NSE 7 Network Security Architect NSE7_SSE_AR-26 Exam Questions and Answers PDF

FortiSASE Secure Private Access (SPA) integrates with FortiGate SD-WAN hubs through IPsec overlays and Border Gateway Protocol routing. This enables FortiSASE security points of presence to advertise endpoint networks and learn routes to corporate applications.

Option A is correct because FortiSASE supports two principal BGP routing designs: BGP per overlay and BGP on loopback. Both designs support appropriate iBGP and eBGP peering arrangements.

With BGP per overlay, routing adjacencies use addresses associated with individual IPsec tunnel interfaces. This approach establishes BGP sessions over each configured overlay.

With BGP on loopback, routing adjacencies terminate on logical loopback interfaces rather than individual tunnel interfaces. This separates BGP session establishment from the underlying IPsec transport and provides improved routing stability when overlay paths change.

iBGP is used when FortiSASE and the connected FortiGate hub belong to the same autonomous system. eBGP enables interconnection when different autonomous systems are involved.

Option B incorrectly excludes BGP on loopback. Option C incorrectly excludes eBGP.

Option D incorrectly presents Dynamic BGP as an independently selectable FortiSASE SPA routing design. Although Dynamic BGP is supported in FortiOS SD-WAN architectures, the FortiSASE SPA configuration identifies BGP per overlay and BGP on loopback as its two routing-design choices.

Application-based SD-WAN rules enable intelligent traffic steering. The FortiOS behavior is: " If a flow is identified as belonging to a defined application category (such as social media), FortiGate will match it to the corresponding service rule (rule 2) and route it through the specified interface, such as port2. However, if the application is not recognized during the session setup, the system defaults to load balancing the traffic using the available tunnels according to the policy for unclassified traffic, ensuring continuous connectivity while waiting for application classification. " This guarantees both performance and resilience. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

The session diagnostic displays an original session path and a reflect or auxiliary session for asymmetric forwarding. The reflect session lists dev=7- > 6/6- > 7; interface index 7 corresponds to port3 and index 6 corresponds to port2, establishing a reply direction of port2 to port3. The original session path dev=7- > 5/5- > 7 represents port3 and port1, not port3 and port2. Auxiliary sessions can be hardware-offloaded when the FortiGate network processor supports the relevant configuration and conditions; a single currently observed offload flag does not prove that capability is impossible. Therefore C and D are the correct conclusions. Reference: FortiOS 7.6 — Controlling Return Path with Auxiliary Session. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

In an SD-WAN rule, you can steer application traffic by using Internet Service Database (ISDB) entries. Facebook and LinkedIn are predefined ISDB objects in FortiGate, so the correct way is to select them in the Internet service field under Destination. This ensures that all traffic to these applications is matched and routed through the chosen (less costly) link. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.