FortiSASE Secure Private Access (SPA) integrates with FortiGate SD-WAN hubs through IPsec overlays and Border Gateway Protocol routing. This enables FortiSASE security points of presence to advertise endpoint networks and learn routes to corporate applications.
Option A is correct because FortiSASE supports two principal BGP routing designs: BGP per overlay and BGP on loopback. Both designs support appropriate iBGP and eBGP peering arrangements.
With BGP per overlay, routing adjacencies use addresses associated with individual IPsec tunnel interfaces. This approach establishes BGP sessions over each configured overlay.
With BGP on loopback, routing adjacencies terminate on logical loopback interfaces rather than individual tunnel interfaces. This separates BGP session establishment from the underlying IPsec transport and provides improved routing stability when overlay paths change.
iBGP is used when FortiSASE and the connected FortiGate hub belong to the same autonomous system. eBGP enables interconnection when different autonomous systems are involved.
Option B incorrectly excludes BGP on loopback. Option C incorrectly excludes eBGP.
Option D incorrectly presents Dynamic BGP as an independently selectable FortiSASE SPA routing design. Although Dynamic BGP is supported in FortiOS SD-WAN architectures, the FortiSASE SPA configuration identifies BGP per overlay and BGP on loopback as its two routing-design choices.
[References: FortiSASE Feature Administration Guide — Configuring BGP, BGP Routing Design and Supported Features for Each SPA BGP Routing Design., ==========, ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit