I85PREP
⌘ K
FCSS SASE Architect study materials
FCSS SASE Architect study resources

FCSS SASE Architect: Secure SD-WAN: SLA Steering and SASE Integration

FCSS SASE Architect · Work through your exam, one topic at a time.

All guide sections

Secure SD-WAN: SLA Steering and SASE Integration

Secure SD-WAN tests FortiGate SD-WAN design: multiple WAN links, health checks, SLA-based application steering, overlays, and integration with FortiSASE. Expect questions that ask which rule or path wins when a link degrades, and how branch SD-WAN complements cloud-delivered security.

Core SD-WAN rules

  • FortiGate SD-WAN uses member interfaces and zones, health checks, and SD-WAN rules to select an egress path. Rules can match source, destination, application, user, and service.
  • Health checks measure reachability, latency, jitter, and packet loss. An SLA ties an application requirement to acceptable thresholds; a member that fails the SLA is de-prioritized for that rule.
  • Steering strategies include lowest cost, best quality, priority, and manual order. Voice typically needs latency/jitter-sensitive steering; bulk traffic can use a cheaper link.
  • Overlay tunnels such as IPsec to a hub, data center, or FortiSASE PoP provide encrypted transport and can be monitored by SD-WAN health checks.
  • ADVPN can create dynamic spoke-to-spoke tunnels, but policy and routing must still be designed so traffic does not bypass inspection.

Worked example

A branch has a low-cost broadband link and a higher-cost business link. Voice must use a path with latency under 100 ms and jitter under 20 ms. Bulk backup traffic should use the cheapest path. An SD-WAN rule for voice references the SLA health check and permits either member that meets the SLA; a second rule sends bulk traffic to the broadband member. When broadband violates jitter, voice moves to the business link. Internet-bound traffic is tunneled to the nearest FortiSASE PoP for inspection; private traffic uses the data-center overlay.

Reasoning: the SD-WAN rule selects the member based on application and SLA, not a static default route. Health checks provide the measured condition. The overlay carries traffic to the security enforcement point without giving up underlay resiliency.

Traps that cost marks

  • Confusing an SD-WAN rule with a static route; rule order and matching matter.
  • Setting SLA thresholds without a health check that measures the required metric.
  • Assuming SD-WAN is only load balancing; it is application-aware steering with failover.
  • Designing overlays that send private traffic through an uninspected shortcut.
  • Forgetting return-path symmetry, which can break stateful inspection.
  • Treating FortiSASE as a replacement for branch SD-WAN rather than a security integration point.