By default, traffic originating from the FortiGate appliance itself, known as local-out traffic, does not use SD-WAN for routing. It follows the standard routing table. To leverage SD-WAN capabilities for services like FortiGuard updates, DNS queries, or management traffic, an administrator must explicitly enable it. This configuration is not global; it must be applied individually to each local-out feature or service via the command-line interface (CLI). For each service, a specific command binds it to an SD-WAN zone, which then subjects its traffic to the configured SD-WAN rules for path selection.

A. By default, no local-out traffic, including ping and traceroute, uses SD-WAN. It must be explicitly enabled for those utilities as well.

C. There is no restriction to use only the manual strategy. Once directed to an SD-WAN zone, local-out traffic can use any rule strategy, including performance-based ones.

1. Fortinet FortiOS 7.6.0 SD-WAN Administration Guide, Local-out traffic, Page 101.

The document states, "By default, local-out traffic from the FortiGate does not use SD-WAN rules for routing. You must enable SD-WAN for each service that you want to use SD-WAN." This directly supports answers B and D.

2. Fortinet FortiOS 7.6.0 CLI Reference, config system dns, Page 1038.

The set sdwan-zone command under config system dns is an example of the per-service configuration required, which supports answer D. It shows that DNS, as a specific local-out service, must be individually configured.

3. Fortinet FortiOS 7.6.0 CLI Reference, config system fortiguard, Page 1101.

Similar to the DNS configuration, the set sdwan-zone command under config system fortiguard demonstrates the requirement to enable SD-WAN for another specific local-out service (FortiGuard), reinforcing answer D.