FortiGate's SD-WAN Performance SLA feature allows for sophisticated health checks that go beyond simple connectivity tests. For application-layer protocols like HTTP and DNS, the health check can be configured to validate the content of the server's response. An HTTP health check can be set to look for a specific string in the server's reply, confirming the web service is returning the expected content. Similarly, a DNS health check can be configured to verify that the DNS server's response contains a specific, expected IP address for the queried domain. This ensures the service is not only reachable but also functioning correctly.

B. icmp: ICMP (ping) health checks only confirm layer 3 reachability and measure round-trip time. They do not have the capability to inspect any application-layer data in a response.

C. twamp: TWAMP (Two-Way Active Measurement Protocol) is designed to measure network performance metrics like round-trip delay, jitter, and packet loss. It does not analyze application-layer server responses.

1. FortiOS 7.0.0 Administration Guide - SD-WAN:

In the section on Performance SLA, the guide details the configuration of different health check modes. For the HTTP mode, it describes the http-match option, which is used to "Enter a text string that should be present in the HTTP response from the server." For the DNS mode, it describes the dns-match-ip option, which is used to "Enter an IP address that the DNS server should return." (See chapter on "Performance SLA", section "Health Check").

2. FortiOS 7.0.0 CLI Reference:

Under config system sdwan -> config health-check, the parameters for different modes are listed.

For set mode http, the option set http-match is available to "Response string to match."

For set mode dns, the option set dns-match-ip is available to "DNS match IP."

The ping (ICMP) and twamp modes do not have equivalent parameters for matching response content. (See config health-check in the CLI reference).