Before an interface can be added as a member of an SD-WAN zone, all existing configuration references to that interface must be removed. Exhibit B shows that port1 is explicitly used as the Outgoing Interface in firewall policy ID 1. This reference is a blocking condition that prevents port1 from being added to the SD-WAN zone. The firewall policy must be deleted and later recreated using the new SD-WAN zone as the outgoing interface.

A. port1 is assigned a manual IP address.

This is incorrect. Interfaces configured with static (manual) IP addresses can be added as SD-WAN members without issue; this is a common configuration method.

C. port2 is referenced in a static route.

This statement is also factually correct and represents another blocking issue. However, the question asks for an issue, and the firewall policy reference for port1 is a critical and equally valid blocking condition shown in the exhibits.

D. port1 and port2 are not administratively down.

This is incorrect. For an interface to be an active member of an SD-WAN zone and pass traffic, it must be administratively up.

1. FortiOS 7.2.0 Administration Guide:

In the "SD-WAN" section, under "Basic configuration," the guide states: "Interfaces cannot be assigned to SD-WAN if they are used in the FortiGate configuration, for example, in a policy or static route." This confirms that both firewall policy references (Option B) and static route references (Option C) are blocking conditions.

2. SD-WAN 7.2 Study Guide:

In the "SD-WAN Members" chapter, page 13, it is explicitly mentioned: "Before you can add an interface as an SD-WAN member, you must remove all references to it. This includes references in firewall policies, static routes, and DHCP." This supports the reasoning that the firewall policy reference shown in Exhibit B for port1 is a valid issue.