I85PREP
⌘ K
FCP study materials
FCP study resources

FCP: Routing and SD-WAN

FCP · Work through your exam, one topic at a time.

All guide sections

Routing and SD-WAN

Routing and SD-WAN tests how FortiGate selects paths and how SD-WAN rules override normal routing. Questions often ask why traffic uses a specific member, why an SLA failed, or why a policy route did not apply.

Routing fundamentals

  • Longest prefix match wins; administrative distance breaks ties between routes from different sources; metric breaks ties within a protocol.
  • Policy routes are evaluated before the routing table and can forward, deny, or steer traffic.
  • Static routes support distance and priority; dynamic routes from OSPF and BGP populate the RIB.
  • Reverse path forwarding and asymmetric routing affect sessions; SD-WAN can help but does not fix firewall state issues.

SD-WAN components

  • An SD-WAN zone groups member interfaces; members can have different gateways and costs.
  • Performance SLA health checks using ping, HTTP, or DNS determine member status; failing checks mark the link down for rule matching.
  • SD-WAN rules match by application, source, destination, or service and choose a member or load-balancing strategy.
  • Rules can use best quality or lowest cost and can specify priority; an implicit rule falls back to routing.
  • SD-WAN changes path selection, not security policy; policies must reference the zone or interfaces correctly. Service-based rules depend on ISDB updates.

Worked example

Two WAN links are members of an SD-WAN zone. A rule sends business traffic to the best-quality link, but the default route points to wan1. If the health check for wan2 fails, the rule will not select it; traffic may fall back to the implicit rule and then the default route. If the rule is set to manual with wan2, the SLA failure does not override the manual choice. To verify, check the performance SLA status and the rule strategy. SD-WAN rules are evaluated as policy routing, not as ordinary RIB entries.

Traps

  • SD-WAN zones and firewall zones are different objects, even if names look similar.
  • A ping health check may succeed while HTTP fails; match the probe to the traffic.
  • Policy routes and SD-WAN rules both precede the RIB; conflicting rules need clear priority.

Key points

  • Longest prefix match, distance, and metric determine route selection.
  • Policy routes and SD-WAN rules are evaluated before the routing table.
  • Performance SLA health checks determine SD-WAN member usability.
  • Manual SD-WAN rules do not automatically fail over on SLA failure.
  • SD-WAN zones and firewall zones are distinct object types.