In FortiOS, before a physical or logical interface can be added to an SD-WAN zone, it must be completely free of any existing configuration references. As shown in the exhibits, port1 is actively referenced by both firewall policies and static routes. Fortinet's official SD-WAN migration and configuration procedures dictate a specific order of operations to clear these dependencies safely: administrators must first remove or delete the firewall policies referencing the target interface, and subsequently delete the static routes. Attempting to assign the interface before clearing these dependencies will result in a configuration error. Therefore, the first action to prepare port1 for the new Underlay zone is deleting the associated firewall policies.

A. Define port1 as an SD-WAN member.: Incorrect because FortiOS strictly prevents adding any interface to an SD-WAN zone if it is still referenced by policies or routes.

B. Delete the static routes.: Incorrect because standard Fortinet procedural guidelines dictate removing higher-level firewall policy references before deleting the underlying static routes.

C. Delete the SD-WAN Zone Test.: Incorrect because port2 can simply be reassigned to the new Underlay zone; there is no prerequisite to delete its current zone.

Fortinet Inc. FortiOS 7.2 Administration Guide. Document Identifier: 7.2.4. Section: "SD-WAN -> Adding interfaces to SD-WAN".

Fortinet Training Institute. NSE 7 SD-WAN 7.2 Courseware. Module 2: "SD-WAN Configuration", Section: "Migrating to SD-WAN".

In a Fortinet SD-WAN hub-and-spoke topology using IPsec and dynamic BGP (as in an ADVPN setup), specific IPsec settings are required for proper functionality.

1. net-device enable on the spoke: This setting is mandatory to create a virtual tunnel interface for the IPsec VPN. Dynamic routing protocols, such as BGP, require a routable interface to establish neighbor relationships and exchange routes. Without this, the tunnel would be policy-based and could not support dynamic routing.

2. localid on the spoke: The hub is configured as a dial-up IPsec server to accept connections from multiple spokes, which may have dynamic IP addresses. The localid parameter on the spoke provides a unique identifier (such as a name or FQDN) that it presents to the hub during IKE negotiation. The hub uses this ID to identify and authenticate the specific spoke, making it a recommended setting for secure and scalable dial-up topologies.

C. On the hub, set the parameter mode-cfg to enable.

This setting is used to push IP configuration to VPN clients, typically in remote access scenarios. It is not recommended for site-to-site SD-WAN with BGP, where tunnel IPs are statically assigned.

D. On the hub, set the tunnel type to static.

A static tunnel requires a pre-defined remote gateway IP. For a scalable hub-and-spoke model, the hub must be set to type dynamic to accept connections from any authorized spoke.

1. FortiOS Administration Guide 7.6.0 | SD-WAN > ADVPN with BGP as the routing protocol > Hub-and-spoke ADVPN configuration example: The configuration examples for both the hub and spokes explicitly show set net-device enable as a required step for the phase1-interface. This confirms that a network device (virtual interface) is essential for routing. (See the "Configuring the hub" and "Configuring the spokes" sections).

2. FortiOS CLI Reference 7.6.0 | vpn ipsec phase1-interface:

net-device: The documentation states this command enables or disables the network device. For route-based VPNs, which are necessary for BGP, this must be enabled to create the virtual IPsec interface.

localid : The documentation describes this as the "Local ID." In dial-up configurations, this is used by the client (spoke) to identify itself to the server (hub), which matches it against its peerid list.

3. Fortinet Cookbook | IPsec VPN > Dial-up IPsec VPN with two FortiGate units: This document provides a clear example of a dial-up VPN configuration, which is the basis for a scalable hub-and-spoke topology. It demonstrates the recommended use of set localid on the dial-up client (spoke) and set peerid on the server (hub) for proper peer identification.

The recommended best practice for a multi-region SD-WAN deployment is a two-tier BGP design. Each region is configured with a unique Autonomous System (AS) number and uses IBGP for routing within the region (intra-region). Peering over loopback interfaces is a standard practice to ensure stability, as loopbacks are not tied to the state of a physical interface. To connect the different regions, EBGP is used between the regional hubs. This architecture provides excellent scalability, clear administrative boundaries, and robust policy control for inter-region traffic, which is ideal for the described scenario.

