Fortinet FCSS - SD-WAN 7.4 Architect Free Sample Questions

Establishing a BGP neighborship between the regional hubs is crucial for them to exchange spoke routing information. This allows a hub in one region to learn about the spokes connected to the hub in the other region, which is a prerequisite for shortcut negotiation.

Enabling auto-discovery sender and receiver roles on the IPsec tunnel connecting the two hubs allows them to forward IKE messages related to shortcut negotiation on behalf of their respective spokes. This is the core mechanism that facilitates inter-region shortcuts.

A metadata variable (e.g., $(lan_subnet)) is the correct feature. The architect can define this variable in the template's address object and then assign the specific subnet value for each branch in the device manager settings. FortiManager will substitute the correct value during deployment.

The "no proposal chosen" error message specifically indicates that the IKE peers (hub and spoke) could not agree on a common set of security parameters during either Phase 1 or Phase 2 negotiation. This is caused by a mismatch in the configured encryption algorithms, authentication methods, Diffie-Hellman groups, or key lifetimes.

When using the 'Best Quality' strategy, FortiGate first disqualifies any member that violates the SLA (in this case, MPLS). From the remaining members that are within SLA (DIA-1 and DIA-2), it will select the one with the best performance based on the SLA criteria (latency). If multiple links are viable, it may load-balance or prefer the best one, but it will only use the links that meet the SLA.

True. The SD-WAN Overlay Template in FortiManager is a powerful automation tool. It can be configured to not only create the IPsec tunnels but also to automatically generate the corresponding BGP configurations for the hub and spokes, significantly simplifying the deployment of dynamic routing across the overlay.

This is the correct approach. The 'Best Quality' strategy makes its decision based on the metrics defined in the selected Performance SLA. By creating an SLA that exclusively measures jitter, the architect ensures that the path selection for the specified applications will be based solely on which active link has the lowest jitter.

In the absence of any explicit SD-WAN rules, traffic is matched by the default implicit rule. The default behavior of this rule is to load-balance traffic across all available SD-WAN member interfaces using a source IP-based algorithm.

For hubs to facilitate shortcuts for spokes that are not their direct clients, they must be able to forward the IKE information messages used for negotiation. The set auto-discovery-forwarder enable command on the hub's Phase 1 interface allows it to forward these messages to the other hub, which is essential for inter-hub shortcut establishment.

A new FortiGate, by default, will act as a DHCP client on its WAN interface. It can receive the FortiManager's IP address via DHCP option 240, which is one of the primary methods for ZTP discovery.

If DHCP discovery fails or is not configured, the FortiGate will attempt to resolve a predefined FQDN (e.g., fortimanager.fortinet.net or a custom one) to find the IP address of its FortiManager, making DNS a key part of the ZTP discovery process.

This command provides a detailed, real-time view of each configured Performance SLA health check, showing which member interfaces are being monitored, their current status (alive or dead), and the measured values for latency, jitter, and packet loss.