In FortiOS, specific administrative features are hidden by default within the Graphical User Interface (GUI) to simplify the administrative experience. To route SD-WAN traffic based on specific applications (application steering), the FortiGate relies on its Application Control engine. If the "Application Control" feature is disabled in the GUI visibility settings, the option to select an application as a destination in an SD-WAN rule will not appear. An administrator must navigate to System > Feature Visibility and toggle "Application Control" on. Once enabled, the "Application" and "Application Group" selection fields will dynamically appear in the SD-WAN rule configuration page.

A. Application-based routing is fully supported and highly recommended in Direct Internet Access (DIA) setups to intelligently steer specific SaaS or web applications over optimal ISP links.

B. FortiGate natively supports the configuration of application-based SD-WAN rules in both the Command Line Interface (CLI) and the GUI, provided the feature is set to visible.

C. You do not need to enable GUI feature visibility via the CLI. The standard and intended method to expose hidden GUI elements is through the System > Feature Visibility GUI menu.

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: System > Feature Visibility. (Details the hiding and exposing of advanced security profiles, including Application Control, in the web interface).

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: SD-WAN > SD-WAN Rules. (Documenting the prerequisite of enabling Application Control visibility to utilize application steering in priority rules).

The exhibit displays set ike-version 2, which strictly requires the remote peer to support IKEv2 negotiation. The configuration also features set mode-cfg disable, indicating the hub will not dynamically assign an IP address to the connecting spoke. Consequently, administrators must manually assign user-defined overlay IP addresses to the tunnel interfaces on both ends. To enable dynamic routing protocols to establish neighbor adjacencies over these manually assigned IP addresses, the configuration uses set exchange-interface-ip enable. This specific command is a Fortinet-proprietary feature that shares the user-defined overlay interface IP addresses between peers via IKEv2 payloads, removing the requirement for standard mode-config for IP resolution.

A. Incorrect because the set mode-cfg disable command explicitly prevents the hub from dynamically assigning or providing a tunnel interface IP address to the spoke side.

B. Incorrect because exchange-interface-ip utilizes a Fortinet-proprietary IKEv2 payload to exchange interface IP addresses, meaning the remote peer must be a compatible FortiGate, not a third-party device.

Fortinet Technologies Inc. "FortiOS 7.2 Administration Guide: IPsec VPN." Section: IKEv2 exchange-interface-ip.

Fortinet Technologies Inc. "FortiOS 7.2 CLI Reference." Section: config vpn ipsec phase1-interface.

In FortiOS, the Internet Service Database (ISDB) contains dynamically updated IP addresses, ports, and protocols for well-known cloud applications and internet services. The exhibit shows the SD-WAN rule configuration GUI where the "Internet service" field is actively available under the Destination parameters. To steer traffic specifically for Facebook and LinkedIn, the administrator can simply select these services directly from the ISDB drop-down list within the "Internet service" field. This method relies on predefined destination IP ranges rather than Layer 7 application control, providing an efficient and immediate way to route traffic for major platforms using the currently available GUI options.

A: A special license is not required to unlock destination fields in the GUI. ISDB definitions are natively integrated into FortiOS and updated via standard FortiGuard services.

C: There is no independent "feature visibility" setting specifically named "applications as destinations of the SD-WAN rule" to toggle this behavior.

D: Standalone FortiGate devices are fully capable of utilizing both internet services and applications as routing destinations within SD-WAN rules.

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: "SD-WAN Rules" -> "Creating SD-WAN rules". Document ID: 01-720-749449-20230620. (Details the configuration steps for specifying destinations using the Internet Service Database in SD-WAN rules).

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: "Policy and Objects" -> "Internet Service Database". (Explains how the ISDB maps well-known public services like Facebook and LinkedIn to specific IP addresses and ports for routing and policy enforcement).

