According to Fortinet's official SD-WAN architecture and deployment guidelines, it is a critical best practice to use dedicated FortiGate devices for the hub role. Hubs are central to the topology, handling a high volume of traffic and numerous VPN tunnels. To ensure the stability, performance, and availability of the SD-WAN fabric, hub FortiGates should not be burdened with managing extensions like FortiSwitch, FortiAP, or FortiExtender. Spoke devices, which have a smaller operational scope, can be deployed with these extensions. Therefore, a single SD-WAN topology can be built, but the hubs must be devices without extensions.

A: This is incorrect. Fortinet best practices explicitly advise against using FortiGate devices with extensions as hubs to maintain performance and stability for the core SD-WAN functions.

C: This is incorrect. While FortiManager is highly recommended for scalable management of SD-WAN, it is not a mandatory requirement. SD-WAN can be configured and managed locally on FortiGate devices.

D: This is incorrect. There is no architectural limitation that requires separate SD-WAN topologies for different extension types. Spokes with various extensions can participate in the same topology.

1. Fortinet. (2024). Secure SD-WAN for FortiOS 7.4 Study Guide. Fortinet Training Institute.

In the module covering SD-WAN Architecture

it is specified that "The hub FortiGate devices should be dedicated to the SD-WAN hub role and should not have any extensions

such as FortiSwitch

FortiAP

or FortiExtender. The spoke FortiGate devices can have extensions." This directly supports the correct answer and refutes option A.

2. Fortinet. (2024). FortiOS 7.4.0 SD-WAN Architecture Guide. Fortinet Document Library.

In the "Deployment considerations" chapter

the section on "Hubs" emphasizes that hubs are critical components and should be sized appropriately for performance. The guide implicitly supports dedicating the device to this core function

which aligns with not adding peripheral management tasks like FortiSwitch or FortiAP control.

3. Fortinet. (2024). FortiOS 7.4.0 Administration Guide. Fortinet Document Library.

The "SD-WAN" section details the configuration steps which can be performed directly on the FortiOS GUI or CLI

demonstrating that FortiManager is not a prerequisite for functionality

thus refuting option C.