Pass the Fortinet NSE 7 Network Security Architect NSE7_SDW-7.2 Questions and answers with CertsForce

SD-WAN strategy is Lowest Cost (SLA) as indicated by the "Mode(sla)" flag. Cost SLA uses SLA target, cost, and priority (i.e., interface preference - or order of config unless manually overridden by admin config) as the criteria -- in that order. Both members meet the target, both have 0 cost, and therefore member 3 (T_INET_0) wins the "priority" tiebreaker. So if there is a valid route to the destination through member 3, it will win. The fact that it does not has nothing to do with the configured static route/member priority, which according to SG page 197 "is used as a tiebreaker for ECMP routes when matching implicit SD-WAN rule."

"Configure SD-WAN *rules* to steer traffic to members only if routes have a specific route-tag." Agree with Cyril - although A says the largely same thing as D, route-tag specifically get used by the SD-WAN rule to determine next-hop (i.e., destination). SG p 142 shows "how an administrator can use [route-]tags in SD-WAN rules."

Recommended templates will allow you to prepare a template for IPsec tunnels using Fortinet recommended settings for phase1 and phase2 parameters.

• The IPsec_Fortinet_Recommended template defines a template for a static point-to-point tunnel

• The BRANCH_IPsec_Recommended template defines a template for a static tunnel (with a known remote IP address)

• The HUB_IPsec_Recommended template defines a template for a dynamic tunnel (an IPsec hub for dial-up tunnels)

The error message in Exhibit B indicates a conflicting template assignment. This occurs because FortiManager does not allow the assignment of multiple IPsec templates thatdefine VPN tunnels with the same name or settings to the same FortiGate device. The conflict arises from trying to assign a second IPsec template to a device that already has one assigned. References: This is based on Fortinet's best practices and administrative guidelines which state that each FortiGate device should be assigned a unique IPsec template to avoid configuration conflicts.