FortiTelemetry is a critical part of Security Fabric communications and requires explicit configuration for each participating FortiGate interface. The administrative access setting " fabric " (corresponding to FortiTelemetry) must be manually enabled per interface on both upstream and downstream devices. This is performed in the GUI under Administrative Access or via the CLI using the command set allowaccess fabric for the relevant network interface. Without this step, FortiTelemetry communications will not occur on that interface.

Additionally, the default communication between downstream and upstream FortiGate units in the Security Fabric is over TCP port 8013. This port is well-documented as the standard for Security Fabric and FortiTelemetry connections, and must be open and permitted across the network path for connectivity and status enforcement between units. The downstream FortiGate initiates the connection to the upstream via this port unless otherwise configured. This has also been documented as a PCI-relevant port, showing its default usage.

Other options:

Neighbor Discovery in FortiOS uses IPv6 ND protocol, not TCP.

FortiTelemetry port (8013) can be modified, but the interface Administrative Access for the Security Fabric must be manually enabled; Neighbor Discovery port modification is not documented as a supported change for FortiGate.

FortiOS supports both route types described in the question. The FortiOS 7.6 Administrator Study Guide states that a static route can reference one or more SD-WAN zones and that FortiOS consequently installs an individual route for every member of the selected zone. It also states: “Alternatively, you can configure per-member static routes for more granular control over traffic.” Therefore, options A and B are incorrect. Fortinet’s official configuration guidance likewise shows static routes referencing an SD-WAN zone .

The relevant duplicate-route restriction is based on the destination prefix. Fortinet courseware explains: “FortiOS doesn’t allow you to configure a static route for the same destination that references an interface.” Accordingly, a route referencing an SD-WAN zone and another route referencing one of that zone’s members cannot use identical destination subnets. They can use different or overlapping destination prefixes—for example, a less-specific route through the zone and a more-specific route through the individual member. The source subnets are not the required differentiator, eliminating option D.

============