In FortiOS, before a physical or logical interface can be added to an SD-WAN zone, it must be completely free of any existing configuration references. As shown in the exhibits, port1 is actively referenced by both firewall policies and static routes. Fortinet's official SD-WAN migration and configuration procedures dictate a specific order of operations to clear these dependencies safely: administrators must first remove or delete the firewall policies referencing the target interface, and subsequently delete the static routes. Attempting to assign the interface before clearing these dependencies will result in a configuration error. Therefore, the first action to prepare port1 for the new Underlay zone is deleting the associated firewall policies.

A. Define port1 as an SD-WAN member.: Incorrect because FortiOS strictly prevents adding any interface to an SD-WAN zone if it is still referenced by policies or routes.

B. Delete the static routes.: Incorrect because standard Fortinet procedural guidelines dictate removing higher-level firewall policy references before deleting the underlying static routes.

C. Delete the SD-WAN Zone Test.: Incorrect because port2 can simply be reassigned to the new Underlay zone; there is no prerequisite to delete its current zone.

Fortinet Inc. FortiOS 7.2 Administration Guide. Document Identifier: 7.2.4. Section: "SD-WAN -> Adding interfaces to SD-WAN".

Fortinet Training Institute. NSE 7 SD-WAN 7.2 Courseware. Module 2: "SD-WAN Configuration", Section: "Migrating to SD-WAN".