In FortiOS SD-WAN, application steering heavily relies on the ISDB application cache for first-packet classification. The exhibits reveal that the destination IP 23.212.248.205 (shown in the FortiAnalyzer log) is absent from the internet-service-app-ctrl-list cache. Therefore, the session's 3-tuple does not match the cache, causing initial packets to bypass rule ID 1 and hit the implicit SD-WAN rule.

Furthermore, once Application Control correctly identifies the "GoToMeeting" payload later in the TCP stream, FortiOS attempts to re-evaluate the routing. However, because Source NAT (SNAT) has already been applied to the session (indicated by the snat entry in the log), FortiGate cannot dynamically refresh the routing to a new interface without breaking the established connection, forcing it to remain on the implicit rule path.

A: Full SSL inspection is not strictly required for application identification; FortiGate can reliably identify web applications by inspecting the Server Name Indication (SNI) in the TLS handshake using standard certificate inspection.

D: The CLI output for Service (1) clearly shows the "Collaboration" application group configured in the rule, which inherently encompasses the GoToMeeting application.

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: SD-WAN rules and application control. (Details the first-packet classification mechanism and dependency on the ISDB kernel cache for application routing).

Fortinet, Inc. FortiOS 7.2 Administration Guide. Section: In-line route updates and SNAT. (Explains the limitation of re-evaluating routes mid-session when Source NAT is applied to the firewall policy).

In SD-WAN priority mode (Manual mode) with a link-cost-factor configured, FortiOS evaluates the specified metric (packet loss) to choose the best link. With the link-cost-threshold set to 0, any member with the lowest packet loss is preferred. Currently, HUB1-VPN1 has the lowest packet loss (2%). If all three members experience the exact same packet loss, a tie occurs. The algorithm then applies the tie-breaker mechanism seen in the output (Tie break: cfg), reverting to the explicitly configured priority-members sequence (6 4 5). Because sequence number 6 (HUB1-VPN3) is listed first in this sequence, it has the highest configuration priority and will be chosen as the new preferred member.

Option A: Incorrect because HUB1-VPN1 and HUB1-VPN2 would tie at 4% loss (beating HUB1-VPN3's 12%). HUB1-VPN1 remains preferred over HUB1-VPN2 due to its higher priority ranking in the configuration.

Option B: Incorrect because HUB1-VPN2 would have the lowest packet loss (4%) among the members, making it the preferred member over both HUB1-VPN1 (12%) and HUB1-VPN3 (12%).

Option C: Incorrect because if HUB1-VPN3 achieves 4% loss, HUB1-VPN1 still maintains the absolute lowest packet loss at 2% and thus remains the active preferred member.

Fortinet, "FortiOS 7.2 Administration Guide," SD-WAN Rules, Section: Manual Mode and Link Cost Factor evaluation. (Document ID: FG-OS-7.2-Admin).

Fortinet NSE 7 SD-WAN 7.2 Study Guide, Chapter 4: SD-WAN Rules, section detailing "Tie break: cfg" mechanisms and Priority member sequencing.

By default, traffic originating from the FortiGate appliance itself, known as local-out traffic, does not use SD-WAN for routing. It follows the standard routing table. To leverage SD-WAN capabilities for services like FortiGuard updates, DNS queries, or management traffic, an administrator must explicitly enable it. This configuration is not global; it must be applied individually to each local-out feature or service via the command-line interface (CLI). For each service, a specific command binds it to an SD-WAN zone, which then subjects its traffic to the configured SD-WAN rules for path selection.

A. By default, no local-out traffic, including ping and traceroute, uses SD-WAN. It must be explicitly enabled for those utilities as well.

C. There is no restriction to use only the manual strategy. Once directed to an SD-WAN zone, local-out traffic can use any rule strategy, including performance-based ones.

1. Fortinet FortiOS 7.6.0 SD-WAN Administration Guide, Local-out traffic, Page 101.

The document states, "By default, local-out traffic from the FortiGate does not use SD-WAN rules for routing. You must enable SD-WAN for each service that you want to use SD-WAN." This directly supports answers B and D.

