I85PREP
⌘ K
FCSS SD-WAN 7.4 Architect study materials
FCSS SD-WAN 7.4 Architect study resources

FCSS SD-WAN 7.4 Architect: Secure SD-WAN Routing and WAN Optimization

FCSS SD-WAN 7.4 Architect · Work through your exam, one topic at a time.

All guide sections

Secure SD-WAN Routing and WAN Optimization

Secure SD-WAN Routing and WAN Optimization

This domain tests route selection over SD-WAN and the FortiGate features that improve WAN efficiency. Expect questions on SD-WAN routes, BGP and OSPF, policy-route precedence, ECMP, WAN optimization tunnels, and loss-mitigation features.

Core rules and concepts

  • SD-WAN routes. Static routes can point to an SD-WAN zone. Dynamic routes from BGP or OSPF become SD-WAN routes when they carry the configured route tag. config system sdwan has a route-tag; route maps set that tag on inbound or redistributed routes.
  • Lookup order. Policy routes are evaluated before SD-WAN rules, and SD-WAN rules before the routing table. A policy route can therefore bypass an SD-WAN rule; use policy routes deliberately.
  • ECMP and health. Multiple routes to the same destination over SD-WAN members create ECMP. Without health checks and SLA targets, traffic can be hashed onto a failed or degraded link.
  • WAN optimization. FortiGate WAN optimization uses tunnels between FortiGate peers and can apply protocol optimization (CIFS, MAPI, HTTP), byte caching, and web caching. It requires a WAN optimization profile, peer configuration, and a firewall policy with WAN optimization enabled.
  • Loss mitigation. SD-WAN rules can enable forward error correction or packet duplication on lossy links. Both consume extra bandwidth; they are not substitutes for a health-check SLA.

Worked example

A hub advertises a data-centre prefix to spokes with BGP. The design wants that prefix reachable over the SD-WAN overlay, with a backup static route over LTE.

  1. On the hub, create a route map that sets tag 100 on the advertised prefix and apply it outbound to the BGP neighbour.
  2. On each spoke, set route-tag 100 in the SD-WAN configuration so the learned route is installed as an SD-WAN route.
  3. Confirm the BGP route appears with the tag and is resolved to the overlay SD-WAN zone.
  4. Add a static route to the same prefix with a higher distance or lower priority over LTE.
  5. Attach an SLA target to the SD-WAN rule so the BGP path is preferred only while it meets the SLA.

If the tag is missing, the route is still installed but is not treated as an SD-WAN route, so SD-WAN rule selection and health-based failover do not apply to it.

Traps

  • Mismatched route tags between BGP/OSPF and config system sdwan, which silently disables SD-WAN treatment.
  • Assuming SD-WAN rules beat policy routes; a broad policy route can pre-empt them.
  • Enabling WAN optimization on one side only; both peers need matching profiles.
  • Forgetting that FEC and duplication add overhead and can worsen congestion.