The FortiManager SD-WAN overlay system allows only one IPsec template to be assigned to each device per overlay operation. The guide clarifies: " If you attempt to assign more than one IPsec template to a FortiGate device for the same overlay type, FortiManager will display an error, preventing duplicate or conflicting tunnel configurations. This limitation ensures a one-to-one mapping between device and overlay template per operation, maintaining configuration integrity and preventing routing issues. " This prevents complex troubleshooting scenarios and enforces best practices for overlay design. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

For a large-scale SD-WAN deployment (such as 1000 spokes) where ADVPN shortcut routing is required and some remote sites connect via FortiSASE, the recommended overlay routing configuration is BGP running on loopback interfaces, combined with dynamic BGP for ADVPN shortcut routing. This design leverages the scalability and resilience of BGP, allowing dynamic discovery and route exchange necessary for shortcut tunnels between spokes in ADVPN environments. Using loopback interfaces for BGP peering is considered best practice because it decouples routing protocol stability from physical link status, ensuring that if a physical underlay interface fails, the BGP session remains up as long as there’s an alternate path. With dynamic BGP, each spoke can efficiently learn the routes to other spokes and dynamically establish shortcuts, which is critical at this scale. This method also integrates smoothly with FortiSASE for remote connectivity to the SD-WAN hub, providing flexibility and centralized management.References: A deployment should preserve the distinction between the physical or logical WAN underlay, the IPsec overlay and the SD-WAN zone that groups forwarding members. These layers can have different routing and security-policy requirements. The configured architecture must also allow the required traffic paths and failover behavior rather than assuming every available interface is interchangeable.

FortiGate SD-WAN integrates policy-based traffic steering with the traditional routing subsystem. SD-WAN rules do not automatically override routing-table decisions; they operate within the route-selection framework.

Option A is correct. A member selected by an SD-WAN rule must have a valid route toward the destination. If the selected member cannot reach the destination, FortiGate excludes that member and evaluates another eligible candidate.

Option C is correct. Under default SD-WAN routing behavior, the best route to the destination must point toward an SD-WAN member before SD-WAN service-rule evaluation applies. If the best route points to a non-SD-WAN interface, conventional routing handles the traffic instead.

Option E is correct because a directly connected route can take precedence when it is the best matching route. FortiGate does not unnecessarily divert locally reachable destinations into SD-WAN processing.

Option B is incorrect because the Internet Service Database supplies application and destination classification information; it does not establish a universal routing-precedence rule above SD-WAN.

Option D is incorrect because a static route does not inherently bypass SD-WAN. Static routes commonly provide reachability through SD-WAN member interfaces.

The fundamental principles are route eligibility, valid member reachability, and preservation of conventional routing decisions outside the SD-WAN domain.

FortiGate SD-WAN zones are logical containers that group interfaces for traffic steering, route selection, and security-policy enforcement. The exhibit distinguishes zones from their underlying SD-WAN members through a hierarchical display.

Option C is correct. WAN1 is an empty, user-created zone and can be deleted because it has no SD-WAN member associations. The other zones must be evaluated according to their membership and whether they are system-defined.

WAN2 has an expansion indicator, showing that the zone contains member entries even though those entries are currently collapsed. Consequently, option A is incorrect: the absence of visible subordinate interfaces does not prove that a zone has no members.

HUB1 also has an expansion indicator. Its members are hidden by the collapsed view, so option D is incorrect.

The red icon is not a universal deletion indicator. In particular, the built-in virtual-wan-link zone must not be treated as an ordinary removable custom zone. An administrator must distinguish interface or zone operational status from configuration eligibility for deletion.

Before removing a custom zone, its members and any references in firewall policies or SD-WAN rules must be examined.

Policy 3 points traffic To = HUB1-VPN1, which is an SD-WAN member interface. In SD-WAN you must reference the SD-WAN zone (the logical interface) in policies, not its member tunnels. Change the policy’s To interface to the zone HUB1, and the install will succeed. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault. In the relevant Fortinet FortiManager documentation, the applicable feature should be verified against the deployed software version, the selected configuration mode and the live operational state before the answer is treated as a definitive implementation requirement.

FortiGate first establishes destination reachability and then evaluates the eligible members of the matching SD-WAN service. The exhibit reports that traffic for the corporate network is reaching HUB1-VPN3 even though HUB1-VPN1 appears earlier in member preference. Option C is supported if HUB1-VPN1 has no valid route for the exact destination prefix. An SD-WAN service cannot force traffic through an overlay member that does not provide reachability. The candidate ' s second answer, D, is less precise: the exhibit presents SD-WAN member preference or priority values, whereas the wording says ' route priority ' . FortiOS distinguishes route priority in the FIB from the preference order defined in an SD-WAN service. A smaller numerical member preference can influence forwarding, but it should not be described as proof of a more-preferred static route. Option A reverses the ranking, and option B invents an overriding conventional policy route not established by the diagnostic output. As presented, C is secure but the complete C,D pair depends on interpreting D as member priority rather than routing-table priority. Validate the actual route entries, their administrative distance and priority, and ' diagnose sys sdwan service4 ' before treating D as conclusive.

