Advanced Networking and SD-WAN practice questions

SD-WAN cannot be applied to routes learned via BGP.

Why wrong: SD-WAN can be applied to any route.

SD-WAN can modify BGP MED values to influence path selection.

Why wrong: SD-WAN does not modify BGP attributes.

SD-WAN rules always follow the BGP best path selection.

Why wrong: SD-WAN rules can override BGP best path.

Volume

Why wrong: Volume algorithm distributes traffic based on the volume of data, not cost. It is used to balance traffic load across members rather than selecting the lowest cost path.

Sessions

Why wrong: Sessions algorithm distributes new sessions across SD-WAN members based on session count, not cost. It aims to balance the number of concurrent sessions.

Source-dest-IP

Why wrong: Source-dest-IP algorithm uses a hash of source and destination IP addresses to deterministically map traffic to an SD-WAN member. It does not consider cost metrics.

A dedicated VDOM

Why wrong: Incorrect. VRF does not require a separate VDOM; it can exist within a single VDOM.

Route leaking configuration

Why wrong: Incorrect. Route leaking is optional for inter-VRF communication, not a basic component of each VRF.

A separate firewall policy for each VRF

Why wrong: Incorrect. Firewall policies are not a routing component; they are applied separately and are not required for VRF configuration.

The OSPF network type is not broadcast

Why wrong: Incorrect. The OSPF network type affects neighbor adjacencies but does not directly prevent redistribution of external routes between areas.

The ABR is not configured with 'area 0'

Why wrong: Incorrect. The ABR must be configured with both areas (including Area 0) to perform inter-area routing; missing 'area 0' would prevent it from being an ABR, but the scenario implies a multi-area setup where the ABR is correctly configured.

The 'redistribute connected' command is missing under the OSPF process

Why wrong: Incorrect. The scenario explicitly states that the 'redistribute connected' command is included under OSPF, so the command is not missing.

Assign a static route for the VoIP subnet

Why wrong: Static routes would override SD-WAN logic.

Enable BFD on all WAN interfaces

Why wrong: BFD is for fast failure detection, not traffic steering.

Configure a route map for VoIP traffic

Why wrong: Route maps are not used for SD-WAN traffic steering.

Configure the area as a stub area

Why wrong: Incorrect. A stub area blocks Type 5 LSAs (external routes) but still allows Type 3 LSAs (inter-area routes), so it does not meet the requirement to block Type 3 LSAs.

Configure the area as an NSSA

Why wrong: Incorrect. An NSSA blocks Type 5 LSAs but allows Type 3 LSAs, similar to a stub area. It does not prevent Type 3 LSAs from entering the area.

Set the OSPF network type to point-to-multipoint

Why wrong: Incorrect. Setting the OSPF network type to point-to-multipoint affects neighbor discovery and LSA flooding behavior but does not filter Type 3 LSAs.

The SD-WAN rule is configured with 'mode = load-balance' but the algorithm is set to 'source-dest-ip'

Why wrong: Algorithm is volume, not source-dest-ip.

The performance SLA has a high packet loss threshold causing the member to be dead

Why wrong: If member is dead, it won't receive traffic, but that's not about volume imbalance.

The traffic is encrypted and cannot be inspected

Why wrong: Encryption does not affect load balancing algorithm.

The session is about to expire and will be removed soon

Why wrong: Expire time is 3599 seconds, not near zero.

The session is using UDP protocol

Why wrong: proto=6 indicates TCP.

The session is in a half-open state

Why wrong: proto_state=01 indicates established, not half-open.

Configure the FortiExtender as a standalone firewall and use IPsec between them.

Why wrong: Configuring the FortiExtender as a standalone firewall with IPsec is incorrect because the FortiExtender acts as a modem, not a standalone firewall, and using IPsec adds unnecessary complexity.

Configure the FortiExtender as a separate VDOM and route between VDOMs.

Why wrong: Configuring the FortiExtender as a separate VDOM and routing between VDOMs is incorrect; the FortiExtender does not support VDOMs and is meant to be directly integrated.

Use a virtual-wire pair to connect the FortiExtender.

Why wrong: Using a virtual-wire pair is incorrect as virtual-wire pairs are used for transparent mode inspection, not for integrating a FortiExtender.

The 'set status' on the performance SLA is 'passive'.

Why wrong: Incorrect. If the performance SLA status is 'passive', it would not probe, but the interface going down should still cause failover by other mechanisms (like route withdrawal). So this is less likely.

The performance SLA's failover threshold is not met.

Why wrong: Incorrect. When the interface is physically down, the SLA is not relevant. The failover threshold applies only when the interface is up but performance degrades. The question says 'unavailable', meaning down.

The 'update-static-route' is enabled on port1.

Why wrong: Incorrect. 'update-static-route' affects whether SD-WAN creates static routes, but it does not prevent failover when an interface goes down.

The session is in a half-open state (proto_state=01) and will expire in 3600 seconds.

Why wrong: While proto_state=01 does indicate a half-open TCP state (SYN-SENT), the expire value shown is 3599 seconds, not 3600. Also, the option misinterprets the duration field as time until expiry.

