NSE7_SSE_AR-26 Fortinet NSE 7 - FortiSASE 26 Architect Question and Answers

The exhibit combines static-route priority changes with interface-specific session-route preservation.

Initially, port2 provides the preferred default route with priority 1, while port1 has priority 10. Increasing port2 ' s route priority to 20 makes port1 the preferred path for new route selections.

Option C is correct because newly created sessions use the current routing table. Since port1 now has the better route priority, traffic matching the default route is forwarded through port1.

Option E is correct because the port2 interface has preserve-session-route enable configured. This setting preserves the original egress routing information associated with existing sessions, allowing them to continue through port2 while the previously selected route remains valid.

The global setting snat-route-change enable enables reevaluation of SNAT session routing when applicable routing changes occur. However, the configured session-route preservation requires special consideration and prevents the simplistic assumption that all established sessions must immediately migrate.

Option A incorrectly assumes that every SNAT session is necessarily moved to port1. Option B introduces an IP-pool dependency that does not determine the stated behavior. Option D incorrectly assumes all sessions are marked dirty and rerouted regardless of session preservation.

The key architectural distinction is between forwarding new sessions according to the revised route priority and preserving eligible established sessions on their original egress path.

The exhibit contains IKE debugging messages generated during the ADVPN shortcut discovery process. The important entries include SHORTCUT_QUERY , the incoming shortcut query, the route lookup, and NAT hole-punching information.

Option D is supported by the behavior shown in Fortinet ' s published ADVPN examples. In the ADVPN shortcut establishment workflow, an initiating spoke can send a shortcut query toward its hub. The hub forwards the discovery information to the destination spoke, which receives that query on its hub-facing tunnel and prepares the subsequent shortcut negotiation.

Fortinet ' s official ADVPN examples show a destination spoke receiving SHORTCUT_QUERY on its tohub interface, followed by route lookup and shortcut-related operations. The exhibit ' s HUB1-VPN1 naming is consistent with a spoke-side tunnel toward Hub 1, although interface names alone do not establish the device ' s role.

Option A is not supported because the displayed log does not demonstrate direct receipt from another spoke. Option B would require evidence that the device is the forwarding hub. Option C incorrectly treats discovery messages as proof of an established shortcut.

The NAT hole-punching entry indicates shortcut negotiation activity, not completion. The strongest interpretation of the provided debug sequence is a destination spoke receiving a forwarded shortcut query from its hub.

An SD-WAN member may be removed using the FortiGate GUI once its configuration dependencies are cleared. Option A is the intended answer: FortiOS updates the member configuration and its associated forwarding entries as needed. Removal does not require the CLI, does not enforce a minimum of two members per user-defined zone, and does not automatically move the interface into the default virtual-wan-link zone. Those facts eliminate B, C and D. A working deployment can lose connectivity after this change if other services depended on routes through the deleted member; therefore an administrator should check static routing and member reachability, not simply the SD-WAN Rules or Performance SLAs tabs. FortiOS describes an SD-WAN member as a reference to an underlying physical or logical interface. Deleting the SD-WAN membership does not necessarily delete that underlying interface or its addressing. Before removing it, examine SD-WAN member references, health checks, firewall policies, SD-WAN zones and configured static routes. After the change, compare the active routing table and the available SD-WAN forwarding members. The answer assumes no outstanding dependency blocks the delete operation.

The diagnose sys sdwan advpn-session output shows remote health check info(3) and a selected local path such as HUB1-VPN1. It describes health-check information received by the local spoke from another spoke as part of ADVPN 2.0 edge discovery. The remote records can include bandwidth, latency, jitter, packet loss, transport group and SLA state. This information enables the local spoke to evaluate candidate direct shortcuts using both endpoints’ path conditions. The output does not show a hub providing embedded measurements to a spoke and does not by itself indicate ongoing ICMP-based embedded SLA redistribution. The candidate key incorrectly describes the local spoke as the transmitter of the shown measurements. Reference: FortiOS 7.6 — ADVPN 2.0 Edge Discovery and Path Management. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation.

