Fortinet FCP_FGT_AD-7.6 Questions & Answers

SD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule explains a different situation, sd-wan routing into zone, where an SD-WAN rule selects a preferred member but the routing table still sends traffic directly through a standalone WAN interface. It does not account for the specific observed default static route condition at Lakeview University. The decisive mechanism here is: Without a matching more-specific route or default route the firewall has no forwarding destination for outside prefixes.

Service-based steering cannot distinguish an application it has not correctly identified explains a different situation, application-aware steering, where critical voice sessions are routed as ordinary HTTPS because no application-aware matching is configured for the relevant SD-WAN service. It does not account for the specific observed default static route condition at Lakeview University. The decisive mechanism here is: Without a matching more-specific route or default route the firewall has no forwarding destination for outside prefixes.

A link can approach congestion before existing SLA probes show a definitive outage explains a different situation, sd-wan carrier capacity headroom, where one WAN link reaches sustained near-maximum bandwidth but the monitoring plan tracks only loss and latency. It does not account for the specific observed default static route condition at Lakeview University. The decisive mechanism here is: Without a matching more-specific route or default route the firewall has no forwarding destination for outside prefixes.

A route lookup and test session both select the configured SD-WAN path would validate the separate control sd-wan routing into zone, not the fault reported for Lakeview University. To confirm this correction, the team instead needs: An authorized remote test resolves a valid route and completes a returnable connection. That is the observable check related to default static route.

A supervised voice test uses the intended SLA rule while unrelated HTTPS remains on its normal path would validate the separate control application-aware steering, not the fault reported for Lakeview University. To confirm this correction, the team instead needs: An authorized remote test resolves a valid route and completes a returnable connection. That is the observable check related to default static route.

Peak-load tests distribute new sessions without exceeding approved provider headroom would validate the separate control sd-wan carrier capacity headroom, not the fault reported for Lakeview University. To confirm this correction, the team instead needs: An authorized remote test resolves a valid route and completes a returnable connection. That is the observable check related to default static route.

Test route and SD-WAN rule interaction during WAN migrations reduces recurrence of sd-wan routing into zone, rather than the observed default static route issue. The relevant preventive control for Lakeview University is: Verify the default next hop after WAN gateway changes. This distinction matters because without a matching more-specific route or default route the firewall has no forwarding destination for outside prefixes.

Revalidate application matching after protocol updates reduces recurrence of application-aware steering, rather than the observed default static route issue. The relevant preventive control for Lakeview University is: Verify the default next hop after WAN gateway changes. This distinction matters because without a matching more-specific route or default route the firewall has no forwarding destination for outside prefixes.

Forecast traffic growth and link contract limits reduces recurrence of sd-wan carrier capacity headroom, rather than the observed default static route issue. The relevant preventive control for Lakeview University is: Verify the default next hop after WAN gateway changes. This distinction matters because without a matching more-specific route or default route the firewall has no forwarding destination for outside prefixes.

Configure suitable performance SLA packet-loss thresholds and a rule that respects service quality is a relevant remedy for a DIFFERENT problem—sla packet loss threshold—when voice traffic remains on a lossy ISP circuit because SD-WAN health checks monitor only link availability. In this Lakeview Logistics case that is not the failing component. Here the correct intervention is to add or correct the precise destination static route toward the intended private tunnel because route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

Configure supported DSCP-aware SD-WAN service matching or related traffic policy is a relevant remedy for a DIFFERENT problem—sd-wan dscp handling—when voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. In this Lakeview Logistics case that is not the failing component. Here the correct intervention is to add or correct the precise destination static route toward the intended private tunnel because route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

Set a supported maintenance-safe alternate member or route before draining the primary is a relevant remedy for a DIFFERENT problem—sd-wan preferred route during maintenance—when an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. In this Lakeview Logistics case that is not the failing component. Here the correct intervention is to add or correct the precise destination static route toward the intended private tunnel because route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

A link can remain up while packet loss makes real-time applications unusable explains a different situation, sla packet loss threshold, where voice traffic remains on a lossy ISP circuit because SD-WAN health checks monitor only link availability. It does not account for the specific observed longest-prefix route selection condition at Lakeview Logistics. The decisive mechanism here is: Route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

Packet QoS markings do not automatically change link steering absent a matching rule explains a different situation, sd-wan dscp handling, where voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. It does not account for the specific observed longest-prefix route selection condition at Lakeview Logistics. The decisive mechanism here is: Route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

Explicit steering constraints can prevent normal traffic from moving when the only eligible member is unavailable explains a different situation, sd-wan preferred route during maintenance, where an operator disables a WAN member for planned maintenance but the documentation says the service is pinned to that member with no fallback. It does not account for the specific observed longest-prefix route selection condition at Lakeview Logistics. The decisive mechanism here is: Route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

A controlled packet-loss test shifts new voice traffic to the healthier eligible link would validate the separate control sla packet loss threshold, not the fault reported for Lakeview Logistics. To confirm this correction, the team instead needs: A route lookup selects the intended tunnel for the specific subnet and internet destinations still use default. That is the observable check related to longest-prefix route selection.

A tagged test voice flow is forwarded through the planned member would validate the separate control sd-wan dscp handling, not the fault reported for Lakeview Logistics. To confirm this correction, the team instead needs: A route lookup selects the intended tunnel for the specific subnet and internet destinations still use default. That is the observable check related to longest-prefix route selection.

An authorized maintenance test continues service on the approved alternate path would validate the separate control sd-wan preferred route during maintenance, not the fault reported for Lakeview Logistics. To confirm this correction, the team instead needs: A route lookup selects the intended tunnel for the specific subnet and internet destinations still use default. That is the observable check related to longest-prefix route selection.

Tune SLA thresholds against measured voice quality reduces recurrence of sla packet loss threshold, rather than the observed longest-prefix route selection issue. The relevant preventive control for Lakeview Logistics is: Test overlapping route summaries when adding private networks. This distinction matters because route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

Verify markings and rule order across the path reduces recurrence of sd-wan dscp handling, rather than the observed longest-prefix route selection issue. The relevant preventive control for Lakeview Logistics is: Test overlapping route summaries when adding private networks. This distinction matters because route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

Create WAN maintenance runbooks with rollback and SLA verification reduces recurrence of sd-wan preferred route during maintenance, rather than the observed longest-prefix route selection issue. The relevant preventive control for Lakeview Logistics is: Test overlapping route summaries when adding private networks. This distinction matters because route selection prefers a longest matching destination prefix ahead of less-specific alternatives.

Add a relevant latency SLA target and suitable service rule for the affected traffic is a relevant remedy for a DIFFERENT problem—sla latency limit—when remote desktop sessions suffer delay when the lowest-cost WAN meets connectivity but exceeds the allowed round-trip latency. In this Lakeview Manufacturing case that is not the failing component. Here the correct intervention is to review and set compatible administrative distance values for the preferred route because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

Tune supported health-check failure and recovery thresholds for stable link selection is a relevant remedy for a DIFFERENT problem—sd-wan failover recovery hysteresis—when a flapping WAN repeatedly regains preferred status and disrupts interactive connections. In this Lakeview Manufacturing case that is not the failing component. Here the correct intervention is to review and set compatible administrative distance values for the preferred route because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

Review supported ECMP settings and choose a deliberate load-balancing or preferred-path design is a relevant remedy for a DIFFERENT problem—ecmp equal-cost forwarding—when two equivalent WAN routes are installed but traffic is spread across them unexpectedly. In this Lakeview Manufacturing case that is not the failing component. Here the correct intervention is to review and set compatible administrative distance values for the preferred route because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

Basic link status alone cannot distinguish a high-latency but reachable WAN explains a different situation, sla latency limit, where remote desktop sessions suffer delay when the lowest-cost WAN meets connectivity but exceeds the allowed round-trip latency. It does not account for the specific observed static route distance preference condition at Lakeview Manufacturing. The decisive mechanism here is: For otherwise equivalent destinations, route preference depends on route distance and eligibility.

Overly sensitive probes can alternate link eligibility during transient packet loss explains a different situation, sd-wan failover recovery hysteresis, where a flapping WAN repeatedly regains preferred status and disrupts interactive connections. It does not account for the specific observed static route distance preference condition at Lakeview Manufacturing. The decisive mechanism here is: For otherwise equivalent destinations, route preference depends on route distance and eligibility.

Equal-cost eligible routes can distribute new sessions instead of behaving as strict standby routes explains a different situation, ecmp equal-cost forwarding, where two equivalent WAN routes are installed but traffic is spread across them unexpectedly. It does not account for the specific observed static route distance preference condition at Lakeview Manufacturing. The decisive mechanism here is: For otherwise equivalent destinations, route preference depends on route distance and eligibility.

A supervised delay condition causes the intended low-latency path selection would validate the separate control sla latency limit, not the fault reported for Lakeview Manufacturing. To confirm this correction, the team instead needs: The expected primary route is installed and a controlled failure selects the backup. That is the observable check related to static route distance preference.

A simulated intermittent outage produces the intended stable hold-down and recovery would validate the separate control sd-wan failover recovery hysteresis, not the fault reported for Lakeview Manufacturing. To confirm this correction, the team instead needs: The expected primary route is installed and a controlled failure selects the backup. That is the observable check related to static route distance preference.

A series of controlled sessions uses the documented link-selection behavior would validate the separate control ecmp equal-cost forwarding, not the fault reported for Lakeview Manufacturing. To confirm this correction, the team instead needs: The expected primary route is installed and a controlled failure selects the backup. That is the observable check related to static route distance preference.

Track SLA latency distributions across provider changes reduces recurrence of sla latency limit, rather than the observed static route distance preference issue. The relevant preventive control for Lakeview Manufacturing is: Document route-distance intent before changing secondary links. This distinction matters because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

Monitor link flaps and adjust SLA stability thresholds reduces recurrence of sd-wan failover recovery hysteresis, rather than the observed static route distance preference issue. The relevant preventive control for Lakeview Manufacturing is: Document route-distance intent before changing secondary links. This distinction matters because for otherwise equivalent destinations, route preference depends on route distance and eligibility.

Record ECMP expectations when adding same-distance routes reduces recurrence of ecmp equal-cost forwarding, rather than the observed static route distance preference issue. The relevant preventive control for Lakeview Manufacturing is: Document route-distance intent before changing secondary links. This distinction matters because for otherwise equivalent destinations, route preference depends on route distance and eligibility.