Verification qualification: The choice concerning route priority is imprecisely worded; displayed member priority is not necessarily static-route priority.

One SD-WAN rule is defined with application categories as the destination → The diagnose output shows application control matches such as Microsoft.Portal, Operational.Technology, and Social.Media, confirming that SD-WAN rules are using application categories as destinations. UDP traffic destined to the subnet 10.22.0.0/24 matches a policy route → The first entry (id=1) shows protocol=17 (UDP) with destination 10.22.0.0/24, confirming this traffic is handled by a policy route instead of an SD-WAN rule. FortiManager templates reduce repetitive work but must resolve to valid, device-specific configurations at installation time. Device assignments, metadata mappings, ADOM scope, policy-package interfaces and provisioning order should be inspected together rather than troubleshooting any one object in isolation. A successful management connection does not guarantee a successful configuration installation. Review the installation preview and task log, then validate the resulting device configuration and operational diagnostics. This separates a deployment-time validation failure from a live tunnel, routing or SLA fault.

The application-aware SD-WAN rule can initially route a connection through the implicit SD-WAN rule if its three-tuple (destination IP, port, protocol) has not yet been learned in the application cache. Once the application-control engine identifies GoToMeeting as a Collaboration application, session reevaluation can allow matching of the intended application rule. Depending on state, NAT and route changes, an existing session might not migrate successfully. This mechanism is not universally dependent on deep SSL inspection, and the configured Collaboration category is a legitimate match for GoToMeeting. The first cause is established; the second is a plausible interpretation not proven by the visible log alone. Reference: FortiOS 7.6 — Application Detection Steering; Fortinet Technical Tip — Application Learning Phases. An operational review should distinguish the rule that matches the traffic from the interface that is ultimately selected. Valid forwarding also depends on destination route eligibility, current member state and the applicable SLA or quality-selection algorithm. A diagnostic showing configured members alone is not conclusive evidence that all those members will carry a particular flow.

Verification qualification: The exhibit establishes initial application classification behavior, but not that session route refresh definitely failed.

According to the FortiSASE 25 Enterprise Administrator Study Guide, page 88, FortiClient automatically exits network lockdown when the endpoint is detected as on-net or successfully establishes a FortiSASE tunnel.

Option A is correct: FortiSASE uses on-net detection rules to identify whether an endpoint is connected to a trusted corporate network. When the endpoint satisfies the configured on-net rules, FortiClient can release network lockdown because internet traffic can be protected by the organization ' s on-premises security infrastructure, such as FortiGate.

Option B is correct: Network lockdown prevents unrestricted LAN and internet access when an off-net endpoint fails to establish its required FortiSASE tunnel within the configured grace period. Once the tunnel is successfully established, FortiClient releases the lockdown, allowing internet traffic to be secured through FortiSASE.

Option C is incorrect: Rebooting the endpoint does not independently satisfy either release condition. FortiClient continues enforcing the configured security requirements.

Option D is incorrect: Security posture tags evaluate endpoint compliance and support conditional access policies. However, posture compliance alone is not identified as a network-lockdown release condition.

The two documented release conditions are on-net detection and successful FortiSASE tunnel establishment.

Exact Source References:

FortiSASE 25 Enterprise Administrator Study Guide, page 86 — On-Net Rule Sets.

FortiSASE 25 Enterprise Administrator Study Guide, page 88 — On-Net and Off-Net Features—Network Lockdown.

FortiSASE-Sovereign 26.2.a Administration Guide, page 67 — On/Off-Net Settings.

The exhibit shows the following IPsec phase1-interface configuration applied on spoke tunnels: In the FCSS SD-WAN 7.6 ADVPN architecture, the network-overlay and network-id parameters are used to logically group IPsec tunnels into separate overlays. When network-overlay is enabled, FortiGate treats the tunnel as part of an overlay network rather than a simple transport tunnel. The network-id parameter is critical in multi-overlay ADVPN designs. Fortinet documentation specifies that ADVPN shortcuts are only allowed between tunnels that share the same network-id. This mechanism explicitly prevents cross-overlay shortcuts, ensuring that shortcuts are formed only within the same logical overlay and not across different overlays that may serve different purposes (for example, different hubs, regions, or transport groups). The use of auto-discovery-shortcuts dependent further enforces correct shortcut behavior by ensuring that shortcut tunnels depend on the state of the parent overlay tunnel, but it does not by itself prevent multiple shortcuts or convert ADVPN versions. Why the other options are incorrect: Therefore, the valid objective of these settings is to prevent cross-overlay shortcuts, which corresponds to Option C.