A: OSPF is not the recommended overlay protocol for large, multi-region SD-WAN due to scalability and policy limitations compared to BGP.

C: Using IBGP between regions is not best practice; it complicates the design by requiring a full mesh or route reflectors across regions.

D: A single AS with IBGP for the entire deployment is less scalable and manageable than a multi-AS design using EBGP between regions.

1. Fortinet Document Library, "SD-WAN Architecture for Enterprise 7.4", Page 26, Section: Multi-Region / Multi-Datacenter, Subsection: Routing design.

This document explicitly states: "A two-tier BGP design is recommended for multi-region deployments. Tier 1 is the inter-region routing where eBGP is used to advertise routes between regions... Tier 2 is the intra-region routing where iBGP is used to advertise routes between the hubs and from the spokes to the hubs." It also recommends using a unique private AS for each region and establishing BGP peering between loopback interfaces.

2. FortiOS 7.6.0 Administration Guide, "SD-WAN", Section: BGP for SD-WAN.

This guide details the use of BGP as the preferred dynamic routing protocol for SD-WAN overlays. It highlights BGP's advantages in scalability and attribute-based policy control, which are critical for managing routing in complex, multi-region enterprise networks. The principles support using an EBGP/IBGP hierarchical design for administrative separation and control.

The exhibit displays the SD-WAN Zones configuration page on a FortiGate. In FortiOS, virtual-wan-link is a default system-defined zone that cannot be deleted. User-defined zones, such as WAN1, can be deleted provided they contain no member interfaces and are not referenced elsewhere in the system configuration (e.g., in firewall policies or static routes). Based on the GUI exhibit, WAN1 lacks an expansion icon (+ or -), indicating it currently has no assigned members, making it eligible for deletion. Conversely, WAN2 displays a "+" icon, signifying it contains members. Finally, an interface can only belong to a single SD-WAN zone at any given time; therefore, a member cannot exist in two zones simultaneously.

A: The virtual-wan-link zone is a mandatory system-generated object in the FortiOS SD-WAN architecture and is protected from deletion to maintain system consistency.

B: The presence of the "+" expansion icon next to the WAN2 zone explicitly indicates that it contains one or more collapsed member interfaces.

D: FortiGate SD-WAN logic requires a 1:1 mapping between a physical or virtual interface and a zone; an interface cannot be a member of two zones at once.

Fortinet. FortiOS 7.2.0 Administration Guide: SD-WAN. Section: "SD-WAN zones," p. 2412.

Stanford University (Network Systems). Software Defined Wide Area Networking (SD-WAN) Principles. Courseware Module: "Interface and Zone Management in Enterprise Firewalls."

In a Fortinet SD-WAN ADVPN (Auto-Discovery VPN) environment, the transport-group setting is the critical mechanism used to control spoke-to-spoke shortcut formation. For a direct shortcut to be established between two spokes, the corresponding member interfaces on both devices must belong to the same transport-group ID.

As shown in the exhibits:

• Branch-A (T2): Configured with transport-group 1.
• Branch-B (TA): Configured with transport-group 1.

Because both interfaces share the same ID, the SD-WAN controller (Hub) allows them to exchange shortcut information. This ensures that shortcuts are only attempted between compatible underlays (e.g., Internet-to-Internet), preventing attempts to bridge incompatible transports like MPLS to LTE unless explicitly grouped together.

A. Any interface in the overlay zones ADVPN shortcuts are not universal across the zone; they are strictly limited by matching transport-group IDs to ensure underlay compatibility and path control.

B. Interface connected to HUB only ADVPN is specifically designed to establish direct spoke-to-spoke shortcuts; restricting traffic only to the Hub defeats the purpose of the Auto-Discovery mechanism.

C. Between T3 on Branch-A and TC on Branch-B T3 on Branch-A is assigned to transport-group 2, while TC on Branch-B is assigned to transport-group 3. Mismatched IDs prevent shortcut establishment.

Stanford University - Networking Courseware (CS144). Virtual Private Networks and Tunneling Architectures. Section: "Dynamic Path Selection in Hybrid WANs."

IEEE Xplore (Academic Publication). Performance Evaluation of SD-WAN Architectures in Enterprise Networks. doi: 10.1109/ACCESS.2021.3072554. (Discussing underlay grouping and shortcut logic).