View all questions & answers for the NSE 5 - FortiSASE and SD-WAN 7.6 Core Administrator Exam Materials exam

NSE 5 - FortiSASE and SD-WAN 7.6 Core Administrator Exam Materials - Question #50 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibit. An administrator is troubleshooting SD-WAN on FortiGate. A device behind branch1_fgt generates traffic to the 10.0.0.0/8 network. The administrator expects the traffic to match SD-WAN rule ID 1 and be routed over HUB1-VPN1. However, the traffic is routed over HUB1-VPN3. Based on the output shown in the exhibit, which two reasons, individually or together, could explain the observed behavior? (Choose two answers)

  • A. HUB1-VPN1 does not have a valid route to the destination.
  • B. HUB1-VPN3 has a lower route priority value (higher priority) than HUB1-VPN1.
  • C. HUB1-VPN3 has a higher member configuration priority than HUB1-VPN1.
  • D. The traffic matches a regular policy route configured with HUB1-VPN3 as the outgoing device.
Correct Answer: A,D

Brave-Dump Community Votes

Answer: A, D (2 votes) 100%

Community Explanations & Comments (2)

Diaa El-rayse 6 months ago
Selected: A, D
The question ask for two reasons that could making this happen , route priority is only considered when we have multiple static routes
Rocky 4 months ago
Selected: A, D
1. Why Option A is Correct (Valid Route Requirement)In FortiOS, for an interface member to be selectable by an SD-WAN rule, it must have a valid active route to the destination within the firewall's main routing table (RIB/FIB).Looking at the third command output (get router info routing-table all | grep HUB1):There is only a valid entry for the target network 10.0.0.0/8 via HUB1-VPN3 (via HUB1-VPN3 tunnel 172.16.1.5).There is no route for the 10.0.0.0/8 network pointing to HUB1-VPN1.Because HUB1-VPN1 lacks a valid routing path to that destination network, the SD-WAN engine automatically bypasses it as an unavailable route.2. Why Option D is Correct (Policy Route Precedence)In the FortiOS packet flow and routing lookup order, regular Policy-Based Routes (PBR) configured under Network > Policy Routes are evaluated before SD-WAN rules.If an administrator previously set up a manual policy route that matches the 10.0.0.0/8 traffic and forces it out via HUB1-VPN3, the firewall will forward the packet instantly using that policy route, completely skipping the SD-WAN ruleset.Why the other options are incorrect:B & C: Even though HUB1-VPN3 shows a member priority value of 1 (which is numerically lower/preferred over 15), the diagnose sys sdwan service 4 output clearly specifies Tie break: cfg (configuration order). Because the rule relies strictly on configuration order rather than member priority weights, interface priority values are ignored during this rule evaluation.