In FortiOS SD-WAN, application steering heavily relies on the ISDB application cache for first-packet classification. The exhibits reveal that the destination IP 23.212.248.205 (shown in the FortiAnalyzer log) is absent from the internet-service-app-ctrl-list cache. Therefore, the session's 3-tuple does not match the cache, causing initial packets to bypass rule ID 1 and hit the implicit SD-WAN rule.

Furthermore, once Application Control correctly identifies the "GoToMeeting" payload later in the TCP stream, FortiOS attempts to re-evaluate the routing. However, because Source NAT (SNAT) has already been applied to the session (indicated by the snat entry in the log), FortiGate cannot dynamically refresh the routing to a new interface without breaking the established connection, forcing it to remain on the implicit rule path.

A: Full SSL inspection is not strictly required for application identification; FortiGate can reliably identify web applications by inspecting the Server Name Indication (SNI) in the TLS handshake using standard certificate inspection.

D: The CLI output for Service (1) clearly shows the "Collaboration" application group configured in the rule, which inherently encompasses the GoToMeeting application.

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: SD-WAN rules and application control. (Details the first-packet classification mechanism and dependency on the ISDB kernel cache for application routing).

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: In-line route updates and SNAT. (Explains the limitation of re-evaluating routes mid-session when Source NAT is applied to the firewall policy).