The session has been idle for 3600 seconds and will be removed in 3599 seconds.

Why wrong: Duration=3600 indicates the time since the session was created, not idle time. The expire value of 3599 is the remaining time before removal, not the time until removal after idle.

The session is UDP and has 3600 seconds to live.

Why wrong: Proto=6 is TCP, not UDP. Also, expire=3599 shows 3599 seconds to live, not 3600.

The ABR is not configured with 'set type' for area 1.

Why wrong: Incorrect. The 'set type' command configures an area type (e.g., stub, NSSA), but not setting it defaults to a standard area, which does not cause route learning failure.

The 'set redistribute' option is missing on the ABR.

Why wrong: Incorrect. 'set redistribute' controls route redistribution from other protocols into OSPF and does not impact inter-area route learning.

Area 1 is configured as a stub area and does not accept external routes.

Why wrong: Incorrect. A stub area blocks external routes (Type 5 LSA) but still accepts inter-area routes (Type 3 LSA). Thus, a FortiGate in a stub area can still learn routes from area 1.

The PBR policy does not have a set tos or set dscp value

Why wrong: PBR does not require TOS/DSCP to function.

The PBR policy has a higher priority number than the default route

Why wrong: PBR priority is independent of route table; lower number means higher priority. But the issue is likely that PBR is not being matched.

The MPLS link is down

Why wrong: If the link is down, traffic would still follow the default route, but the question states the traffic uses the default route, not that it fails.

The route map does not have a match statement and therefore is not applied

Why wrong: In FortiOS, a route map with only set statements matches all routes and is applied. Therefore, missing a match statement does not cause the route map to be ignored.

The route map is applied in the wrong direction

Why wrong: Route maps applied to OSPF redistribution do not have a direction; they are simply referenced in the redistribute command. Applying in the wrong direction is not a valid concept here.

The redistributed route is already in OSPF with a metric of 20

Why wrong: The redistributed route cannot already be in OSPF, as redistribution implies it is being imported from another source. This option is not plausible.

The interface must have 'set role lan' configured

Why wrong: Incorrect. Setting the role to 'lan' does not enable FortiLink management protocols.

The interface must be configured as a 'trunk' mode to connect to the FortiSwitch

Why wrong: Incorrect. Trunk mode (set mode trunk) is used for port aggregation or VLAN trunking but does not enable FortiLink control protocols.

The interface must be a member of a VDOM

Why wrong: Incorrect. VDOM membership is unrelated to FortiLink management; the interface must be a physical or VLAN interface with switch type.

Enable BFD only on the OSPF interfaces using 'set bfd enable' under the interface configuration.

Why wrong: Incorrect. Enabling BFD only on OSPF interfaces using 'set bfd enable' under interface configuration is insufficient because BFD must also be enabled globally and at the OSPF process level.

BFD is automatically enabled when OSPF is configured; no additional steps are needed.

Why wrong: Incorrect. BFD is not automatically enabled when OSPF is configured; explicit configuration is required at both global and process levels.

Create a BFD template and apply it to the OSPF process.

Why wrong: Incorrect. FortiGate does not use BFD templates; BFD is configured directly under global and OSPF settings.

Enable 'set role' on the MPLS link as 'primary' and on the broadband link as 'standby' with the 'redundant' strategy.

Why wrong: FortiGate SD-WAN does not have a 'role' setting or 'redundant' strategy; these are not valid options.

Configure both links in the SD-WAN zone with equal priority and use the 'lowest cost' strategy.

Why wrong: Equal priority would not enforce active/passive behavior; traffic might be load-balanced. The 'lowest cost' strategy is not the primary method for failover.

Create two static routes: one with higher distance for MPLS and one with lower distance for broadband.

Why wrong: Static route distance is not used for SD-WAN member selection; SD-WAN rules use priorities and strategies.

The static route for Member1 has a higher administrative distance than Member2.

Why wrong: SD-WAN member selection does not rely on static route distance; it uses SD-WAN rules and health-check status.

The SD-WAN rule is configured with 'set fallback' disabled.

Why wrong: There is no 'fallback' setting in SD-WAN rules; fallback is controlled by health-check and route updates.

The priority of Member2 is higher than Member1.

Why wrong: Member1 has higher priority (10 > 5), so it should be preferred when available; this is not the cause.

Increase the priority of Link A to ensure it remains the preferred link.

Why wrong: Increasing priority would not address the performance degradation; it would keep traffic on Link A despite poor quality.

Disable link-quality-measurement to reduce overhead on Link A.

Why wrong: Disabling link-quality-measurement would remove the ability to monitor performance, not improve it.

Add a new SD-WAN rule with 'lowest cost' strategy for VoIP traffic.

Why wrong: Lowest cost strategy does not consider quality; it would not improve voice quality.

Health-check probes can be sent from any interface, including loopback.

Why wrong: Health-check probes are sent from the SD-WAN member interfaces themselves, not from loopback.

Health-check can only be configured on physical interfaces, not VLANs or subinterfaces.

Why wrong: Health-check can be configured on any SD-WAN member, including VLANs and subinterfaces.