Fortinet FCP_FGT_AD-7.6 Questions & Answers

A gateway-only probe can stay green during upstream outages beyond the access router explains a different situation, health-check probe target choice, where fortiGate declares a circuit healthy because it probes only its local ISP gateway while overseas applications are unreachable. It does not account for the specific observed static route failover link monitoring condition at Lakeview Energy Cooperative. The decisive mechanism here is: An interface's carrier state does not prove upstream end-to-end reachability.

Service-based steering cannot distinguish an application it has not correctly identified explains a different situation, application-aware steering, where critical voice sessions are routed as ordinary HTTPS because no application-aware matching is configured for the relevant SD-WAN service. It does not account for the specific observed static route failover link monitoring condition at Lakeview Energy Cooperative. The decisive mechanism here is: An interface's carrier state does not prove upstream end-to-end reachability.

VDOMs maintain independent route contexts and do not automatically share forwarding entries explains a different situation, route monitoring across vdoms, where a route is added within one VDOM while the application interfaces belong to a different VDOM routing table. It does not account for the specific observed static route failover link monitoring condition at Lakeview Energy Cooperative. The decisive mechanism here is: An interface's carrier state does not prove upstream end-to-end reachability.

A simulated upstream failure changes SLA status and steering according to design would validate the separate control health-check probe target choice, not the fault reported for Lakeview Energy Cooperative. To confirm this correction, the team instead needs: A controlled remote outage removes or deprioritizes the unusable path and uses the backup. That is the observable check related to static route failover link monitoring.

A supervised voice test uses the intended SLA rule while unrelated HTTPS remains on its normal path would validate the separate control application-aware steering, not the fault reported for Lakeview Energy Cooperative. To confirm this correction, the team instead needs: A controlled remote outage removes or deprioritizes the unusable path and uses the backup. That is the observable check related to static route failover link monitoring.

The expected route is visible in the correct VDOM and traffic follows its permitted path would validate the separate control route monitoring across vdoms, not the fault reported for Lakeview Energy Cooperative. To confirm this correction, the team instead needs: A controlled remote outage removes or deprioritizes the unusable path and uses the backup. That is the observable check related to static route failover link monitoring.

Review probe destinations with application network paths reduces recurrence of health-check probe target choice, rather than the observed static route failover link monitoring issue. The relevant preventive control for Lakeview Energy Cooperative is: Test remote failures rather than only unplugging local cables. This distinction matters because an interface's carrier state does not prove upstream end-to-end reachability.

Revalidate application matching after protocol updates reduces recurrence of application-aware steering, rather than the observed static route failover link monitoring issue. The relevant preventive control for Lakeview Energy Cooperative is: Test remote failures rather than only unplugging local cables. This distinction matters because an interface's carrier state does not prove upstream end-to-end reachability.

Label VDOM context in all routing work instructions reduces recurrence of route monitoring across vdoms, rather than the observed static route failover link monitoring issue. The relevant preventive control for Lakeview Energy Cooperative is: Test remote failures rather than only unplugging local cables. This distinction matters because an interface's carrier state does not prove upstream end-to-end reachability.

Add the supported WAN interface to the intended SD-WAN zone and verify its gateway settings is a relevant remedy for a DIFFERENT problem—sd-wan member underlay onboarding—when a new secondary ISP circuit comes online but FortiGate SD-WAN never sends traffic through it because the physical interface is not configured as a member. In this Lakeview Utilities case that is not the failing component. Here the correct intervention is to correct the relevant static routes and reciprocal paths to preserve intended session symmetry because stateful forwarding expects return packets to traverse the same usable security session path.

Place the specific application-aware service rule ahead of the generic fallback as appropriate is a relevant remedy for a DIFFERENT problem—sd-wan rule first-match ordering—when generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. In this Lakeview Utilities case that is not the failing component. Here the correct intervention is to correct the relevant static routes and reciprocal paths to preserve intended session symmetry because stateful forwarding expects return packets to traverse the same usable security session path.

Configure supported DSCP-aware SD-WAN service matching or related traffic policy is a relevant remedy for a DIFFERENT problem—sd-wan dscp handling—when voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. In this Lakeview Utilities case that is not the failing component. Here the correct intervention is to correct the relevant static routes and reciprocal paths to preserve intended session symmetry because stateful forwarding expects return packets to traverse the same usable security session path.

An up physical interface is not automatically eligible for SD-WAN service selection explains a different situation, sd-wan member underlay onboarding, where a new secondary ISP circuit comes online but FortiGate SD-WAN never sends traffic through it because the physical interface is not configured as a member. It does not account for the specific observed asymmetric return route condition at Lakeview Utilities. The decisive mechanism here is: Stateful forwarding expects return packets to traverse the same usable security session path.

SD-WAN service rule order can determine which steering rule governs a matching session explains a different situation, sd-wan rule first-match ordering, where generic internet SD-WAN service selection consumes traffic before a later specialized finance application rule. It does not account for the specific observed asymmetric return route condition at Lakeview Utilities. The decisive mechanism here is: Stateful forwarding expects return packets to traverse the same usable security session path.

Packet QoS markings do not automatically change link steering absent a matching rule explains a different situation, sd-wan dscp handling, where voice packets carry the expected DSCP marking but FortiGate sends them through an unintended WAN member. It does not account for the specific observed asymmetric return route condition at Lakeview Utilities. The decisive mechanism here is: Stateful forwarding expects return packets to traverse the same usable security session path.

The link appears as a healthy SD-WAN member and receives an approved test flow would validate the separate control sd-wan member underlay onboarding, not the fault reported for Lakeview Utilities. To confirm this correction, the team instead needs: A bidirectional packet trace follows the expected ingress and return interfaces. That is the observable check related to asymmetric return route.

A tagged finance session uses its intended provider and other traffic follows fallback would validate the separate control sd-wan rule first-match ordering, not the fault reported for Lakeview Utilities. To confirm this correction, the team instead needs: A bidirectional packet trace follows the expected ingress and return interfaces. That is the observable check related to asymmetric return route.

A tagged test voice flow is forwarded through the planned member would validate the separate control sd-wan dscp handling, not the fault reported for Lakeview Utilities. To confirm this correction, the team instead needs: A bidirectional packet trace follows the expected ingress and return interfaces. That is the observable check related to asymmetric return route.

Review membership when adding or replacing WAN circuits reduces recurrence of sd-wan member underlay onboarding, rather than the observed asymmetric return route issue. The relevant preventive control for Lakeview Utilities is: Check both directions when static routes change. This distinction matters because stateful forwarding expects return packets to traverse the same usable security session path.

Review specific-to-general rule precedence during changes reduces recurrence of sd-wan rule first-match ordering, rather than the observed asymmetric return route issue. The relevant preventive control for Lakeview Utilities is: Check both directions when static routes change. This distinction matters because stateful forwarding expects return packets to traverse the same usable security session path.

Verify markings and rule order across the path reduces recurrence of sd-wan dscp handling, rather than the observed asymmetric return route issue. The relevant preventive control for Lakeview Utilities is: Check both directions when static routes change. This distinction matters because stateful forwarding expects return packets to traverse the same usable security session path.

Align supported static or dynamic routes with the intended SD-WAN zone and service rules is a relevant remedy for a DIFFERENT problem—sd-wan routing into zone—when an SD-WAN rule selects a preferred member but the routing table still sends traffic directly through a standalone WAN interface. In this Lakeview Biotechnology case that is not the failing component. Here the correct intervention is to review the effective FortiGate routing table and session details rather than only saved route configuration because configured candidate routes may be inactive or shadowed by preferred and connected routes.

Configure supported SLA-aware primary and fallback member behavior is a relevant remedy for a DIFFERENT problem—sd-wan preferred-member failover—when a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. In this Lakeview Biotechnology case that is not the failing component. Here the correct intervention is to review the effective FortiGate routing table and session details rather than only saved route configuration because configured candidate routes may be inactive or shadowed by preferred and connected routes.

Tune supported health-check failure and recovery thresholds for stable link selection is a relevant remedy for a DIFFERENT problem—sd-wan failover recovery hysteresis—when a flapping WAN repeatedly regains preferred status and disrupts interactive connections. In this Lakeview Biotechnology case that is not the failing component. Here the correct intervention is to review the effective FortiGate routing table and session details rather than only saved route configuration because configured candidate routes may be inactive or shadowed by preferred and connected routes.

SD-WAN link steering needs a viable route to the SD-WAN context as well as a matching service rule explains a different situation, sd-wan routing into zone, where an SD-WAN rule selects a preferred member but the routing table still sends traffic directly through a standalone WAN interface. It does not account for the specific observed route diagnostic table versus session condition at Lakeview Biotechnology. The decisive mechanism here is: Configured candidate routes may be inactive or shadowed by preferred and connected routes.

A fixed preferred member without relevant health conditions can remain selected despite degraded service explains a different situation, sd-wan preferred-member failover, where a rule forces all finance traffic onto one provider and keeps attempting the unhealthy member during a fault. It does not account for the specific observed route diagnostic table versus session condition at Lakeview Biotechnology. The decisive mechanism here is: Configured candidate routes may be inactive or shadowed by preferred and connected routes.

Overly sensitive probes can alternate link eligibility during transient packet loss explains a different situation, sd-wan failover recovery hysteresis, where a flapping WAN repeatedly regains preferred status and disrupts interactive connections. It does not account for the specific observed route diagnostic table versus session condition at Lakeview Biotechnology. The decisive mechanism here is: Configured candidate routes may be inactive or shadowed by preferred and connected routes.

A route lookup and test session both select the configured SD-WAN path would validate the separate control sd-wan routing into zone, not the fault reported for Lakeview Biotechnology. To confirm this correction, the team instead needs: The selected active route agrees with an observed test session's egress interface. That is the observable check related to route diagnostic table versus session.

An authorized loss test moves new finance sessions to the approved healthy backup would validate the separate control sd-wan preferred-member failover, not the fault reported for Lakeview Biotechnology. To confirm this correction, the team instead needs: The selected active route agrees with an observed test session's egress interface. That is the observable check related to route diagnostic table versus session.

A simulated intermittent outage produces the intended stable hold-down and recovery would validate the separate control sd-wan failover recovery hysteresis, not the fault reported for Lakeview Biotechnology. To confirm this correction, the team instead needs: The selected active route agrees with an observed test session's egress interface. That is the observable check related to route diagnostic table versus session.

Test route and SD-WAN rule interaction during WAN migrations reduces recurrence of sd-wan routing into zone, rather than the observed route diagnostic table versus session issue. The relevant preventive control for Lakeview Biotechnology is: Use effective-table checks in routing acceptance tests. This distinction matters because configured candidate routes may be inactive or shadowed by preferred and connected routes.

Practice controlled failover for business-critical services reduces recurrence of sd-wan preferred-member failover, rather than the observed route diagnostic table versus session issue. The relevant preventive control for Lakeview Biotechnology is: Use effective-table checks in routing acceptance tests. This distinction matters because configured candidate routes may be inactive or shadowed by preferred and connected routes.

Monitor link flaps and adjust SLA stability thresholds reduces recurrence of sd-wan failover recovery hysteresis, rather than the observed route diagnostic table versus session issue. The relevant preventive control for Lakeview Biotechnology is: Use effective-table checks in routing acceptance tests. This distinction matters because configured candidate routes may be inactive or shadowed by preferred and connected routes.