By default, local-out traffic does not use SD-WAN → FortiGate normally sends local-out traffic (e.g., DNS, NTP, FortiGuard updates) directly through its interfaces without applying SD-WAN rules. You must configure each local-out feature individually to use SD-WAN → To steer local-out traffic via SD-WAN, you must explicitly configure the desired local-out features (e.g., DNS, FortiGuard, CAPWAP) to use SD-WAN rules. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

The described design is a multi-region SD-WAN architecture, where: According to Fortinet’s SD-WAN Architecture for Enterprise guidance, when deploying multiple ADVPN regions, eBGP is the recommended routing protocol between regions. Each region operates as an independent routing domain (typically iBGP within the region), while eBGP is used to exchange routes between regional hubs. This approach: This is explicitly documented in Fortinet guidance for “Using eBGP between regions with intra-region ADVPN”, which confirms that the architecture described in the question is valid and recommended when eBGP is used between regions. Why the other options are incorrect: Therefore, the correct and documented conclusion is that the plan is possible and eBGP should be used as the routing protocol between regions, which corresponds to Answer A. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

FortiSASE supports federated identity authentication through Security Assertion Markup Language (SAML), enabling enterprises to integrate their existing identity providers into centralized secure access workflows.

Option C is correct because FortiSASE can function as a SAML service provider while delegating user authentication to an external identity provider such as Microsoft Entra ID, formerly Azure AD, Okta, or FortiAuthenticator.

During authentication, FortiSASE redirects or delegates the authentication exchange to the configured identity provider. After successful authentication, the identity provider issues a signed SAML assertion containing the identity information required by the service provider. FortiSASE validates the assertion and applies the appropriate access-control policies.

Option A is incorrect because SSO reduces repetitive authentication across supported services rather than requiring independent authentication for every security function.

Option B is incorrect because SSO does not eliminate identity verification. Authentication remains mandatory according to configured access requirements, and zero-trust policies may additionally assess endpoint posture and contextual conditions.

Option D is incorrect because the principal purpose of federated authentication is to leverage an established identity system rather than duplicate enterprise passwords within FortiSASE.

SSO simplifies administration while maintaining centralized identity governance, supporting secure internet and private application access.

The FortiManager SD-WAN overlay template preview, as described in the document, indicates: " When the device is acting as a hub, the configuration enables the sending of ADVPN shortcut offers to spokes. This means the hub can facilitate on-demand dynamic shortcut tunnel creation between spokes, improving performance for branch-to-branch communication by bypassing the hub for inter-branch traffic after initial discovery. " Such a role is critical in scalable ADVPN topologies, enabling hub devices to optimize overlays dynamically. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

The rule is in SLA mode with two SLAs. From the status, HUB1-VPN2 and HUB1-VPN3 meet the SLA (sla(0x2) and sla(0x3)), while HUB1-VPN1 does not (sla(0x0)). Among members that meet SLA, FortiGate uses the configured order (priority-members 4 5 6) to pick the first eligible one—HUB1-VPN2—so traffic is routed over HUB1-VPN2. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow. When troubleshooting, correlate the configured SD-WAN service with diagnose sys sdwan service4, the live session entry and the routing table. An application signature, an IP route and a health-check result describe different decision stages; treating them as interchangeable can produce incorrect conclusions about the egress interface.

The CSV import process for FortiManager model devices requires the fields ' Serial Number ' , ' Device Blueprint ' , and ' Name ' . These are the mandatory identifiers used to create model devices and apply the appropriate initial provisioning configuration. In the exhibit, the missing device-blueprint field and an empty name for one device prevent a complete import. Options A and B are therefore the required corrections. Metadata values for addresses or user-defined variables may be included as additional columns, but they are not universally mandatory to import a model device. Consequently, options C and D impose requirements that depend on a subsequent provisioning template, not the CSV import itself. The selected blueprint must also be compatible with the target hardware platform. When deploying large numbers of devices, administrators should ensure serial numbers are unique, device names are valid and blueprint assignments resolve to templates and packages within the correct ADOM. The definitive FortiManager 7.6 import specification lists precisely those three required CSV columns; it does not impose a blanket requirement for every metadata variable to contain a value at import time.

The FortiManager installation error is associated with the gateway value produced by metadata substitution, not with a general failure of FortiManager-to-FortiGate connectivity. A template uses a variable such as ' $(sdwan_port1_gw) ' to provide the interface gateway at installation time. If the current device has no valid value in its per-device metadata mapping, the generated FortiOS configuration contains an invalid IPv4 gateway and the copy or validation operation fails. Therefore the remediation is to inspect the variable definition and its per-device mapping, which is option C in the normalized question. The administrator can verify the mapping for the affected FortiGate, supply a valid address, regenerate the installation preview and reinstall. It is unnecessary to remove all template installation targets: FortiManager supports them alongside metadata variables. Nor must the members of a zone all use identical gateway configuration methods. This conclusion is specifically tied to the error shown in the original exhibit. The uploaded FortiSASE guides describe centralized management generally, but detailed per-device template substitution belongs to the FortiManager 7.6 Administration Guide.

The exhibits identify a source at 10.0.1.101 generating an ICMP echo toward a public destination. They show multiple Internet-facing SD-WAN members, but not a session-table record or packet capture tying this exact ICMP exchange to port2. The corporate service requires a private destination, so it is not the controlling match for the Facebook public IP address. Application classification must also be distinguished from a basic ICMP ping: a Facebook application signature associated with HTTPS traffic does not establish that an ICMP exchange has been recognized as the Facebook application. Although D (port2) is the supplied key, the displayed service definition and application-cache information alone do not prove it. To determine the correct egress, capture the specific ICMP flow or apply a source/destination session filter and inspect the selected SD-WAN member and outgoing device. Port1, port2, and port4 remain potential candidates until the relevant interface and route-selection evidence is supplied. Accordingly this is not an exhibit-verified single-answer item, and it should not be sold as conclusively solved solely from the provided screenshot. The FortiOS Application Steering guide documents why application detection and rule eligibility must be examined separately.

Verification qualification: The available exhibits do not uniquely prove port2 as the ICMP egress interface.

The SD-WAN rule is configured for Best Quality with packet loss as the selected link-cost factor. The output shows HUB1-VPN1 at 2% loss, HUB1-VPN2 at 4% and HUB1-VPN3 at 12%, with member ID 6 placed first in the configured priority list. With a link-cost threshold of zero, FortiGate selects by the measured link-cost metric, using member order to resolve an equal-quality tie. Option D is the intended answer: if all three members reach the same packet-loss value, the first configured preference, HUB1-VPN3, can win the tie. Increasing only HUB1-VPN1 loss to 4% leaves HUB1-VPN2 at 4% and HUB1-VPN3 at 12%; changing VPN3 to 4% still leaves VPN1 at 2%. Increasing HUB1-VPN1 to 12% leaves VPN2 at 4%. Therefore A, B and C do not produce the same tie outcome. This interpretation assumes all members are operational and remain equally route-eligible. Fortinet ' s Best Quality documentation explicitly describes measured metrics, configured member ordering and link-cost thresholds as distinct selection inputs.

Verification qualification: The exhibit supports the equality tie-break outcome only if the chosen quality criterion is packet loss and no other eligibility changes intervene.

FortiGate SD-WAN uses traffic-classification criteria to identify application flows and apply appropriate forwarding strategies based on business priorities and link-performance requirements.

Option C is correct because application categories can be used to identify traffic belonging to defined application groups. This capability enables administrators to steer business-critical applications through preferred WAN paths while directing less-sensitive traffic through alternative links.

Application-aware SD-WAN rules can use FortiGuard application identification to make forwarding decisions without relying exclusively on destination IP addresses or transport ports.

Option D is correct because the Internet Service Database provides predefined classifications for cloud services and internet applications. FortiGate can use ISDB objects in SD-WAN service rules to steer traffic toward destinations associated with services such as Microsoft 365 and other cloud applications.

Option A is incorrect because physical interface type is not one of the application or destination matching criteria represented by this question. SD-WAN members identify eligible forwarding interfaces, which is distinct from the traffic-classification criteria.

Option B is incorrect because BGP attributes influence routing decisions and route selection but are not directly equivalent to the application and ISDB matching criteria used by these service rules.

Together, application-category and ISDB matching provide granular, application-aware steering.

According to the FortiSASE 25 Enterprise Administrator Study Guide, page 88, FortiClient automatically exits network lockdown when the endpoint is detected as on-net or successfully establishes a FortiSASE tunnel.

Option A is correct: FortiSASE uses on-net detection rules to identify whether an endpoint is connected to a trusted corporate network. When the endpoint satisfies the configured on-net rules, FortiClient can release network lockdown because internet traffic can be protected by the organization ' s on-premises security infrastructure, such as FortiGate.

Option B is correct: Network lockdown prevents unrestricted LAN and internet access when an off-net endpoint fails to establish its required FortiSASE tunnel within the configured grace period. Once the tunnel is successfully established, FortiClient releases the lockdown, allowing internet traffic to be secured through FortiSASE.

Option C is incorrect: Rebooting the endpoint does not independently satisfy either release condition. FortiClient continues enforcing the configured security requirements.

Option D is incorrect: Security posture tags evaluate endpoint compliance and support conditional access policies. However, posture compliance alone is not identified as a network-lockdown release condition.

The two documented release conditions are on-net detection and successful FortiSASE tunnel establishment.

Exact Source References:

FortiSASE 25 Enterprise Administrator Study Guide, page 86 — On-Net Rule Sets.

FortiSASE 25 Enterprise Administrator Study Guide, page 88 — On-Net and Off-Net Features—Network Lockdown.

FortiSASE-Sovereign 26.2.a Administration Guide, page 67 — On/Off-Net Settings.

The SD-WAN overlay template defines a zone for each underlay interface and moves the interfaces into those zones. This statement perfectly describes the likely sequence of events. The template, when applied, re-organizes the interfaces and zones, causing the existing firewall policy that relies on the old zone configuration to fail. This is the most plausible root cause. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable. Before applying a topology change, review the interface dependencies, static and dynamic routing, security policies and provisioning templates. FortiGate can support multiple transport types, but routing and tunnel compatibility still determine whether the intended member is operationally eligible. In checking this outcome, an administrator should distinguish what the displayed exhibit proves from configuration prerequisites not visible in the screenshot. Routing eligibility, device role, rule matching, and software-version details should be verified before using the selected answer in a production decision. The referenced Fortinet documentation identifies the underlying feature and its supported configuration context.

Hosting the hub at the MSSP centralizes installation, security, and ongoing management while each site (spoke) keeps local DIA. This can be done multi-tenant with a shared hub using a dedicated VDOM or with a fully dedicated hub per customer for stricter isolation and control, both meeting the requirement to delegate administration to the MSSP and support high inter-site traffic. A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable. Before applying a topology change, review the interface dependencies, static and dynamic routing, security policies and provisioning templates. FortiGate can support multiple transport types, but routing and tunnel compatibility still determine whether the intended member is operationally eligible.

The line sdwan_mbr_seq=1 sdwan_service_id=4 indicates that this session is part of an SD-WAN rule. sdwan_service_id=4 confirms that the session is being handled by SD-WAN rule ID 4. This directly links the flow to the SD-WAN configuration. The line no_offload_reason: redir-to-ips denied-by-nturbo shows that the session is not offloaded to the NPU (Network Processing Unit) and is being processed by the main CPU. A session that is not offloaded can be re-evaluated. If the outgoing interface (the one currently being used) goes down, the FortiGate will re-evaluate the session against the SD-WAN rules to find a new active member to steer the traffic through. This is a fundamental behavior of SD-WAN, which ensures network resilience. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

FortiOS gathers performance statistics through configured health checks irrespective of whether a particular SD-WAN service rule currently uses the resulting SLA target. That makes option A incorrect. Lowest Cost (SLA) rules use selected SLA targets to determine which members satisfy their latency, jitter or packet-loss requirements; the standard distinction makes B and C the intended correct statements. A service can reference more than one SLA health check using separate entries in its service-level configuration, supporting the intended meaning of E. The CLI uses ' config system sdwan ' , ' config service ' , and a nested ' config sla ' table, in which each named health-check entry references an SLA ID. Option D suggests multiple target IDs within one entry; that is not what the standard syntax shows. Note that FortiOS versions supporting hybrid quality-and-SLA selection add nuance to the phrase ' only Lowest Cost ' , so B must be interpreted in the context of the conventional Manual, Best Quality and Lowest Cost strategies addressed by the question. The uploaded FortiSASE guides do not contain the detailed CLI target schema, which is documented in the FortiOS 7.6 SD-WAN command reference.

FortiOS ADVPN 2.0 adds SD-WAN-aware shortcut path management over an already established ADVPN infrastructure. The principal spoke-side activation is advpn-select enable in the relevant SD-WAN zone, with advpn-health-check identifying the performance SLA. Transport-group configuration governs compatible underlying networks used to establish direct shortcuts. The FortiGate hubs ordinarily need no wholesale replacement of the existing compatible ADVPN tunnel configuration solely for this upgrade. Removing and recreating every IPsec tunnel is unnecessary and introduces avoidable operational risk. The supplied key selects a hub IPsec change, but the required feature in the question is implemented through the branch SD-WAN configuration. Reference: FortiOS 7.6 — ADVPN 2.0; SD-WAN Zone CLI and Transport Groups. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

The IKE debug shows processing notify type SHORTCUT_QUERY, recv shortcut-query and forward shortcut-query. These commands identify a hub receiving ADVPN shortcut discovery signaling from a spoke and forwarding it toward another spoke. A spoke that merely receives a shortcut query would not be characterized by the explicit forwarding record in the same manner. The output does not establish a two-region topology or a completed direct shortcut. The candidate key identifying a spoke contradicts the forwarded-shortcut-query diagnostic evidence. Reference: FortiOS 7.6 — ADVPN Shortcut Establishment and IKE Debugging. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

The screenshot omits the application-destination selector because the corresponding FortiOS GUI feature has not been enabled. Option D is correct: open System > Feature Visibility and enable Application Detection Based SD-WAN. Fortinet documents the equivalent CLI setting as ' config system global ' followed by ' set gui-app-detection-sdwan enable ' . Once visible, individual applications, groups and categories can be selected in SD-WAN rules. This is supported for direct internet access and for standalone FortiGate appliances, so options A and B are wrong. Option C is also wrong because using the CLI is an alternative, not a required prerequisite when the GUI setting is available. Application-aware traffic steering additionally requires an application-control profile on an applicable firewall policy so traffic can be classified. Administrators should distinguish this application-signature selector from the Internet Service Database destination field: ISDB objects are another supported way to define destinations, but ISDB matching is not synonymous with application- control signature recognition. Review the GUI feature flag, firewall policy inspection profile and the matched service rule before evaluating the resulting forwarding member. This behavior is documented specifically in FortiOS 7.6 Application Steering Using SD-WAN Rules.

Fortinet ' s unified SASE architecture supports multiple methods of securing private application access, including identity-based Zero Trust Network Access and connectivity through Secure SD-WAN.

Option B is correct because ZTNA provides an application-centric alternative to traditional remote-access VPN architectures. Instead of providing broad network connectivity, ZTNA authenticates users, evaluates device security posture, and grants access only to explicitly authorized applications.

Fortinet ZTNA integrates identity verification, endpoint posture assessment, and application-specific security policies to reduce implicit trust.

Option C is correct because Secure SD-WAN enables encrypted and centrally managed connectivity between enterprise locations, cloud environments, and private resources. When integrated with FortiSASE, existing SD-WAN hubs can provide secure private application access through cloud security points of presence.

Option A is incorrect in this scenario because SD-WAN Branch On-ramp is primarily an ingress method for connecting branch networks to FortiSASE. Although it can participate in a broader private-access architecture, it is not the general VPN-replacement technology being tested.

Option D is incorrect because SWG and CASB primarily address internet and SaaS application security rather than providing the private network connectivity and application-specific access control required here.

ZTNA delivers granular access enforcement, while Secure SD-WAN supplies resilient and secure enterprise connectivity.

Policy 3 points traffic To = HUB1-VPN1, which is an SD-WAN member interface. In SD-WAN you must reference the SD-WAN zone (the logical interface) in policies, not its member tunnels. Change the policy’s To interface to the zone HUB1, and the install will succeed. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault. In the relevant Fortinet FortiManager documentation, the applicable feature should be verified against the deployed software version, the selected configuration mode and the live operational state before the answer is treated as a definitive implementation requirement.

FortiSASE Secure Private Access enables protected communication between remote users, branch locations, and enterprise resources through FortiSASE security points of presence and FortiGate SPA hubs.

Option B is correct because SPA supports server-initiated communication from resources behind FortiGate SPA hubs to FortiClient agent-based remote users. This bidirectional capability requires appropriate From hubs security policies and routing.

Option D is correct because agent-based users can access private applications behind Fortinet Secure SD-WAN hubs. FortiSASE establishes IPsec overlays to the hubs, while BGP exchanges reachability information for protected networks.

Option E is correct because thin-edge locations and branch on-ramp devices can access private applications through FortiSASE. Fortinet explicitly documents access from FortiAP, FortiExtender, and branch on-ramp deployments to private networks through SPA.

Option A is incorrect because internet-bound traffic is principally associated with Secure Internet Access (SIA), rather than SPA.

Option C is not a standard SPA hub-to-hub service flow. SPA primarily connects FortiSASE users and edge locations with private resources behind SPA connectors. Inter-site traffic may use other supported SD-WAN or specifically configured inter-PoP paths.

The distinction is important: Fortinet documents thin-edge and branch-on-ramp access to private resources as a supported SPA use case.

From the SD-WAN rule configuration (service ID 3, name " Corp " ), the rule is configured as: In the diagnose firewall proute list output for service=3 (Corp), FortiGate shows the actual members considered for this rule and their SLA pass status: Because the rule is SLA-based, FortiGate selects only members that meet the SLA requirements for the rule. The output indicates that HUB1-VPN1 and HUB1-VPN2 pass both SLA checks (num_pass=2), while HUB1-VPN3 passes only one (num_pass=1) and therefore is not selected as an eligible forwarding interface for this rule. Since load-balance is enabled and the rule uses hash-mode source-ip-based, FortiGate will consistently choose an eligible member based on the source IP hash. For traffic sourced from 10.0.1.101, the session can be steered through either HUB1-VPN1 or HUB1-VPN2 (whichever the hash selects), but not HUB1-VPN3. Therefore, the correct answer is B. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

Verification qualification: A specific hash-selected interface cannot be predicted from the supplied configuration without the full evaluation.

FortiManager SD-WAN Overlay Orchestration produces the core provisioning artifacts IPsec tunnel templates, BGP templates and CLI templates. IPsec tunnels implement the WAN overlays, BGP exchanges route prefixes and the CLI portion provides other device configuration needed by the topology. The candidate key includes a generic Rules template, but the standard generated template list does not identify such an object. SD-WAN rules are configured using the appropriate SD-WAN provisioning template or follow-up policy tasks, and they are not the same as the three generated template types. Static routing templates are not universally generated as core overlays. Reference: FortiManager 7.6 — Objects and Templates Created by SD-WAN Overlay Orchestrator. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

FortiGate provides three primary SD-WAN health-monitoring modes: Active, Passive, and Prefer Passive. Prefer Passive combines live-session measurements with active probes when sufficient application traffic is unavailable.

Option B is correct because FortiGate measures performance passively when qualifying TCP sessions traverse an SD-WAN member. It derives latency, jitter, and packet-loss measurements from actual TCP session behavior rather than relying exclusively on synthetic probes.

Option E is correct because passive measurements alone cannot reliably determine whether an otherwise idle interface is completely unreachable. In Prefer Passive mode, FortiGate uses active probing when no suitable TCP traffic has been observed for three continuous minutes. Active probes can then identify dead members.

Option A is incorrect because ordinary ICMP traffic does not provide the TCP session information required for this passive measurement mechanism.

Option C reverses the transition logic. The three-minute timer applies to the absence of TCP traffic before switching from passive to active monitoring. FortiGate returns to passive monitoring when eligible TCP traffic becomes available.

Option D is incorrect because enabling passive-wan-health-measurement disables automatic ASIC offloading for the affected firewall policy, allowing the CPU to observe the session characteristics necessary for passive measurement.

After using the SD-WAN overlay template, two mandatory post-run tasks remain: " First, administrators must create and assign policy packages to branch devices, as security and access policies are not included in overlay templates. Second, SD-WAN rules must be configured so that traffic can be matched and steered appropriately through the established overlays. Neglecting either task results in ungoverned traffic or inefficient routing, undermining the benefits of SD-WAN. " Templates automate topology, but policy and rule definition are critical for operational effectiveness.References: FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

The FortiManager SD-WAN overlay system allows only one IPsec template to be assigned to each device per overlay operation. The guide clarifies: " If you attempt to assign more than one IPsec template to a FortiGate device for the same overlay type, FortiManager will display an error, preventing duplicate or conflicting tunnel configurations. This limitation ensures a one-to-one mapping between device and overlay template per operation, maintaining configuration integrity and preventing routing issues. " This prevents complex troubleshooting scenarios and enforces best practices for overlay design. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.