NSE 4 - FortiOS 7.6 Administrator Exam Materials - Question #36 Discussion

This slide shows the SD-WAN rule lookup process. SD-WAN rules are essentially policy routes. Like regular
policy routes, SD-WAN rules are checked from top to bottom (first match). For each rule, FortiGate maintains
an outgoing interface (oif) list. The oif list sorts the configured members by preference based on the
strategy in use. The members that are placed first in the list have higher preference for steering traffic.
FortiGate starts the lookup process by comparing the packet against the rule matching criteria. If the packet
doesn’t match the criteria, FortiGate moves on to the next rule, and so on, until it finds a match. Then,
FortiGate proceeds as follows:
1. FortiGate performs a forwarding information base (FIB) lookup for the packet destination IP (dstip). If
the resolved interface for the fib-best-match isn’t an SD-WAN member, then FortiGate moves on to
the next rule. This behavior follows the key routing principle: SD-WAN rules are skipped if the best route
to the destination isn’t an SD-WAN member.
2. If the resolved interface is an SD-WAN member, then FortiGate looks for one or more acceptable
members in the oif list, starting with the first member in the list. An acceptable member is an alive
member that has a route to the destination. This behavior follows the key routing principle: SD-WAN rules
are skipped if none of the configured members in the rule have a valid route to the destination.
If FortiGate finds an acceptable member, it forwards the packet to that member—then the firewall policy check
occurs— and the rule lookup process ends. Otherwise, FortiGate moves on to the next rule. If all rules are
skipped, then FortiGate routes the packet using standard routing, hence the key routing principle: The implicit
SD-WAN rule equals standard FIB lookup.
Pag 429

Is the correct

FIB lookup ABE

abe

ace

B is nonsense

What is the correct answer @admin?

A,C,E

B wrong because its saying "any"
ACE correct
from study guide page 421
SD-WAN rules are skipped if the best route to the destination isn't an SD-WAN member.
SD-WAN rules are skipped if none of the configured members in the rule have a valid route to the destination.

36