Based on the provided exhibits, FortiSASE leverages its SD-WAN integration to route traffic to internal networks via Secure Private Access (SPA). The "Priority settings" exhibit explicitly demonstrates that HUB-1 is configured with the highest priority (P1) for the designated region, whereas HUB-2 holds a secondary priority (P2). Consequently, FortiSASE's SD-WAN routing engine will direct traffic destined for Branch-2 toward the primary path, HUB-1. Once the traffic reaches HUB-1, the hub’s internal routing table forwards the packets across the existing overlay network to the target spoke, Branch-2. FortiSASE does not negotiate direct IPsec/ADVPN shortcuts directly to branch spokes for remote user traffic.

A: Incorrect because the priority settings exhibit shows HUB-2 assigned a lower priority (P2) than HUB-1. SD-WAN logic will select the highest priority path first.

B: Incorrect because FortiSASE relies on the SD-WAN hub-and-spoke topology for Secure Private Access and does not initiate direct ADVPN shortcut tunnels to branch spokes using static routes.

D: Incorrect because FortiSASE does not utilize ADVPN dynamic routing protocols to establish direct, spontaneous shortcuts to branch locations; traffic must transit the designated Hubs.

Fortinet, Inc. (2023). FortiSASE Administration Guide. Section: "Secure Private Access (SPA) - Hub-and-spoke architecture". This document details how FortiSASE Security Points-of-Presence (PoPs) act as spokes and rely on hub prioritization to route traffic to corporate networks.

Fortinet, Inc. (2023). FortiOS 7.2 Secure SD-WAN Architecture Guide. Section: "SD-WAN Rules and BGP Route Prioritization". Explains the mechanics of how priority tags (P1, P2) in SD-WAN deployments dictate path selection for inbound and outbound overlay traffic.