The FortiOS SD-WAN routing mechanism follows a specific order of operations and logic. First, FortiOS evaluates traditional policy routes; if a match is found, that route is used, and SD-WAN rules are bypassed. If no policy route matches, FortiOS performs a standard route lookup in the Forwarding Information Base (FIB). By default, if the best route found is not through an SD-WAN member interface, the SD-WAN rules are skipped entirely. Finally, for an SD-WAN rule to be applied, at least one of its member interfaces must have a valid, active route to the traffic's destination. If none of the members can reach the destination, the rule is skipped, and the system proceeds to the next step in the routing logic.

B. SD-WAN rules do not have the highest precedence; regular policy routes are evaluated first in the FortiOS packet flow.

D. SD-WAN rules are not skipped if only one route is available. SD-WAN can be used for application steering and SLA monitoring even on a single link.

1. FortiOS 7.6.0 SD-WAN Administration Guide

Page 10

"SD-WAN rules":

"FortiGate first performs a route lookup for the destination IP address. If the best route is not an SD-WAN member

FortiGate does not use the SD-WAN rules and forwards the traffic using the best route." (Supports option E)

"If none of the members selected by the SD-WAN rule have a valid route to the destination

the SD-WAN rule is skipped." (Supports option A)

2. FortiOS 7.6.0 Networking Guide

Page 29

"Packet flow and session processing"

"Routing" section:

The packet flow diagram and description clearly show that "Policy Route" lookup occurs before "SD-WAN Rule" lookup. This confirms that regular policy routes have precedence over SD-WAN rules. (Supports option C

refutes option B)