FCSS_SDW_AR-7.4

Two hub-and-spoke groups are connected through redundant site-to-site IPsec VPNs between Hub 1

and Hub 2

Which two configuration settings are required for the spoke A1 to establish an ADVPN shortcut with

the spoke B2? (Choose two.)

• On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to hubs.

• On hubs, auto-discovery-receiver must be enabled on the IPsec VPNs to spokes.

• On hubs, auto-discovery-forwarder must be enabled on the IPsec VPNs to spokes.

• On hubs, auto-diacovery-sender must be enabled on the IPsec VPNs to spokes

Which SD-WAN rule and interface uses FortiGate to steer the traffic from the LAN subnet 10.0.1.0/24

to the corporate server 10.2.5.254?

• SD-WAN service rule 3 and interface HUB1-VPN2.

• SD-WAN service rule 3 and interface HUB1-VPN3.

• SD-WAN service rule 4 and port1 or port2.

• SD-WAN service rule 4 and interface port2.

Refer to the exhibit.

You want to configure SD-WAN on a network as shown in the exhibit.

The network contains many FortiGate devices. Some are used as NGFW, and some are installed with

extensions such as FortiSwitch. FortiAP. or Forti Ex tender.

What should you consider when planning your deployment?

• You can build an SD-WAN topology that includes all devices. The hubs can be FortiGate devices

  with Forti Extender.

• You can build an SD-WAN topology that includes all devices. The hubs must be devices without

  extensions.

• You must use FortiManager to manage your SD-WAN topology.

• You must build multiple SD-WAN topologies. Each topology must contain only one type of

  extension.

Refer to the exhibit that shows event logs on FortiGate.

Based on the output shown in the exhibit, what can you say about the tunnels on this device?

• The master tunnel HU82-VPN3 cannot accept ADVPN shortcuts.

• The device steers voice traffic through the VPN tunnel HUB1-VPN3.

• The VPN tunnel HUB1-VPN1_0 is a shortcut tunnel.

• There is one shortcut tunnel built from master tunnel VPN4.

Which action will FortiGate take if it detects SD-WAN members as dead?

• FoftiGate bounces port5 after it detects all SD-WAN members as dead.

• FortiGate fails over to the secondary device after it detects port5 as dead.

• FortiGate sends alert messages through poft5 when it detects all SD-WAN members as dead

• FortiGate brings down port5 after it detects all SD-WAN members as dead.

You are planning a large SD-WAN deployment with approximately 1000 spokes and want to allow

ADVPN between the spokes. Some remote sites use FortiSASE to connect to the company's SD-WAN

hub. Which overlay routing configuration should you use?

• BGP on loopback with dynamic BGP for ADVPN shortcut routing.

• BGP on loopback with IPsec phase2 selectors for ADVPN shortcut routing.

• BGP per overlay with dynamic BGP for ADVPN shortcut routing.

• BGP per overlay with BGP next-hop convergence for ADVPN shortcut routing.

You connect to a device behind a branch FortiGate device and initiate a ping test. The device is part

of the LAN subnet and its IP address is 10.0.1.101. Based on the exhibits, which interface uses branch 1_fgt to steer the test traffic?

• port4

• HUB1-VPN1

• port1

• port2

You manage an SD-WAN topology. You will soon deploy 50 new branches.

Which three tasks can you do in advance to simplify this deployment? (Choose three.)

• Update the DHCP server configuration.

• Create model devices.

• Create a ZTP template.

• Define metadata variables value for each device.

• Create policy blueprint.

An administrator configures SD-WAN rules for a DIA setup using the FortiGate GUI. The page to

configure the source and destination part of the rule looks as shown in the exhibit. The GUI page

shows no option to configure an application as the destination of the SD-WAN rule Why?

• You cannot use applications as the destination when FortiGate is used for a DIA setup.

• FortiGate allows the configuration of applications as the destination of SD-WAN rules only on the

  CLI.

• You must enable the feature on the CLI.

• You must enable the feature first using the GUI menu System > Feature Visibility.

You are planning a new SD-WAN deployment with the following criteria:

• - Two regions

• - Most of the traffic is expected to remain within its region

• - No requirement for inter-region ADVPN

• To remain within the recommended best practices, which routing protocol should you select for the

  overlays?

• OSPF for the routing within each region and EBGP between the regions.

• IBGP with BGP on loopback within each region and EBGP between the regions.

• IBGP with BGP per overlays within each region and IBGP with BGP on loopback between the

  regions.

• IBGP within each region and between the regions.