Refer to the exhibits. Exhibit A https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Fortinet_NSE7_SDW-7.2/page_45_img_1.jpg Exhibit B https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/Fortinet_NSE7_SDW-7.2/page_45_img_2.jpg Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate. Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if the administrator increases the static route priority on port2 to 20? (Choose two.)

FortiGate flags the sessions as dirty.

Question 14 - Fortinet NSE7_SDW-7.2 Real Exam Questions [Jan 2026 Update]

Q: 14

Refer to the exhibits. Exhibit A

Exhibit B

Exhibit A shows the source NAT (SNAT) global setting and exhibit B shows the routing table on FortiGate. Based on the exhibits, which two actions does FortiGate perform on existing sessions established over port2, if the administrator increases the static route priority on port2 to 20? (Choose two.)

Options

Correct Answer:

A, D

Explanation

The snat-route-change setting is enabled, which dictates how FortiGate handles existing sessions when a routing change occurs. The priority of the static route for port2 is increased to 20, making the route via port1 (priority 0) the preferred path for the default route.

Because snat-route-change is enabled, FortiGate will re-evaluate the existing sessions that were using port2. These sessions are first flagged as dirty. A new route lookup is then performed, which identifies port1 as the new best egress interface. Consequently, the session's gateway and SNAT information are updated to redirect the traffic through port1, ensuring session continuity over the new optimal path.

Why Incorrect

B. FortiGate continues routing the sessions with no SNAT, over port2.

This is incorrect because the enabled snat-route-change feature specifically triggers a re-evaluation and rerouting of sessions when the best route changes.

C. FortiGate performs a route lookup for the original traffic only.

This is incomplete. While a route lookup occurs, the key actions are flagging the session as dirty and updating its attributes for both directions of traffic.

References

1. Fortinet Knowledge Base, Article ID: FD36126, Technical Tip: Behavior of snat-route-change option in 'config system global'. This article explicitly states: "When this option is enabled, if the route for the SNAT IP is changed, the sessions are not flushed but are marked as dirty and are rerouted." This directly supports answers A and D.

2. FortiOS 7.2.1 Administration Guide, Session failover, Page 1231. The guide explains that for session failover to work when a link fails, sessions must be rerouted. The snat-route-change command is a key part of this process, forcing the re-evaluation of sessions that require SNAT.

3. FortiOS 7.2 CLI Reference, config system global, Page 2018. The description for snat-route-change is "Enable/disable flushing sessions when the source NAT route changes." While the term "flushing" can be ambiguous, in this context, it refers to the re-evaluation process where sessions are marked dirty and updated, as clarified by the Knowledge Base articles.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE