FCSS_SDW_AR-7.4 FCSS - SD-WAN 7.4 Architect Questions and Answers

The implicit SD-WAN rule serves as the final catch-all. Per Fortinet:

"Sessions matching the implicit SD-WAN rule do not have an SD-WAN service id, as they are not associated with any specific user-defined SD-WAN rule. Additionally, this occurs only when traffic fails to match any entry in the policy route table. This default handling guarantees connectivity while minimizing the risk of blackholed traffic."

Administrators can observe this in diagnostic outputs for troubleshooting.

To allow spokes in different hub-and-spoke groups to establish ADVPN shortcuts, the hubs must be configured to forward and send ADVPN shortcut offers. The key required settings on the hub are auto-discovery-forwarder (for VPNs to hubs) and auto-discovery-sender (for VPNs to spokes). This ensures the hub can facilitate and advertise ADVPN shortcut offers between spokes.

When using the diagnose sys session list command, SD-WAN-specific session steering is indicated by the presence of the sdwan_service_id field in the session data. This identifier ties the session directly to a specific SD-WAN rule or service. As noted in the Fortinet documentation: “Sessions that are handled according to SD-WAN rules will include a service ID tag (sdwan_service_id) in their session listing. This allows administrators to correlate live sessions with SD-WAN policy matches for troubleshooting and visibility.” This is a crucial diagnostic tool, as it distinguishes between traffic managed by traditional routing and that explicitly controlled by SD-WAN steering logic, aiding in operational insight and troubleshooting.

From the SD-WAN monitor in FortiManager:

"The SD-WAN monitor provides a summary view of the branch devices and their members. In the scenario shown, it is clear that branch2_fgt is missing SLA configuration for one member, as evidenced by the lack of performance metrics. The monitor also shows only two branches in the current topology, allowing quick assessment of branch health and configuration completeness."

This kind of visibility is vital for proactive monitoring and rapid troubleshooting in SD-WAN environments.

The SD-WAN load balancing algorithm selection is nuanced. Fortinet documentation states:

"Outbandwidth hash mode can be used with any load balancing strategy that permits multiple simultaneous paths. However, SD-WAN load balancing in practice is only enabled when the strategy is either 'best quality' or 'lowest cost (SLA)'. Manual strategies do not support automated load balancing, and are typically used for deterministic or failover scenarios."

Selecting the correct strategy is key for achieving desired distribution and redundancy.

In FortiOS SD-WAN configurations, when setting up Direct Internet Access (DIA) using the GUI, you cannot select applications as thedestinationin SD-WAN rules. The destination field in these rules is designed for IP subnets or address objects only, due to how DIA policies are structured within FortiOS. This is a platform limitation: while application steering is supported forsourceor for application-aware routing, the destination field in DIA scenarios does not accept applications. Therefore, the GUI does not present the option, and administrators must instead define DIA SD-WAN rules by specifying IP addresses or address objects for destinations. This restriction helps maintain rule clarity and performance efficiency in large deployments.

When referencing a zone in a static route, FortiGate’s behavior is described as:

"Referencing a zone in a static route causes FortiGate to install a static route for each member interface of the zone. This enables ECMP (Equal-Cost Multi-Path) and load balancing where supported and ensures that traffic can be steered over any valid zone member according to SD-WAN rules or standard routing."

This mechanism is fundamental to Fortinet’s implementation of SD-WAN and simplifies large, multi-interface deployments.

Based on the provided scenario, when initiating a ping test to a device (10.0.1.101) behind the branch FortiGate, the test traffic is steered through port1. This is determined by analyzing the SD-WAN rules, interface priorities, and routing table on the branch device. In typical Fortinet SD-WAN configurations, the port used for steering is determined by a combination of static routes, SD-WAN rules, and interface health checks. If port1 is the preferred member for that traffic—due to route metrics, health check status, or explicit SD-WAN rule configuration—then all eligible traffic from the LAN to the destination will be forwarded through port1. This not only ensures optimal traffic flow but also leverages SD-WAN’s dynamic path selection features to provide resilience and application steering.