2. Fortinet FortiOS 7.6.0 CLI Reference, config system dns, Page 1038.

The set sdwan-zone command under config system dns is an example of the per-service configuration required, which supports answer D. It shows that DNS, as a specific local-out service, must be individually configured.

3. Fortinet FortiOS 7.6.0 CLI Reference, config system fortiguard, Page 1101.

Similar to the DNS configuration, the set sdwan-zone command under config system fortiguard demonstrates the requirement to enable SD-WAN for another specific local-out service (FortiGuard), reinforcing answer D.

By analyzing the SD-WAN template exhibits, we can see that SD-WAN Member 6 (Interface HUB1-VPN3) has an "Installation Target" restricted to only two devices: branch2_fgt and branch3_fgt. The provided CLI output for the diagnose sys sdwan member command lists members 4, 5, 7, 8, and 9, but explicitly lacks member 6. Because member 6 is configured to be installed on branches 2 and 3, its absence in the CLI output confirms that the device being queried cannot be branch2_fgt or branch3_fgt. Therefore, the output must have been collected from branch1_fgt, which receives the other template members but is appropriately excluded from member 6.

Option A: The flags=0xd value indicates the interface is active (0x1), valid (0x4), and alive (0x8), meaning the members are functioning normally, not dead.

Option B: The output directly corresponds to the expected SD-WAN member configuration pushed to branch1_fgt via the FortiManager template.

Option C: If the output were collected from branch2_fgt, Member 6 (HUB1-VPN3) would be visible in the list because it is an explicit installation target for that device.

Fortinet, "FortiManager 7.2 Administration Guide," SD-WAN Configuration, section "Assigning SD-WAN members and Installation Targets".

Fortinet, "FortiOS 7.2 CLI Reference," System Diagnostics Commands, section "diagnose sys sdwan member," 2023.

Fortinet, "FortiOS 7.2 Administration Guide," SD-WAN Troubleshooting, section "Understanding SD-WAN member flags".

The exhibit shows that the traffic's source IP (10.0.1.130) falls within the 10.0.1.128/255.255.255.128 subnet, and the destination IP (128.66.0.125) falls within the 128.66.0.0/255.255.255.0 subnet. This means the traffic explicitly matches the standard router policy configured under edit 1. The action for this policy route is set to deny. In FortiOS architecture, configuring a policy route with a deny action does not drop the traffic. Instead, it instructs the routing engine to halt policy route evaluation—effectively bypassing all subsequent policy routes and SD-WAN rules—and forces the FortiGate to route the traffic using standard static or dynamic routes found in the active routing table, which is the Forwarding Information Base (FIB).

A. FortiGate drops the traffic flow. Setting a deny action in a policy route stops policy-based routing evaluation; it does not drop the packet. Packet dropping is exclusively handled by firewall policies.

C. FortiGate load balances the traffic flow through port7 and port8. Because the traffic matches the standard deny policy route, it bypasses SD-WAN rule evaluation entirely, preventing SD-WAN load balancing algorithms from processing the flow.

D. FortiGate steers the traffic flow through port7. The deny action in the matched standard policy route preempts all SD-WAN rule processing. Therefore, traffic will not be steered by any configured SD-WAN service members or SLAs.

Fortinet, Inc. FortiOS 7.4 Administration Guide. "Routing > Policy routing." Document ID: FG-OS-74-Admin. (Specifies that the deny action tells the FortiGate to stop checking policy routes and route based on the regular routing table).

Fortinet, Inc. SD-WAN Architecture for Enterprise. "Traffic Steering > Policy Routes and SD-WAN Rules." (Details the precedence of standard policy routes over SD-WAN rules and the behavior of fall-through mechanisms to the FIB).

