it fails: Incorrect. SD-WAN failover affects only new sessions; existing sessions are not automatically moved unless the session is part of a persistent session or a static route is used.

If multiple SD-WAN rules match, the rule with the highest bandwidth member is used.

Why it fails: Incorrect. SD-WAN rules are evaluated in order; the first matching rule is used, not the one with highest bandwidth.

When the SD-WAN rule action is set to 'lowest cost' and no member meets the SLA, the FortiGate drops the traffic.

Why it fails: Incorrect. With 'lowest cost' and no SLA met, the FortiGate still forwards traffic using the member with the lowest cost, but it logs a warning.

User authentication, then basic configuration, then policies, then debug, then routing

Why it fails: This is incorrect because checking user authentication before verifying basic configuration can lead to wasted effort; if the SSL VPN interface or portal settings are wrong, authentication will fail regardless.

Basic configuration, then policies, then user authentication, then debug, then routing

Why it fails: This is incorrect because policies rely on user authentication; if users are not properly authenticated, the policies will not match, so authentication must be verified before policies.

Basic configuration, then user authentication, then debug, then policies, then routing

Why it fails: This is incorrect because enabling debug before policies are confirmed to be correct can generate excessive log data; it is more efficient to verify policies first to ensure traffic is permitted.

IKE: A set of parameters defining how IPsec processes traffic between peers.

Why it fails: Incorrect — this definition describes an IPsec SA, not IKE.

IPsec SA: Protocol used to establish security associations and authenticate peers.

Why it fails: Incorrect — this definition describes IKE, not an IPsec SA.

Physical interface: A logical interface that combines multiple physical interfaces

Why it fails: Incorrect. This definition describes an aggregate interface, not a physical interface.

VLAN interface: A virtual interface that is always up

Why it fails: Incorrect. This definition describes a loopback interface; VLAN interfaces require a parent interface and may go down if the parent link fails.

Create a route map to prefer wan1 and apply it to the SD-WAN rule.

Why it fails: Route maps are for routing policy, not for SD-WAN failover based on SLA metrics.

Set the SD-WAN rule strategy to 'Best Quality' and select latency as the metric.

Why it fails: Best Quality strategy would automatically select the best member based on SLA metrics, but the engineer wants a manual preference with SLA-based failover.

Enable BFD on wan1 and wan2 with a minimum interval of 50 ms.

Why it fails: BFD detects link failures but does not measure latency; it is used for fast convergence, not for SLA-based failover.

Sessions

Why it fails: Sessions algorithm distributes sessions evenly, but does not guarantee source IP stickiness.

Volume

Why it fails: Volume algorithm balances based on actual traffic volume, not session persistence.

Spillover

Why it fails: Spillover sends traffic to a secondary link when the primary exceeds a threshold.

Configure route redistribution from BGP to OSPF.

Why it fails: Redistribution does not affect forwarding decisions based on route existence.

Enable ECMP load balancing.

Why it fails: ECMP is for load balancing among equal-cost routes, not for conditional routing.

Create a static default route with a higher administrative distance.

Why it fails: That would only affect default route selection, not override for specific destinations.

The SLA server is blocking ICMP echo requests.

Why it fails: The probe uses TCP, not ICMP.

The performance SLA is configured with the wrong threshold.

Why it fails: Thresholds affect status but not the probe failure itself.

The firewall policy allowing the probe traffic is missing.

Why it fails: If the interface is up and ping works, the policy likely allows traffic; the issue is the probe type.

Policy-based routing

Why it fails: PBR can steer traffic but not maintain separate routing tables.

Virtual IP (VIP)

Why it fails: VIP is for NAT destination mapping, not routing segmentation.

Multiple VDOMs

Why it fails: VDOMs would also work but are more resource-intensive and require separate management.

Set the load balancing algorithm to 'Spillover' on all rules.

Why it fails: Spillover would not load balance based on bandwidth and does not allow manual steering.

Enable ECMP on the FortiGate.

Why it fails: ECMP is for equal-cost routes, not SD-WAN load balancing.

Configure a performance SLA for each link.

Why it fails: Performance SLAs are for monitoring link quality, not for bandwidth-based load balancing.

BFD is enabled on MPLS but not on LTE.

Why it fails: BFD does not affect SLA-based selection.

The route to the datacenter is learned via OSPF with a lower cost over LTE.

Why it fails: SD-WAN rules override routing table decisions; the cost of OSPF routes does not affect SD-WAN member selection.

The latency threshold is set too low for MPLS.

Why it fails: If the threshold is too low, SLA might show dead, but it shows 'alive', so threshold is fine.

The FortiGate must operate in transparent mode.

Why it fails: Transparent mode is not supported; NAT mode is required.

The FortiGate must have a separate VDOM for each managed device.

Why it fails: A single VDOM can manage multiple devices.

get router info bfd

Why it fails: This is a valid command but the correct syntax is often 'get router info bfd session' or 'diagnose sys bfd session list'.

show bfd sessions

Why it fails: This is not a standard FortiGate command.

execute bfd show

Why it fails: This is not a valid FortiGate command.