FCSS SD-WAN 7.4 Architect flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SD-WAN member

A physical or logical interface (or IPsec overlay) participating in SD-WAN, configured with a gateway, cost, and priority used by the selection algorithm.

Performance SLA

A named set of latency, jitter, and packet-loss thresholds evaluated by a health check; members failing all targets are treated as out-of-SLA.

ADVPN

Auto-Discovery VPN using IPsec plus BGP so spokes can build dynamic shortcut tunnels to each other, bypassing the hub for spoke-to-spoke traffic.

SD-WAN zone

A logical grouping of SD-WAN members referenced by firewall policies and routes, so member changes do not require policy rewrites.

IPsec overlay MTU

The phase1 MTU setting reduced to account for ESP overhead; too-high values cause fragmentation on DSL or LTE links.

Route reflector role

In ADVPN, the hub often acts as BGP route reflector or uses next-hop-self so spokes learn overlay routes through the hub.

SD-WAN implicit rules

Built-in rules (SD-WAN implicit, load-balancing, BGP, static route) evaluated below explicit rules when no explicit rule matches a flow.

Best-quality strategy

An SD-WAN rule strategy that selects the member with the best measured SLA performance (lowest latency, jitter, and loss) among in-SLA members.

Maximize-bandwidth strategy

An SD-WAN rule strategy that load-balances a flow across members to aggregate available bandwidth, typically for bulk or non-stateful traffic.

Health-check protocols

Performance SLA probes can be ping, TCP echo, HTTP, or UDP echo; the probe type determines what the SLA measures and which server is reachable.

update-static-route

A performance SLA option that, when enabled, withdraws the member's static route if the SLA fails, steering traffic to remaining members.

SD-WAN and routing table

SD-WAN rules select the egress member; the routing table then resolves the next-hop on that member. SD-WAN does not replace routing.

FEC in SD-WAN

Forward error correction adds redundant packets to recover loss without retransmission; configured on IPsec phase1 or the SD-WAN member for lossy links.

Session stickiness

Load-balancing SD-WAN rules can break stateful sessions; manual or best-quality strategies keep a flow on one member for its lifetime.

BGP sdwan-zone

A BGP neighbor option binding the neighbor to the SD-WAN zone so the session follows member changes and ADVPN shortcuts install correctly.

ISDB steering

Using internet service database objects as SD-WAN rule match criteria to steer SaaS and cloud traffic to a preferred member.

SD-WAN rule match criteria

Explicit SD-WAN rules match on source/destination address, internet service, application, user/group, DSCP, and protocol to select a member.

Policy order with SD-WAN

Firewall policy references the SD-WAN zone; the SD-WAN rule picks the member, then security profiles apply to the session.

DSCP preservation

SD-WAN rules can match DSCP to prioritize voice and video; DSCP must be preserved across IPsec or explicitly set to keep priority.

Overlay security profiles

Internet-bound SD-WAN policies carry IPS, antivirus, web filter, and SSL inspection; overlay-to-overlay policies typically need lighter inspection.

ZTNA steering

For private application access, SD-WAN steers traffic to the ZTNA gateway rather than exposing internal applications directly on WAN members.

SD-WAN template

A FortiManager template that defines SD-WAN members, performance SLAs, and rules; it references interfaces created by the system template.

diagnose sys sdwan service

A CLI command listing each SD-WAN rule, the member(s) it selected, and the current SLA status for matched flows.

diagnose sys sdwan health-check

A CLI command showing each performance SLA's probe results per member, including latency, jitter, packet loss, and up/down state.

diagnose sys sdwan member

A CLI command showing each SD-WAN member's interface, gateway, cost, priority, and current in-SLA or out-of-SLA state.

SLA member down cause

A member marked down by a performance SLA usually means the health-check target is unreachable from that member; verify source IP and route.

ADVPN shortcut verification

Use diagnose vpn ike gateway list, diagnose ipsec tunnel list, and BGP summary to confirm spoke-to-spoke shortcut tunnels are established.

FortiAnalyzer SD-WAN logs

Performance SLA logs feed FortiAnalyzer SD-WAN dashboards and FortiView, showing per-member quality trends over time when logging is enabled.

Install preview

A FortiManager feature showing per-device config diffs before install; use it to validate SD-WAN template changes and catch failed installs.

get system sdwan

A CLI command displaying the running SD-WAN configuration, including members, zones, health checks, and rules, for verification against intended design.

diagnose sys sdwan route

A CLI command showing SD-WAN route entries and the member selected for each destination, useful when traffic uses an unexpected WAN link.

SD-WAN wizard

A FortiOS 7.4 guided flow that creates members, performance SLAs, SD-WAN rules, and static routes; verify implicit zone membership afterward.