I85PREP
⌘ K
FCSS SD-WAN 7.4 Architect study materials
FCSS SD-WAN 7.4 Architect study resources

FCSS SD-WAN 7.4 Architect: Secure SD-WAN Centralized Management and Troubleshooting

FCSS SD-WAN 7.4 Architect · Work through your exam, one topic at a time.

All guide sections

Secure SD-WAN Centralized Management and Troubleshooting

Secure SD-WAN Centralized Management and Troubleshooting

This domain tests operating SD-WAN at scale with FortiManager and FortiAnalyzer, and diagnosing why a rule, link, or SLA is not behaving as designed. Expect questions on templates, metadata variables, installation workflow, monitoring, and CLI diagnostics.

Core rules and concepts

  • FortiManager SD-WAN Manager. SD-WAN Manager provides overlay and SD-WAN templates for zones, members, performance SLAs, and rules. Templates are assigned to devices or device groups and installed as a policy package.
  • Metadata variables. Variables such as interface names, IP addresses, and link costs let one template serve many branches. Variables are resolved per device or per model; unresolved variables block installation.
  • Provisioning versus policy. Interface and system settings usually come from provisioning templates; firewall policy and SD-WAN rules can come from policy packages. Keep the ownership boundary clear to avoid conflicting edits.
  • FortiAnalyzer monitoring. FortiAnalyzer receives SD-WAN logs and provides SD-WAN Monitor views and SLA history. If logs are not enabled or the log setting is wrong, the monitor is empty even though the FortiGate is healthy.
  • CLI diagnostics. diagnose sys sdwan health-check shows member health; diagnose sys sdwan service shows rule selection and SLA state; diagnose sys sdwan member shows member configuration; diagnose sys sdwan route shows SD-WAN routes. Use diagnose debug flow and diagnose firewall proute list to see why a session took a path.

Worked example

A new branch is deployed from a FortiManager SD-WAN template with two links. The voice rule works at headquarters but not at the branch, and FortiAnalyzer shows no SLA data for the branch.

  1. Check the device assignment and installation history; confirm the SD-WAN template and policy package were installed, not only saved.
  2. Run diagnose sys sdwan health-check on the branch; if members are down, check underlay routing and gateway reachability.
  3. Run diagnose sys sdwan service; confirm the voice rule matches and the SLA target is attached.
  4. Check that the firewall policy permits the branch SD-WAN zone; a rule can select a member that policy then drops.
  5. Confirm log settings and FortiAnalyzer connectivity; without logs, SLA history and SD-WAN Monitor remain empty.

Traps

  • Editing a template-managed object directly on the FortiGate; the next install overwrites it.
  • Confusing save with install in FortiManager workflow.
  • Leaving a metadata variable unresolved, which fails installation or produces wrong interface names.
  • Treating a green health check as proof of end-to-end forwarding; policy, routing, and return path still apply.