I85PREP
⌘ K
FCSS SD-WAN 7.4 Architect study materials
FCSS SD-WAN 7.4 Architect study resources

FCSS SD-WAN 7.4 Architect: Secure SD-WAN Deployment

FCSS SD-WAN 7.4 Architect · Work through your exam, one topic at a time.

All guide sections

Secure SD-WAN Deployment

Secure SD-WAN Deployment

This domain tests how you turn a WAN design into a FortiGate SD-WAN configuration: SD-WAN zones and members, performance SLAs, underlay and overlay design, and repeatable deployment with FortiManager.

Core rules and concepts

  • SD-WAN zones. In FortiOS 7.4, member interfaces are grouped into one or more SD-WAN zones. Firewall policies and SD-WAN rules reference the zone, so a link can be replaced without rewriting policy. Group by business role, for example internet, MPLS, and LTE.
  • Members. Each member needs an interface, a gateway, and usually cost and priority. Cost drives the lowest-cost strategy; priority breaks ties.
  • Performance SLA. A health check (ping, HTTP, DNS, TCP echo, UDP echo, or TWAMP) measures latency, jitter, and packet loss. SLA targets set thresholds per member; failure and recovery thresholds stop flapping.
  • Overlay. IPsec overlays with ADVPN and BGP provide hub-and-spoke with dynamic spoke-to-spoke shortcuts. The underlay must support unique tunnel IPs, correct MTU, NAT traversal, and return routing.
  • Order of work. Address underlay, then overlay, then SD-WAN members, health checks, rules, routes, firewall policy, and security profiles. FortiManager templates should encode the same order.

Worked example

A branch has 100 Mbps fibre (cost 10) and 40 Mbps LTE (cost 100). Voice must use fibre unless latency exceeds 150 ms or loss exceeds 1%; guest traffic should use LTE whenever it meets a 300 ms SLA.

  1. Create an SD-WAN zone internet with both members; set costs 10 and 100.
  2. Create performance SLA voice-sla: ping every 500 ms, latency 150 ms, packet loss 1%, failure threshold 3, recovery threshold 3.
  3. Add a voice rule with strategy lowest-cost and SLA target voice-sla.
  4. Add a guest rule with lowest-cost and a looser SLA, placed after the voice rule.
  5. Add static routes to the SD-WAN zone, then permit the zone in firewall policy with the right profiles.

If fibre breaches the SLA, the voice rule falls to LTE because the SLA target is evaluated per member before strategy selection.

Traps

  • Referencing physical interfaces in policy instead of the SD-WAN zone, so the selected link is not permitted.
  • Configuring health checks but not attaching an SLA target to the rule, so the rule ignores health.
  • Missing return-path routing on the hub or ISP, making healthy links look down.
  • Reusing tunnel IPs or overlapping subnets across ADVPN spokes.