FCSS-SDW-AR-7.4 Fortinet FCSS - SD-WAN 7.4 Architect Practice Questions

The FortiOS SD-WAN feature integrates with the policy routing table. Each configured SD-WAN rule (service) dynamically creates corresponding entries in the policy route table. The diagnose firewall proute list command is a crucial tool for troubleshooting as it shows exactly how the SD-WAN rules have been translated into routable decisions.

This is correct. The traffic from one spoke arrives at the hub, is decrypted, and then needs to be routed and forwarded to the other spoke. This forwarding action requires a normal Accept policy (Source Interface: ipsec_tunnel, Destination Interface: ipsec_tunnel). An IPsec action policy is not used for this traffic flow.

This strategy, often referred to as 'Load Balance', distributes sessions across multiple links based on configured algorithms like volume, sessions, or spillover to maximize bandwidth utilization.

Lowest Cost is a valid strategy that uses the member interfaces according to a preferred order, failing over to the next in the list if the preferred one fails or goes out of SLA.

Best Quality is a valid strategy that selects the best-performing link based on the criteria in a chosen Performance SLA.

FortiManager's default behavior can be configured at the ADOM level. If 'Allow FortiManager Overwrite' (or a similar setting depending on the version) is enabled, when FortiManager pushes its configuration, it can overwrite any settings on the end device, including those it does not explicitly manage. To preserve local changes, this should be disabled, forcing FortiManager to only manage the objects defined within its database.

This is the correct sequence. The initial packet(s) trigger the process by flowing through the hub. The hub forwards this traffic and also sends an IKE information message to the initiator (Spoke A) containing the peer information for Spoke B. Spoke A then initiates the direct IKE negotiation with Spoke B to build the on-demand shortcut tunnel.

Enabling auto-discovery sender and receiver roles on the IPsec tunnel connecting the two hubs allows them to forward IKE messages related to shortcut negotiation on behalf of their respective spokes. This is the core mechanism that facilitates inter-region shortcuts.

Establishing a BGP neighborship between the regional hubs is crucial for them to exchange spoke routing information. This allows a hub in one region to learn about the spokes connected to the hub in the other region, which is a prerequisite for shortcut negotiation.

A metadata variable (e.g., $(lan_subnet)) is the correct feature. The architect can define this variable in the template's address object and then assign the specific subnet value for each branch in the device manager settings. FortiManager will substitute the correct value during deployment.

The "no proposal chosen" error message specifically indicates that the IKE peers (hub and spoke) could not agree on a common set of security parameters during either Phase 1 or Phase 2 negotiation. This is caused by a mismatch in the configured encryption algorithms, authentication methods, Diffie-Hellman groups, or key lifetimes.

When using the 'Best Quality' strategy, FortiGate first disqualifies any member that violates the SLA (in this case, MPLS). From the remaining members that are within SLA (DIA-1 and DIA-2), it will select the one with the best performance based on the SLA criteria (latency). If multiple links are viable, it may load-balance or prefer the best one, but it will only use the links that meet the SLA.

True. The SD-WAN Overlay Template in FortiManager is a powerful automation tool. It can be configured to not only create the IPsec tunnels but also to automatically generate the corresponding BGP configurations for the hub and spokes, significantly simplifying the deployment of dynamic routing across the overlay.