:

The FortiGate VPN event logs clearly show the establishment of ADVPN shortcut tunnels. The log message msg="IPsec ADVPN shortcut is up" tunnel="TMPLS0" shortcutname="TMPLS00" is explicit. According to the FortiGate log message reference, the tunnel field identifies the parent (master) tunnel, and the shortcutname field identifies the dynamically created shortcut tunnel. Therefore, TMPLS0 is the master tunnel from which one shortcut, named TMPLS00, has been successfully built.

A. The logs contain msg="IPsec tunnel statistics" for tunnelname="TMPLS00" and tunnelname="TINET00", which are the ADVPN shortcut tunnels, disproving this statement.

C. The logs identify TMPLS0 as the master tunnel in the tunnel="TMPLS0" field, while TMPLS00 is explicitly named as the shortcut.

D. The log message msg="IPsec ADVPN shortcut is up" ... tunnel="TINET0" directly confirms that the master tunnel TINET0 successfully negotiated and established an ADVPN shortcut.

1. FortiGate / FortiOS 7.2.0 Log Message Reference, Page 321, Log ID 0101039947.

This document defines the fields for the "IPsec ADVPN shortcut is up" message. It specifies:

tunnel: "Name of the parent tunnel."

shortcutname: "Name of the shortcut tunnel."

This directly supports the explanation that TMPLS0 is the master (parent) and TMPLS00 is the shortcut.

2. FortiOS 7.2.4 Administration Guide, Page 1311, "Monitoring ADVPN".

The guide explains how to monitor ADVPN tunnels. In the output of the command diagnose vpn tunnel list, shortcut tunnels are shown with a suffix (e.g., 0) appended to the master tunnel's name and are identified as dynamic. This confirms the naming convention seen in the logs.

3. SD-WAN 7.2 Study Guide, Page 218, "ADVPN Troubleshooting".

This guide describes the ADVPN shortcut negotiation process. It states, "When a shortcut is created, FortiGate creates a new IPsec phase 1 and phase 2. The new interface name is derived from the original phase 1 name with a number appended to it." This confirms that tunnels like TMPLS00 are the dynamically created shortcuts.

The SD-WAN rule is configured to use the Best Quality strategy, with SLAJitter as the measured criterion. This strategy operates in two steps: first, it identifies all member interfaces that meet the configured SLA target; second, from that filtered list, it selects the single best interface based on the quality metric (lowest jitter).

According to Exhibit B, only the TINET10 interface meets the SLA requirements (SLA Met: Yes). The other two interfaces, TINET00 and TMPLS0, do not meet the SLA (SLA Met: No). Therefore, they are not considered eligible paths. As TINET10 is the only member that satisfies the SLA, FortiGate will route all traffic matching this rule through it.

A: The Best Quality strategy selects a single optimal path based on the defined metric; it does not perform load balancing across multiple overlays.

B: TINET00 is not selected because it fails to meet the SLA target, making it an ineligible path for this rule.

C: TMPLS0 is not selected because it fails to meet the SLA target, making it an ineligible path for this rule.

1. Fortinet NSE 7 SD-WAN 7.2 Study Guide, Chapter: "SD-WAN Rules", Section: "Rule Steering Behavior". The guide explains that for the Best Quality strategy, "FortiGate first checks which members meet the SLA target, and then chooses the best one among them based on the link cost." This confirms that members failing the SLA are not considered for selection.

2. FortiOS 7.2 Administration Guide, Section: "SD-WAN > SD-WAN Rules". The documentation states for the Best Quality strategy: "FortiGate sends all traffic to the link with the best quality... If the best link goes down or does not meet the health-check SLA, FortiGate sends traffic to the next best link." This implies that meeting the SLA is a prerequisite for being considered the "best link".

The snat-route-change setting is enabled, which dictates how FortiGate handles existing sessions when a routing change occurs. The priority of the static route for port2 is increased to 20, making the route via port1 (priority 0) the preferred path for the default route.

Because snat-route-change is enabled, FortiGate will re-evaluate the existing sessions that were using port2. These sessions are first flagged as dirty. A new route lookup is then performed, which identifies port1 as the new best egress interface. Consequently, the session's gateway and SNAT information are updated to redirect the traffic through port1, ensuring session continuity over the new optimal path.

B. FortiGate continues routing the sessions with no SNAT, over port2.

This is incorrect because the enabled snat-route-change feature specifically triggers a re-evaluation and rerouting of sessions when the best route changes.

C. FortiGate performs a route lookup for the original traffic only.

This is incomplete. While a route lookup occurs, the key actions are flagging the session as dirty and updating its attributes for both directions of traffic.

1. Fortinet Knowledge Base, Article ID: FD36126, Technical Tip: Behavior of snat-route-change option in 'config system global'. This article explicitly states: "When this option is enabled, if the route for the SNAT IP is changed, the sessions are not flushed but are marked as dirty and are rerouted." This directly supports answers A and D.

2. FortiOS 7.2.1 Administration Guide, Session failover, Page 1231. The guide explains that for session failover to work when a link fails, sessions must be rerouted. The snat-route-change command is a key part of this process, forcing the re-evaluation of sessions that require SNAT.

3. FortiOS 7.2 CLI Reference, config system global, Page 2018. The description for snat-route-change is "Enable/disable flushing sessions when the source NAT route changes." While the term "flushing" can be ambiguous, in this context, it refers to the re-evaluation process where sessions are marked dirty and updated, as clarified by the Knowledge Base articles.

FortiGate keeps the session table intact when a firewall-policy entry is edited. Packets that belong to sessions already present in the session table continue to match the policy that was in effect when the session was first created, so those sessions are not reset or re-evaluated (option C). Only traffic that triggers the creation of a new session is examined against the updated policy set; therefore the new or modified rules are applied only to new sessions (option D).

A. FortiGate flushes all sessions – Session table is retained; flush occurs only with an explicit diagnose sys session clear command.

B. FortiGate terminates the old sessions – Existing sessions remain active until they age out or are closed normally; no automatic teardown follows a policy edit.

1. Fortinet, “FortiOS 7.2 Administration Guide – Firewall Policy, Changing firewall policies,” p. 339-340: “Changes do not affect sessions already in the session table; new sessions are evaluated against the new policy set.”

2. Fortinet KB Article FD30165 “How does a change to a firewall policy affect existing sessions?” (2022): para 2 “Existing sessions continue untouched; only new sessions are matched against the revised policy.”

3. Fortinet NSE7 SD-WAN 7.2 Study Guide (official), Module 3 “Session Management,” slide 18: “Policy edits are forward-looking; current sessions stay bound to their original rule.”