A. The cloud on-ramp topology is specifically designed to enhance the performance of cloud-based applications (SaaS and IaaS). It achieves this by intelligently steering traffic to the nearest and best-performing cloud point of presence (PoP) or VPC/VNet, which reduces latency and improves the overall user experience.

B. A standalone SD-WAN design refers to a site that is managed locally rather than being part of a larger, centrally managed topology like hub-and-spoke. For a site with the constraint of only one WAN link, the primary SD-WAN benefits of multi-path intelligence are unavailable. In such a scenario, a complex hub-and-spoke configuration is often unnecessary, making a simpler, standalone deployment a practical choice for basic connectivity and local security.

C. Remote breakout, also known as Direct Internet Access (DIA), decentralizes traffic inspection to the branch level, which is the opposite of centralizing it. Centralized inspection occurs when traffic is backhauled to a hub.

D. A Direct Internet Access (DIA) design increases the local attack surface and therefore requires a robust, full-featured security device at the branch, not one with limited capabilities, to inspect traffic locally.

1. Fortinet SD-WAN Design and Deploy 7.6 - Study Guide, Page 10, "Cloud On-Ramp": "The cloud on-ramp use case is about providing better, more reliable, and faster access to cloud applications. It does this by connecting branches to the cloud through the closest point of presence (PoP)." This directly supports option A.

2. Fortinet SD-WAN Architecture Guide 7.6, Section "Use Case: Secure SD-WAN for Multi-Cloud (Cloud On-Ramp)": This section details how the solution "optimizes application performance and provides consistent security posture" for cloud-hosted applications, reinforcing the purpose described in option A.

3. Fortinet SD-WAN Design and Deploy 7.6 - Study Guide, Page 9, "Local Breakout": "Local breakout, also known as direct internet access (DIA), is when you send traffic destined for the internet directly out of the branch's local internet connection... This approach requires a full security stack at the branch..." This statement directly contradicts options C and D, confirming they are incorrect.

4. Fortinet SD-WAN Design and Deploy 7.6 - Study Guide, Page 8, "Basic SD-WAN Deployment": The guide states, "In its most basic form, SD-WAN can be deployed on a single FortiGate with two or more WAN links." This implies that having only one link is a constraint where full SD-WAN benefits are not realized, making a simple standalone deployment (as described in option B) a logical choice for such a limited scenario.

The SD-WAN rule "Critical-DIA" (ID 1) is configured with set mode sla, which corresponds to the Lowest Cost (SLA) steering strategy. In this mode, FortiGate evaluates the interfaces defined in the priority-members list (1 then 2) in their specific order. It selects the first member in that list that currently meets the targets of the assigned Performance SLA (Corp_HC, SLA ID 1). The provided SD-WAN event log explicitly states that Member 1 (identified as port1 in the member status exhibit) has changed to "out-of-sla" for SLA Target ID 1. Consequently, FortiGate bypasses port1 and selects the next configured member in the priority list, which is Member 2 (port2), to steer the traffic.

A. FortiGate skips SD-WAN rule ID 1. FortiGate only skips a rule if the traffic packet does not match the rule's criteria; here, the rule is valid and has a secondary member available.

C. FortiGate uses port1 to steer the traffic for SD-WAN rule ID 1. The mode sla strategy requires the member to meet SLA targets; the event log confirms port1 is currently "out-of-sla," disqualifying it as the primary choice.

D. FortiGate uses port1 or port2 to steer the traffic for SD-WAN rule ID 1. The "Lowest Cost (SLA)" strategy is not a load-balancing mode; it follows a strict priority sequence and selects only one compliant member at a time.

Fortinet Documentation Library. FortiOS 7.4.0 Administration Guide: SD-WAN rules. Section: "Lowest cost (SLA) strategy".

Fortinet Training Institute. NSE 7 Network Security Architect: SD-WAN 7.2 Study Guide. pp. 108-114. (Detailed explanation of SLA-based member selection and priority-member ordering).