When a FortiGate attempts to join a Security Fabric as a member, its status will remain "Pending" for two primary reasons. First, the join request may not have reached the root FortiGate due to a network connectivity issue or a misconfiguration, such as an incorrect Upstream FortiGate IP. Option A suggests the configured upstream IP is incorrect, which would prevent the join request from being sent to the right device. Second, even if the request is successfully received by the root FortiGate, the member device will not be fully joined until an administrator manually authorizes it on the root FortiGate. If this authorization step is not completed, the member's status will remain "Pending".

B. SAML Single Sign-On must be set to Manual. SAML SSO settings relate to administrator login synchronization across the fabric and do not impact the initial device authorization and join process. D. Management IP must be set to 10.0.13.254. The Management IP is the address of the local device (HQ-ISFW-2). An incorrect Management IP affects how the root manages the device after it joins, not the initial join request itself.

1. Fortinet FortiOS 7.6.0 Administration Guide, Chapter: "Security Fabric", Section: "Building the Security Fabric".

Reference for A: The guide states, "On the downstream FortiGate, go to Security Fabric > Fabric Connectors and edit the FortiGate connector. Set Upstream FortiGate IP to the IP address of the root FortiGate that the downstream FortiGate will connect to." This highlights that a correct Upstream FortiGate IP is required for the connection to be established. An incorrect IP, as implied by option A, is a valid reason for failure.

Reference for C: The guide details the authorization step: "On the root FortiGate... Go to Security Fabric > Fabric Connectors. The downstream FortiGate is listed with a status of Pending. Select the downstream FortiGate and select Authorize." This confirms that lack of authorization leaves the device in a pending state.