FCSS_SDW_AR-7.4 FCSS - SD-WAN 7.4 Architect Question and Answers

When the member priority of a port is increased (e.g., port2 to 20), FortiGate evaluates existing sessions and applies “dirty” flags where applicable. The SD-WAN session management mechanism is described in detail: “Upon a change in SD-WAN member priority, all existing sessions using that member are marked as dirty. For SNAT sessions, the gateway information is updated to ensure future packets are routed through the newly preferred member, in this case, port1. This automatic re-evaluation allows SD-WAN to dynamically respond to topology or priority changes, maintaining optimal routing.” This is fundamental to seamless failover and session persistence in Fortinet SD-WAN, ensuring active flows are redirected based on updated priorities or health status.

In the SD-WAN GUI, the absence of members in a zone is visually represented, and the Fortinet guide confirms:

"If a zone such as overlay-factories contains no members, it will be displayed as empty in the SD-WAN GUI. This may occur when the zone is reserved for future expansion, or if members have been temporarily removed for maintenance or reconfiguration. Traffic cannot be steered via an empty zone until at least one SD-WAN member is added."

Such visual cues help operators quickly assess configuration status and readiness.

When all SD-WAN members on a given interface are detected as "dead" (failed health checks), FortiGate will bring down the corresponding physical interface (e.g., port5) to prevent further traffic from being sent over a non-functional path. This helps to ensure that no traffic is black-holed and allows for proper failover.

SD-WAN rules often rely on application detection. As the guide notes:

"If the initial session tuple does not match any existing entry in the ISDB (Internet Service Database) application cache, FortiGate may not immediately recognize the application. Furthermore, if routing information cannot be refreshed after application detection, the session will continue to be handled by the implicit SD-WAN rule rather than a specific application-based rule. This commonly happens with encrypted traffic or late application identification."

This underscores the importance of precise application detection and session refresh for policy enforcement.

The implicit SD-WAN rule serves as the final catch-all. Per Fortinet:

"Sessions matching the implicit SD-WAN rule do not have an SD-WAN service id, as they are not associated with any specific user-defined SD-WAN rule. Additionally, this occurs only when traffic fails to match any entry in the policy route table. This default handling guarantees connectivity while minimizing the risk of blackholed traffic."

Administrators can observe this in diagnostic outputs for troubleshooting.

SD-WAN performance SLAs and health checks are typically measured using synthetic probes (e.g., ping, HTTP, TCP). In the configuration shown, the health/performance metrics are tied specifically to TCP traffic related to Facebook and YouTube applications. According to the SD-WAN 7.4 Concept Guide: “When application-based performance measurement is enabled, only TCP flows matching the specified application IDs (such as Facebook and YouTube) are used to calculate metrics. The performance metric for the member is then computed as an average of those application-specific probes or traffic samples.” This enables fine-grained, application-aware steering and ensures that measured values reflect the real user experience for critical business applications.

When referencing a zone in a static route, FortiGate’s behavior is described as:

"Referencing a zone in a static route causes FortiGate to install a static route for each member interface of the zone. This enables ECMP (Equal-Cost Multi-Path) and load balancing where supported and ensures that traffic can be steered over any valid zone member according to SD-WAN rules or standard routing."

This mechanism is fundamental to Fortinet’s implementation of SD-WAN and simplifies large, multi-interface deployments.

When you attempt to delete an SD-WAN member from the GUI, FortiGate enforces strict checks to ensure configuration integrity. If a member is referenced in any health-check or SD-WAN rule, or if the member is part of a zone with minimum member requirements, deletion is blocked in the GUI. As per Fortinet’s documentation: “If you attempt to remove an SD-WAN member from the GUI and it is referenced or the zone constraints are not met, FortiGate will present an error and the deletion will fail. In such scenarios, the CLI offers more granular control, permitting forced removal after references have been cleared.” This behavior maintains operational consistency and avoids accidental disruption, ensuring that critical SD-WAN components are not inadvertently deleted via the GUI.