In Fortinet SD-WAN, the architecture is composed of an underlay and an overlay network. The underlay consists of the physical transport networks (e.g., MPLS, Internet). The overlay is a virtual network built on top of the underlay, using tunnels to connect SD-WAN locations. These tunnels are the "overlay links." FortiGate devices primarily use IPsec tunnels to create a secure, encrypted overlay fabric. Additionally, GRE (Generic Routing Encapsulation) tunnels can also be configured as SD-WAN members to function as overlay links, often used in scenarios requiring multicast traffic support over the SD-WAN.

A. LAG: A Link Aggregation Group (LAG) is an underlay technology that bundles multiple physical interfaces to increase bandwidth and provide redundancy. It is not an overlay tunnel.

C. Physical: A physical interface is a hardware port on the FortiGate that connects directly to the underlay network. It provides the transport path for the overlay, but is not the overlay link itself.

1. Fortinet FortiOS 7.0.2 SD-WAN Architecture for Enterprise Guide, Page 10, "Overlay and underlay networks". The document states, "The SD-WAN overlay is a virtual network built on top of underlay networks. The overlay consists of the tunnels that are established between the SD-WAN members." A diagram on the same page explicitly labels "IPsec Tunnels (Overlay)" running over "Underlay Networks".

2. Fortinet FortiOS 7.0.0 Administration Guide, "SD-WAN" chapter, "SD-WAN members" section. This section describes the interfaces that can be added as SD-WAN members. While it includes physical interfaces (for direct internet access), the context of inter-site connectivity, which defines the overlay, is achieved through tunnel interfaces like IPsec and GRE. The configuration examples for building the overlay consistently use IPsec tunnels.

3. Fortinet FortiOS 7.0.0 Cookbook, "Basic SD-WAN deployment" section. This guide demonstrates the standard procedure for building an SD-WAN overlay, which involves creating IPsec VPN tunnels between sites and then adding these tunnel interfaces as members to the SD-WAN interface. This confirms IPsec as a primary overlay link type.