FortiGate SD-WAN traffic steering depends on both service-rule matching and routing-table reachability. A matching SD-WAN rule identifies eligible interfaces, but the selected member must also have a usable route toward the destination.
Option A is correct because service rule 3 matches the specified source and destination address ranges, and the routing table identifies HUB1-VPN3 as the route toward the corporate server subnet.
The source address 10.0.1.0/24 falls within the source range 10.0.0.0/8 , while destination 10.2.5.254 also falls within the configured destination range.
The exhibit identifies service rule 3 as an SLA-based service with multiple available overlay members. However, the route to 10.2.5.0/24 identifies HUB1-VPN3 as the reachable next-hop interface.
Although HUB1-VPN2 appears in the service ' s eligible member list, it does not provide the matching destination route shown in the routing table. Therefore, option B is incorrect.
Options C and D reference service rule 4 and physical WAN interfaces. They do not represent the selected corporate overlay path for the stated source and destination.
This demonstrates a fundamental SD-WAN behavior: matching a service rule does not eliminate the requirement for valid route resolution through its forwarding member.
[References: Fortinet SD-WAN Architecture for Enterprise — SD-WAN Routing Logic; FortiOS 7.6 Administration Guide — SD-WAN Service Rules and Route Selection., ==========, ]
Submit