Free and Premium Fortinet NSE7_SSE_AR-26 Dumps Questions Answers

From the Underlay and network advertisement configuration exhibit for the Secondary HUB: In FortiManager SD-WAN Overlay Orchestrator, underlay interfaces selected for a hub are the transports used to build the overlay IPsec tunnels (one overlay per underlay, per peer as defined by the template). Because both port1 and port2 are configured as underlays, FortiManager will build overlay tunnels over both underlay links. That supports: For the BGP neighbor options: So, the two correct conclusions are B and C. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

FortiManager supports advance model-device creation and per-device metadata variable mappings for large-scale onboarding. Model devices can be assigned configuration templates and policy packages before physical installation. When DHCP-based discovery is selected, DHCP options can also be prepared to direct new FortiGates toward FortiManager. Custom metadata values provide branch-specific addresses, site identifiers and gateway settings. The terms “ZTP template” and “policy blueprint” do not accurately identify the documented FortiManager objects in the candidate answers: device blueprints and policy packages are distinct components. Consequently, options A, B and D are valid under a DHCP-based ZTP design. This choice is dependent on the selected bootstrap method. Reference: FortiManager 7.6 — Model Devices, Metadata Variables, Zero-Touch Provisioning and Device Blueprints. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation.

Verification qualification: The DHCP-server step depends on the zero-touch-provisioning method; it is not universally mandatory.

Enforce Device Configuration is enabled and the blueprint applies the provisioning CLI templates. The LAN-interface script sets port1 and port2 to DHCP and assigns a static IP to port5 (using the branch_id variable). Therefore, when FortiManager pushes the blueprint, it updates the configurations of port1, port2, and port5 - and their IP addresses may change accordingly. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault. In the relevant Fortinet FortiManager documentation, the applicable feature should be verified against the deployed software version, the selected configuration mode and the live operational state before the answer is treated as a definitive implementation requirement.

FortiGate SD-WAN integrates policy-based traffic steering with the traditional routing subsystem. SD-WAN rules do not automatically override routing-table decisions; they operate within the route-selection framework.

Option A is correct. A member selected by an SD-WAN rule must have a valid route toward the destination. If the selected member cannot reach the destination, FortiGate excludes that member and evaluates another eligible candidate.

Option C is correct. Under default SD-WAN routing behavior, the best route to the destination must point toward an SD-WAN member before SD-WAN service-rule evaluation applies. If the best route points to a non-SD-WAN interface, conventional routing handles the traffic instead.

Option E is correct because a directly connected route can take precedence when it is the best matching route. FortiGate does not unnecessarily divert locally reachable destinations into SD-WAN processing.

Option B is incorrect because the Internet Service Database supplies application and destination classification information; it does not establish a universal routing-precedence rule above SD-WAN.

Option D is incorrect because a static route does not inherently bypass SD-WAN. Static routes commonly provide reachability through SD-WAN member interfaces.

The fundamental principles are route eligibility, valid member reachability, and preservation of conventional routing decisions outside the SD-WAN domain.

From the SD-WAN rule configuration (service ID 3, name " Corp " ), the rule is configured as: In the diagnose firewall proute list output for service=3 (Corp), FortiGate shows the actual members considered for this rule and their SLA pass status: Because the rule is SLA-based, FortiGate selects only members that meet the SLA requirements for the rule. The output indicates that HUB1-VPN1 and HUB1-VPN2 pass both SLA checks (num_pass=2), while HUB1-VPN3 passes only one (num_pass=1) and therefore is not selected as an eligible forwarding interface for this rule. Since load-balance is enabled and the rule uses hash-mode source-ip-based, FortiGate will consistently choose an eligible member based on the source IP hash. For traffic sourced from 10.0.1.101, the session can be steered through either HUB1-VPN1 or HUB1-VPN2 (whichever the hash selects), but not HUB1-VPN3. Therefore, the correct answer is B. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

Verification qualification: A specific hash-selected interface cannot be predicted from the supplied configuration without the full evaluation.

One SD-WAN rule is defined with application categories as the destination → The diagnose output shows application control matches such as Microsoft.Portal, Operational.Technology, and Social.Media, confirming that SD-WAN rules are using application categories as destinations. UDP traffic destined to the subnet 10.22.0.0/24 matches a policy route → The first entry (id=1) shows protocol=17 (UDP) with destination 10.22.0.0/24, confirming this traffic is handled by a policy route instead of an SD-WAN rule. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

The described design is a multi-region SD-WAN architecture, where: According to Fortinet’s SD-WAN Architecture for Enterprise guidance, when deploying multiple ADVPN regions, eBGP is the recommended routing protocol between regions. Each region operates as an independent routing domain (typically iBGP within the region), while eBGP is used to exchange routes between regional hubs. This approach: This is explicitly documented in Fortinet guidance for “Using eBGP between regions with intra-region ADVPN”, which confirms that the architecture described in the question is valid and recommended when eBGP is used between regions. Why the other options are incorrect: Therefore, the correct and documented conclusion is that the plan is possible and eBGP should be used as the routing protocol between regions, which corresponds to Answer A. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

The exhibits identify a source at 10.0.1.101 generating an ICMP echo toward a public destination. They show multiple Internet-facing SD-WAN members, but not a session-table record or packet capture tying this exact ICMP exchange to port2. The corporate service requires a private destination, so it is not the controlling match for the Facebook public IP address. Application classification must also be distinguished from a basic ICMP ping: a Facebook application signature associated with HTTPS traffic does not establish that an ICMP exchange has been recognized as the Facebook application. Although D (port2) is the supplied key, the displayed service definition and application-cache information alone do not prove it. To determine the correct egress, capture the specific ICMP flow or apply a source/destination session filter and inspect the selected SD-WAN member and outgoing device. Port1, port2, and port4 remain potential candidates until the relevant interface and route-selection evidence is supplied. Accordingly this is not an exhibit-verified single-answer item, and it should not be sold as conclusively solved solely from the provided screenshot. The FortiOS Application Steering guide documents why application detection and rule eligibility must be examined separately.

Verification qualification: The available exhibits do not uniquely prove port2 as the ICMP egress interface.

Fortinet ' s unified SASE architecture supports multiple methods of securing private application access, including identity-based Zero Trust Network Access and connectivity through Secure SD-WAN.

Option B is correct because ZTNA provides an application-centric alternative to traditional remote-access VPN architectures. Instead of providing broad network connectivity, ZTNA authenticates users, evaluates device security posture, and grants access only to explicitly authorized applications.

Fortinet ZTNA integrates identity verification, endpoint posture assessment, and application-specific security policies to reduce implicit trust.

Option C is correct because Secure SD-WAN enables encrypted and centrally managed connectivity between enterprise locations, cloud environments, and private resources. When integrated with FortiSASE, existing SD-WAN hubs can provide secure private application access through cloud security points of presence.

Option A is incorrect in this scenario because SD-WAN Branch On-ramp is primarily an ingress method for connecting branch networks to FortiSASE. Although it can participate in a broader private-access architecture, it is not the general VPN-replacement technology being tested.

Option D is incorrect because SWG and CASB primarily address internet and SaaS application security rather than providing the private network connectivity and application-specific access control required here.

ZTNA delivers granular access enforcement, while Secure SD-WAN supplies resilient and secure enterprise connectivity.

FortiGate evaluates SD-WAN traffic against configured service rules, considering source and destination addresses, application identification, performance SLA status, and eligible forwarding members.

Option D is correct because SMTP traffic matches SD-WAN service rule 3, which permits load balancing across six overlay interfaces belonging to the HUB1 and HUB2 zones.

Service 2: Although the source IP address 10.0.1.124 matches its configured source range, this rule specifies Facebook, LinkedIn, and gaming applications. SMTP traffic does not satisfy these application-matching criteria.

Service 3: The rule matches the following conditions:

Source: 10.0.1.0–10.0.1.255

Destination: 10.0.0.0–10.255.255.255

Strategy: Lowest Cost (SLA), with round-robin load balancing

Members: Six VPN interfaces across HUB1 and HUB2

The diagnostic output shows that all six members are alive and selected.

Although sla(0x0) and num of pass(0) indicate that none meets the configured SLA target, FortiOS can still load balance across the tied, operational members when all fail their SLA thresholds.

Therefore, FortiGate can distribute qualifying SMTP sessions among HUB1-VPN1, HUB1-VPN2, HUB1-VPN3, HUB2-VPN1, HUB2-VPN2, and HUB2-VPN3, assuming valid destination routes.

Options A and C incorrectly restrict the eligible interfaces, while option B disregards the matching SD-WAN service rule.

FortiSASE proxy-based secure internet access allows managed and unmanaged endpoints to use cloud-delivered security controls without requiring the FortiClient endpoint agent.

Option A is correct because a proxy auto-configuration file can define how browsers and operating systems redirect eligible HTTP and HTTPS requests to the FortiSASE secure web gateway.

A PAC file allows automatic proxy selection based on destination URLs, hostnames, and other conditions. FortiSASE supports hosted and downloadable PAC file configurations, simplifying deployment across large endpoint populations.

Option B is correct because endpoints should install and trust the FortiSASE certificate authority certificate when SSL deep inspection is required. During TLS inspection, FortiSASE decrypts permitted traffic for security analysis and presents certificates that must be trusted by the endpoint.

Without the appropriate certificate, browsers and applications may reject inspected HTTPS connections because the signing authority is untrusted.

Option C is incorrect because FortiClient is associated with agent-based endpoint connectivity. Proxy-based deployment can operate without installing FortiClient.

Option D is incorrect because a tunnel policy applies to tunnel-based traffic handling rather than constituting an endpoint onboarding component for explicit proxy access.

PAC configuration provides traffic steering, while CA certificate installation establishes the certificate trust needed for SSL inspection.

The SD-WAN rule is configured for Best Quality with packet loss as the selected link-cost factor. The output shows HUB1-VPN1 at 2% loss, HUB1-VPN2 at 4% and HUB1-VPN3 at 12%, with member ID 6 placed first in the configured priority list. With a link-cost threshold of zero, FortiGate selects by the measured link-cost metric, using member order to resolve an equal-quality tie. Option D is the intended answer: if all three members reach the same packet-loss value, the first configured preference, HUB1-VPN3, can win the tie. Increasing only HUB1-VPN1 loss to 4% leaves HUB1-VPN2 at 4% and HUB1-VPN3 at 12%; changing VPN3 to 4% still leaves VPN1 at 2%. Increasing HUB1-VPN1 to 12% leaves VPN2 at 4%. Therefore A, B and C do not produce the same tie outcome. This interpretation assumes all members are operational and remain equally route-eligible. Fortinet ' s Best Quality documentation explicitly describes measured metrics, configured member ordering and link-cost thresholds as distinct selection inputs.

Verification qualification: The exhibit supports the equality tie-break outcome only if the chosen quality criterion is packet loss and no other eligibility changes intervene.

For a large-scale SD-WAN deployment (such as 1000 spokes) where ADVPN shortcut routing is required and some remote sites connect via FortiSASE, the recommended overlay routing configuration is BGP running on loopback interfaces, combined with dynamic BGP for ADVPN shortcut routing. This design leverages the scalability and resilience of BGP, allowing dynamic discovery and route exchange necessary for shortcut tunnels between spokes in ADVPN environments. Using loopback interfaces for BGP peering is considered best practice because it decouples routing protocol stability from physical link status, ensuring that if a physical underlay interface fails, the BGP session remains up as long as there’s an alternate path. With dynamic BGP, each spoke can efficiently learn the routes to other spokes and dynamically establish shortcuts, which is critical at this scale. This method also integrates smoothly with FortiSASE for remote connectivity to the SD-WAN hub, providing flexibility and centralized management.References: A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

FortiGate supports Active, Passive, and Prefer Passive performance SLA monitoring modes. Passive monitoring measures actual network traffic rather than generating synthetic probes.

Option B is correct in the conventional preferred-link scenario because passive measurement depends on traffic traversing an SD-WAN member. When traffic is forwarded exclusively through the preferred link, FortiGate cannot measure the performance of unused alternative links. This is a limitation of passive monitoring.

Option D is correct because FortiGate uses TCP session information to measure latency, jitter, and packet loss. Latency measurements are derived from TCP connection behavior, while packet loss and jitter are determined using TCP header information.

Option A is incorrect because passive measurement relies on TCP session characteristics rather than ICMP traffic.

Option C is incorrect because enabling passive WAN health measurement disables automatic ASIC offloading on the affected firewall policies, allowing FortiGate to inspect the required TCP session information.

Option E is incorrect because the three-minute fallback to active probing belongs to Prefer Passive, not Passive mode. In Prefer Passive mode, FortiGate activates probes after three minutes without qualifying TCP traffic.

The event-log field advpnsc establishes whether the logged VPN tunnel is an ADVPN shortcut. The value advpnsc=1 identifies a shortcut, whereas advpnsc=0 identifies a non-shortcut event. The log for HUB1-VPN1_0 contains advpnsc=1, making the shortcut identification the directly supported conclusion. A different tunnel showing advpnsc=0 does not prove that its master tunnel cannot accept shortcuts. Application steering cannot be inferred from a VPN statistics event without the corresponding SD-WAN rule and session evidence. For ADVPN diagnostics, correlate vpntunnel, tunnelid, advpnsc and status messages. Reference: FortiOS 7.6 — ADVPN Shortcut Paths; Fortinet VPN log-field reference. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

FortiGuard SOC-as-a-Service provides managed security monitoring, threat investigation, alert triage, and incident-response assistance for organizations that require dedicated security operations capabilities.

Option B is correct because SOCaaS provides continuous monitoring of security telemetry forwarded from protected FortiSASE and FortiGate environments. Fortinet ' s managed security specialists investigate suspicious activity, correlate events, and escalate validated incidents. This capability provides ongoing visibility into security threats affecting connected users and protected endpoints, within the scope of integrated telemetry sources.

Option D is correct because SOCaaS centralizes security event analysis and incident visibility. Logs and alerts collected from different enforcement points can be correlated to support investigations and coordinated remediation, reducing the operational fragmentation associated with independent monitoring systems.

Option A is incorrect because bandwidth analytics primarily belongs to network monitoring, traffic analytics, and digital experience monitoring rather than the core SOCaaS security-operations function.

Option C is incorrect because SOCaaS does not replace endpoint protection. FortiClient, endpoint detection and response, and other security controls continue to provide essential prevention and endpoint telemetry.

The Study Guide describes SOCaaS as a 24/7 managed service incorporating FortiGuard intelligence, expert investigation, and security orchestration capabilities.

Before FortiGate can steer traffic according to SD-WAN rules, certain configuration elements must be present. Fortinet SD-WAN design guidance describes the required elements: " SD-WAN is not a standalone feature and interacts with several fundamental FortiGate configurations. Specifically, you must: (1) Define the interfaces (physical, VLAN, or IPsec) that will act as SD-WAN members, (2) Create firewall policies to allow traffic to be steered by SD-WAN, and (3) Set up routing so that traffic has valid routes via SD-WAN members. Without these, SD-WAN rules will not be able to match or steer any traffic. " Security profiles and traffic shaping are not mandatory for basic SD-WAN steering but can be layered on for enhanced security and QoS once foundational elements are present.References: A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

FortiSASE Secure Private Access enables protected communication between remote users, branch locations, and enterprise resources through FortiSASE security points of presence and FortiGate SPA hubs.

Option B is correct because SPA supports server-initiated communication from resources behind FortiGate SPA hubs to FortiClient agent-based remote users. This bidirectional capability requires appropriate From hubs security policies and routing.

Option D is correct because agent-based users can access private applications behind Fortinet Secure SD-WAN hubs. FortiSASE establishes IPsec overlays to the hubs, while BGP exchanges reachability information for protected networks.

Option E is correct because thin-edge locations and branch on-ramp devices can access private applications through FortiSASE. Fortinet explicitly documents access from FortiAP, FortiExtender, and branch on-ramp deployments to private networks through SPA.

Option A is incorrect because internet-bound traffic is principally associated with Secure Internet Access (SIA), rather than SPA.

Option C is not a standard SPA hub-to-hub service flow. SPA primarily connects FortiSASE users and edge locations with private resources behind SPA connectors. Inter-site traffic may use other supported SD-WAN or specifically configured inter-PoP paths.

The distinction is important: Fortinet documents thin-edge and branch-on-ramp access to private resources as a supported SPA use case.

When you enable ADVPN (auto-discovery VPN) in the overlay template, FortiManager automatically updates both the IPsec and BGP templates on the hub so that shortcut tunnels can be established dynamically. ADVPN can be activated in the SD-WAN overlay template for any supported topology, including dual-hub primary–primary, not just single hub. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable. Before applying a topology change, review the interface dependencies, static and dynamic routing, security policies and provisioning templates. FortiGate can support multiple transport types, but routing and tunnel compatibility still determine whether the intended member is operationally eligible. In the relevant Fortinet FortiOS documentation, the applicable feature should be verified against the deployed software version, the selected configuration mode and the live operational state before the answer is treated as a definitive implementation requirement.

According to the FortiSASE 25 Enterprise Administrator Study Guide, page 25, branch on-ramp deployment enables organizations to secure outbound internet traffic from branch locations by connecting their existing network infrastructure to FortiSASE.

Option A is correct: Branch on-ramp allows remote offices and branch locations to establish secure IPsec VPN tunnels between their FortiGate or supported third-party network devices and FortiSASE points of presence (PoPs). Traffic is forwarded through these tunnels, allowing FortiSASE to deliver cloud-based security inspection and enforcement.

The study guide explains that connected branches can benefit from Secure Internet Access (SIA), Secure SaaS Access (SSA), and Secure Private Access (SPA).

Option B is incorrect: Although branch on-ramp supports secure private application access, providing access through a bookmark portal is not its primary deployment benefit.

Option C is incorrect: Branch on-ramp provides secure network connectivity and traffic inspection. It is not designed primarily for endpoint inventory, administration, or lifecycle management.

Option D is incorrect: The study guide explicitly states that FortiClient installation is not required for branch edge-device deployments and that ZTNA tags are not supported in this configuration.

Therefore, branch on-ramp primarily enables organizations to extend FortiSASE cloud security services to branch offices and secure their internet-bound traffic.

Exact Source References:

FortiSASE 25 Enterprise Administrator Study Guide, page 25 — Thick Edge Use Case, including secure branch outbound traffic and branch on-ramp.

FortiSASE 25 Enterprise Administrator Study Guide, page 26 — FortiSASE Branch On-Ramp Configuration.

FortiSASE 25 Enterprise Administrator Study Guide, page 27 — Edge-Device Policies, explaining the lack of ZTNA tag support.

FortiSASE Secure Private Access (SPA) integrates with FortiGate SD-WAN hubs through IPsec overlays and Border Gateway Protocol routing. This enables FortiSASE security points of presence to advertise endpoint networks and learn routes to corporate applications.

Option A is correct because FortiSASE supports two principal BGP routing designs: BGP per overlay and BGP on loopback. Both designs support appropriate iBGP and eBGP peering arrangements.

With BGP per overlay, routing adjacencies use addresses associated with individual IPsec tunnel interfaces. This approach establishes BGP sessions over each configured overlay.

With BGP on loopback, routing adjacencies terminate on logical loopback interfaces rather than individual tunnel interfaces. This separates BGP session establishment from the underlying IPsec transport and provides improved routing stability when overlay paths change.

iBGP is used when FortiSASE and the connected FortiGate hub belong to the same autonomous system. eBGP enables interconnection when different autonomous systems are involved.

Option B incorrectly excludes BGP on loopback. Option C incorrectly excludes eBGP.

Option D incorrectly presents Dynamic BGP as an independently selectable FortiSASE SPA routing design. Although Dynamic BGP is supported in FortiOS SD-WAN architectures, the FortiSASE SPA configuration identifies BGP per overlay and BGP on loopback as its two routing-design choices.

Application-based SD-WAN rules enable intelligent traffic steering. The FortiOS behavior is: " If a flow is identified as belonging to a defined application category (such as social media), FortiGate will match it to the corresponding service rule (rule 2) and route it through the specified interface, such as port2. However, if the application is not recognized during the session setup, the system defaults to load balancing the traffic using the available tunnels according to the policy for unclassified traffic, ensuring continuous connectivity while waiting for application classification. " This guarantees both performance and resilience. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

The session diagnostic displays an original session path and a reflect or auxiliary session for asymmetric forwarding. The reflect session lists dev=7- > 6/6- > 7; interface index 7 corresponds to port3 and index 6 corresponds to port2, establishing a reply direction of port2 to port3. The original session path dev=7- > 5/5- > 7 represents port3 and port1, not port3 and port2. Auxiliary sessions can be hardware-offloaded when the FortiGate network processor supports the relevant configuration and conditions; a single currently observed offload flag does not prove that capability is impossible. Therefore C and D are the correct conclusions. Reference: FortiOS 7.6 — Controlling Return Path with Auxiliary Session. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

In an SD-WAN rule, you can steer application traffic by using Internet Service Database (ISDB) entries. Facebook and LinkedIn are predefined ISDB objects in FortiGate, so the correct way is to select them in the Internet service field under Destination. This ensures that all traffic to these applications is matched and routed through the chosen (less costly) link. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

The SD-WAN rule (config service edit 1) is configured with set mode priority. This means the rule selects the best interface based on a defined performance metric, as opposed to a simple static priority or SLA. The event log (image_41cfb5.png) shows Metric latency and Message Service prioritized by performance metric will be redirected in sequence order. This indicates that the rule is using latency to determine the preferred member. Given that the log message is about a change, and the most logical reason for a change in a priority mode is that a different member is now the best performer, it implies that the latency on port2 has become lower than that on port1. The log message Service prioritized by performance metric will be redirected in sequence order confirms that FortiGate is changing the member being used for this service. Because the mode is priority, FortiGate dynamically selects the member that currently meets the best performance criteria, which in this case is latency. The log implies a new member has been selected as the most optimal, and with the default configuration, the members are sorted based on their performance, so the outgoing interface list is effectively updated to prefer the new best-performing member (port2).

The FortiManager installation error is associated with the gateway value produced by metadata substitution, not with a general failure of FortiManager-to-FortiGate connectivity. A template uses a variable such as ' $(sdwan_port1_gw) ' to provide the interface gateway at installation time. If the current device has no valid value in its per-device metadata mapping, the generated FortiOS configuration contains an invalid IPv4 gateway and the copy or validation operation fails. Therefore the remediation is to inspect the variable definition and its per-device mapping, which is option C in the normalized question. The administrator can verify the mapping for the affected FortiGate, supply a valid address, regenerate the installation preview and reinstall. It is unnecessary to remove all template installation targets: FortiManager supports them alongside metadata variables. Nor must the members of a zone all use identical gateway configuration methods. This conclusion is specifically tied to the error shown in the original exhibit. The uploaded FortiSASE guides describe centralized management generally, but detailed per-device template substitution belongs to the FortiManager 7.6 Administration Guide.

The application-aware SD-WAN rule can initially route a connection through the implicit SD-WAN rule if its three-tuple (destination IP, port, protocol) has not yet been learned in the application cache. Once the application-control engine identifies GoToMeeting as a Collaboration application, session reevaluation can allow matching of the intended application rule. Depending on state, NAT and route changes, an existing session might not migrate successfully. This mechanism is not universally dependent on deep SSL inspection, and the configured Collaboration category is a legitimate match for GoToMeeting. The first cause is established; the second is a plausible interpretation not proven by the visible log alone. Reference: FortiOS 7.6 — Application Detection Steering; Fortinet Technical Tip — Application Learning Phases. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

Verification qualification: The exhibit establishes initial application classification behavior, but not that session route refresh definitely failed.

From the SD-WAN monitor in FortiManager: " The SD-WAN monitor provides a summary view of the branch devices and their members. In the scenario shown, it is clear that branch2_fgt is missing SLA configuration for one member, as evidenced by the lack of performance metrics. The monitor also shows only two branches in the current topology, allowing quick assessment of branch health and configuration completeness. " This kind of visibility is vital for proactive monitoring and rapid troubleshooting in SD-WAN environments.References: FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

The exhibit shows the following IPsec phase1-interface configuration applied on spoke tunnels: In the FCSS SD-WAN 7.6 ADVPN architecture, the network-overlay and network-id parameters are used to logically group IPsec tunnels into separate overlays. When network-overlay is enabled, FortiGate treats the tunnel as part of an overlay network rather than a simple transport tunnel. The network-id parameter is critical in multi-overlay ADVPN designs. Fortinet documentation specifies that ADVPN shortcuts are only allowed between tunnels that share the same network-id. This mechanism explicitly prevents cross-overlay shortcuts, ensuring that shortcuts are formed only within the same logical overlay and not across different overlays that may serve different purposes (for example, different hubs, regions, or transport groups). The use of auto-discovery-shortcuts dependent further enforces correct shortcut behavior by ensuring that shortcut tunnels depend on the state of the parent overlay tunnel, but it does not by itself prevent multiple shortcuts or convert ADVPN versions. Why the other options are incorrect: Therefore, the valid objective of these settings is to prevent cross-overlay shortcuts, which corresponds to Option C.

