The network topology explicitly shows an ADVPN (Auto-Discovery VPN) setup where FortiSASE functions as a spoke. When a remote user accesses a resource on Branch-2 (another spoke), the initial traffic is routed to HUB-2 based on the configured static route. Upon receiving this spoke-to-spoke traffic, HUB-2, as the ADVPN hub, facilitates the creation of a dynamic, on-demand "shortcut" tunnel directly between the FortiSASE security PoP and the Branch-2 FortiGate. A new, more specific route for this path is dynamically installed in the routing tables of both spokes. All subsequent traffic then flows directly over this shortcut, bypassing the hub. Therefore, the ultimate routing mechanism uses a dynamic route for a direct path, as enabled by the ADVPN protocol.

A: This describes only the initial traffic path before the ADVPN shortcut is established. It fails to account for the primary, optimized routing function of ADVPN.

B: The static route shown in the exhibit directs traffic to the hub (HUB-2), not directly to the branch. The direct path is established dynamically, not statically.

C: The static route in the exhibit clearly specifies the gateway for the Branch-2 network is HUB-2 (10.2.0.1), not HUB-1.

1. FortiSASE Administration Guide: In the section on Secure Private Access

the guide details integration with FortiGate secure SD-WAN. It states

"When a spoke (including FortiSASE) needs to send traffic to another spoke

it initially sends the traffic to the hub. The hub forwards the traffic...and also facilitates the two spokes to establish a dynamic IPsec tunnel

called a shortcut tunnel

between them. Subsequent traffic between the spokes flows through the shortcut tunnel

bypassing the hub." This confirms the process of initial routing via the hub

followed by the creation of a direct

dynamic path. (Search for "ADVPN" and "shortcut tunnel" in the FortiSASE Administration Guide for the relevant version).

2. FortiOS Administration Guide (SD-WAN Section): The ADVPN chapter explains that shortcut tunnels are created on-demand and that routes for these shortcuts are dynamically added to the routing table. This confirms that the route for the direct path described in the correct answer is dynamic. (Refer to the "ADVPN" section in the FortiOS Handbook).