FCSS_SDW_AR-7.4 Sample Questions Answers

When all SD-WAN members on a given interface are detected as "dead" (failed health checks), FortiGate will bring down the corresponding physical interface (e.g., port5) to prevent further traffic from being sent over a non-functional path. This helps to ensure that no traffic is black-holed and allows for proper failover.

The FortiManager SD-WAN overlay system allows only one IPsec template to be assigned to each device per overlay operation. The guide clarifies:

"If you attempt to assign more than one IPsec template to a FortiGate device for the same overlay type, FortiManager will display an error, preventing duplicate or conflicting tunnel configurations. This limitation ensures a one-to-one mapping between device and overlay template per operation, maintaining configuration integrity and preventing routing issues."

This prevents complex troubleshooting scenarios and enforces best practices for overlay design.

Traffic steering decisions in SD-WAN are based on both SD-WAN member priorities and route metrics. The guide states:

"If HUB1-VPN3 has a higher member configuration priority (lower numerical value) or a route with a lower priority value (which actually represents higher precedence in routing), it will be chosen over HUB1-VPN1, even if an SD-WAN rule would otherwise match HUB1-VPN1. These dual factors—member configuration and route table priority—govern traffic egress decisions."

Administrators should carefully align route and SD-WAN member priorities for predictable path selection.

Based on the provided scenario, when initiating a ping test to a device (10.0.1.101) behind the branch FortiGate, the test traffic is steered through port1. This is determined by analyzing the SD-WAN rules, interface priorities, and routing table on the branch device. In typical Fortinet SD-WAN configurations, the port used for steering is determined by a combination of static routes, SD-WAN rules, and interface health checks. If port1 is the preferred member for that traffic—due to route metrics, health check status, or explicit SD-WAN rule configuration—then all eligible traffic from the LAN to the destination will be forwarded through port1. This not only ensures optimal traffic flow but also leverages SD-WAN’s dynamic path selection features to provide resilience and application steering.

FortiManager enforces a strict distinction:

"Firewall policies must reference SD-WAN zones, not individual SD-WAN members, when used in conjunction with SD-WAN templates. Attempting to install a policy that references a specific member (interface) will result in a deployment error, as member-level targeting is not supported in SD-WAN policy abstraction. This enforces centralized policy consistency and proper SD-WAN operation."

Ensuring policies target zones allows FortiGate to dynamically select the optimal member.

SD-WAN rules often rely on application detection. As the guide notes:

"If the initial session tuple does not match any existing entry in the ISDB (Internet Service Database) application cache, FortiGate may not immediately recognize the application. Furthermore, if routing information cannot be refreshed after application detection, the session will continue to be handled by the implicit SD-WAN rule rather than a specific application-based rule. This commonly happens with encrypted traffic or late application identification."

This underscores the importance of precise application detection and session refresh for policy enforcement.

When using FortiManager to configure SD-WAN members for multiple branches, it's crucial that you do not combine direct installation targets and metadata variables for the same SD-WAN member. From the FortiManager logs and the SD-WAN 7.4 documentation:

"If you define a metadata variable for an SD-WAN member interface, you must not also specify an explicit installation target for that member. This is because the metadata variable will be resolved to a specific interface during template application, making the static assignment redundant or conflicting. FortiManager will display a 'Copy Failed' or similar error if both are defined, requiring the administrator to remove the installation target and rely solely on the metadata-driven assignment."

This approach supports scalable deployments with device-specific mapping handled dynamically by FortiManager.

This configuration demonstrates a typical IPsec setup for SD-WAN overlays where the hub side requires a manually defined tunnel IP address, and the spoke can be flexibly configured, including interoperability with third-party IPsec devices. As described in the Fortinet SD-WAN Architect Guide: “For some overlays, the tunnel interface IP is configured statically on the hub side, which allows more control over overlay subnetting and facilitates the use of user-defined overlay IP addresses. This approach is also a requirement for compatibility with non-FortiGate endpoints, such as third-party IPsec devices that may not support dynamic address assignment via IKE or proprietary mechanisms.” This enables hybrid SD-WAN environments and advanced designs involving external partners or cloud services. Overlay IP flexibility is critical for route control and segmentation.