The FortiOS 7.6 architecture describes multiple standard SD-WAN deployment designs, each mapped to a specific operational goal or constraint. A cloud on-ramp topology is designed to optimize connectivity to cloud services such as SaaS and IaaS. This design provides the most efficient and reliable path to cloud applications by establishing direct tunnels to cloud gateways or cloud workloads and by avoiding backhauling traffic through a central data center. As a result, its primary indication is improving the performance of cloud applications, which makes option A correct. A remote breakout (centralized breakout) design forwards all internet-bound traffic from branch sites to a central hub for security inspection. This allows security policies, inspection, and logging to be centralized on a high-capacity FortiGate at the hub. Because branch devices do not need advanced local security configurations, this design also limits local management requirements, which makes option C correct. Option B is incorrect because a standalone SD-WAN design is not selected simply because a site has only one WAN link. SD-WAN provides its main benefits when multiple WAN paths exist, and single-link sites do not gain meaningful traffic-steering advantages. Option D is incorrect because a direct internet access (DIA) design performs local internet breakout at the branch and therefore requires strong local security capabilities. DIA does not inherently increase traffic security and is not intended for devices with limited capabilities. Therefore, the two correct associations are A and C.

From the exhibit, both branches have an SD-WAN zone named overlay with set advpn-select enable, and each SD-WAN member in that zone is assigned a transport-group value. Branch-A members: Branch-B members: In FCSS SD-WAN 7.6 ADVPN design, transport-group is used to constrain which underlays are allowed to form ADVPN shortcuts with each other. A spoke can establish an ADVPN shortcut only between interfaces that belong to the same transport-group on both sides. This prevents building shortcuts across dissimilar transports. Evaluating the options: Therefore, the valid shortcut pairing listed is between T2 on Branch-A and TA on Branch-B, which corresponds to Option D. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

BGP on loopback separates routing adjacency establishment from individual IPsec tunnel interface addresses. Combined with Dynamic BGP, it enables scalable SD-WAN overlays and dynamic spoke-to-spoke routing relationships.

Option A is correct for the intended reference design because enabling net-device on a spoke supports dedicated tunnel-interface handling for IPsec connections and dynamically created ADVPN shortcuts. This configuration appears in Fortinet ' s overlay provisioning examples.

Option C is correct because the spoke ' s localid supplies an identifiable IKE identity that the hub can use when authenticating and matching IPsec peers. It is particularly useful where multiple spokes share a hub ' s dial-up IPsec configuration or the hub requires specific peer identities.

Option B is incorrect because the hub normally acts as the dynamic IPsec dial-up responder, rather than being configured as a static tunnel endpoint for every spoke.

Option D is not a fundamental requirement of BGP-on-loopback routing. IKE mode configuration can distribute tunnel addresses, but loopback-based BGP does not inherently require IP addresses on each IPsec overlay.

An important implementation distinction is that net-device behavior can vary by FortiOS release and reference topology. Therefore, the actual production configuration should follow the selected FortiOS 7.6 deployment template rather than treating this combination as universal.

FortiGate SD-WAN uses traffic-classification criteria to identify application flows and apply appropriate forwarding strategies based on business priorities and link-performance requirements.

Option C is correct because application categories can be used to identify traffic belonging to defined application groups. This capability enables administrators to steer business-critical applications through preferred WAN paths while directing less-sensitive traffic through alternative links.

Application-aware SD-WAN rules can use FortiGuard application identification to make forwarding decisions without relying exclusively on destination IP addresses or transport ports.

Option D is correct because the Internet Service Database provides predefined classifications for cloud services and internet applications. FortiGate can use ISDB objects in SD-WAN service rules to steer traffic toward destinations associated with services such as Microsoft 365 and other cloud applications.

Option A is incorrect because physical interface type is not one of the application or destination matching criteria represented by this question. SD-WAN members identify eligible forwarding interfaces, which is distinct from the traffic-classification criteria.

Option B is incorrect because BGP attributes influence routing decisions and route selection but are not directly equivalent to the application and ISDB matching criteria used by these service rules.

Together, application-category and ISDB matching provide granular, application-aware steering.