Pass NSE7_SSE_AR-26 Exam Guide

The exhibit shows the following IPsec phase1-interface configuration applied on spoke tunnels: In the FCSS SD-WAN 7.6 ADVPN architecture, the network-overlay and network-id parameters are used to logically group IPsec tunnels into separate overlays. When network-overlay is enabled, FortiGate treats the tunnel as part of an overlay network rather than a simple transport tunnel. The network-id parameter is critical in multi-overlay ADVPN designs. Fortinet documentation specifies that ADVPN shortcuts are only allowed between tunnels that share the same network-id. This mechanism explicitly prevents cross-overlay shortcuts, ensuring that shortcuts are formed only within the same logical overlay and not across different overlays that may serve different purposes (for example, different hubs, regions, or transport groups). The use of auto-discovery-shortcuts dependent further enforces correct shortcut behavior by ensuring that shortcut tunnels depend on the state of the parent overlay tunnel, but it does not by itself prevent multiple shortcuts or convert ADVPN versions. Why the other options are incorrect: Therefore, the valid objective of these settings is to prevent cross-overlay shortcuts, which corresponds to Option C.

The FortiOS 7.6 architecture describes multiple standard SD-WAN deployment designs, each mapped to a specific operational goal or constraint. A cloud on-ramp topology is designed to optimize connectivity to cloud services such as SaaS and IaaS. This design provides the most efficient and reliable path to cloud applications by establishing direct tunnels to cloud gateways or cloud workloads and by avoiding backhauling traffic through a central data center. As a result, its primary indication is improving the performance of cloud applications, which makes option A correct. A remote breakout (centralized breakout) design forwards all internet-bound traffic from branch sites to a central hub for security inspection. This allows security policies, inspection, and logging to be centralized on a high-capacity FortiGate at the hub. Because branch devices do not need advanced local security configurations, this design also limits local management requirements, which makes option C correct. Option B is incorrect because a standalone SD-WAN design is not selected simply because a site has only one WAN link. SD-WAN provides its main benefits when multiple WAN paths exist, and single-link sites do not gain meaningful traffic-steering advantages. Option D is incorrect because a direct internet access (DIA) design performs local internet breakout at the branch and therefore requires strong local security capabilities. DIA does not inherently increase traffic security and is not intended for devices with limited capabilities. Therefore, the two correct associations are A and C.

From the exhibit, both branches have an SD-WAN zone named overlay with set advpn-select enable, and each SD-WAN member in that zone is assigned a transport-group value. Branch-A members: Branch-B members: In FCSS SD-WAN 7.6 ADVPN design, transport-group is used to constrain which underlays are allowed to form ADVPN shortcuts with each other. A spoke can establish an ADVPN shortcut only between interfaces that belong to the same transport-group on both sides. This prevents building shortcuts across dissimilar transports. Evaluating the options: Therefore, the valid shortcut pairing listed is between T2 on Branch-A and TA on Branch-B, which corresponds to Option D. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

BGP on loopback separates routing adjacency establishment from individual IPsec tunnel interface addresses. Combined with Dynamic BGP, it enables scalable SD-WAN overlays and dynamic spoke-to-spoke routing relationships.

Option A is correct for the intended reference design because enabling net-device on a spoke supports dedicated tunnel-interface handling for IPsec connections and dynamically created ADVPN shortcuts. This configuration appears in Fortinet ' s overlay provisioning examples.

Option C is correct because the spoke ' s localid supplies an identifiable IKE identity that the hub can use when authenticating and matching IPsec peers. It is particularly useful where multiple spokes share a hub ' s dial-up IPsec configuration or the hub requires specific peer identities.

Option B is incorrect because the hub normally acts as the dynamic IPsec dial-up responder, rather than being configured as a static tunnel endpoint for every spoke.

Option D is not a fundamental requirement of BGP-on-loopback routing. IKE mode configuration can distribute tunnel addresses, but loopback-based BGP does not inherently require IP addresses on each IPsec overlay.

An important implementation distinction is that net-device behavior can vary by FortiOS release and reference topology. Therefore, the actual production configuration should follow the selected FortiOS 7.6 deployment template rather than treating this combination as universal.