Important Fortinet NSE6_SDW_AD-7.6 Exam Questions

Answer: A, C, D

Explanation:

The provisioning templates in FortiManager are designed for flexible, scalable configuration of large SD-WAN deployments. The official documentation explains: 'Template groups can consist of both system and SD-WAN templates, providing a way to apply consistent settings across multiple devices. CLI templates are evaluated and executed in order from top to bottom within the template group, which is crucial for managing dependencies. Furthermore, CLI template groups can contain both regular CLI templates and advanced (Perl-script-based) templates, allowing complex or conditional configuration logic.' This modular design streamlines large deployments by separating system, SD-WAN, and CLI logic into reusable building blocks. Reference:

[FCSS_SDW_AR-7.4 1-0.docx Q17]

FortiManager Administration Guide 7.4, 'Template Groups and CLI Template Processing'

Answer: A, B, E

Explanation:

Before FortiGate can steer traffic according to SD-WAN rules, certain configuration elements must be present. The guide states: 'SD-WAN is not a standalone feature and interacts with several fundamental FortiGate configurations. Specifically, you must: (1) Define the interfaces (physical, VLAN, or IPsec) that will act as SD-WAN members, (2) Create firewall policies to allow traffic to be steered by SD-WAN, and (3) Set up routing so that traffic has valid routes via SD-WAN members. Without these, SD-WAN rules will not be able to match or steer any traffic.' Security profiles and traffic shaping are not mandatory for basic SD-WAN steering but can be layered on for enhanced security and QoS once foundational elements are present. Reference:

[FCSS_SDW_AR-7.4 1-0.docx Q16]

FortiOS 7.4 SD-WAN Concept Guide, ''Prerequisite Configuration Elements for SD-WAN Steering

Answer: D

Explanation:

When using the diagnose sys session list command, SD-WAN-specific session steering is indicated by the presence of the sdwan_service_id field in the session data. This identifier ties the session directly to a specific SD-WAN rule or service. As noted in the Fortinet documentation: ''Sessions that are handled according to SD-WAN rules will include a service ID tag (sdwan_service_id) in their session listing. This allows administrators to correlate live sessions with SD-WAN policy matches for troubleshooting and visibility.'' This is a crucial diagnostic tool, as it distinguishes between traffic managed by traditional routing and that explicitly controlled by SD-WAN steering logic, aiding in operational insight and troubleshooting. Reference:

[FCSS_SDW_AR-7.4 1-0.docx Q15]

FortiOS 7.4 CLI Reference, ''diagnose sys session list: SD-WAN Service ID Tagging''

SD-WAN 7.4 Concept Guide, Section: 'Session Identification for SD-WAN Traffic'

Answer: B

Explanation:

When asymmetric routing is observed (such as reply traffic not following the optimal path), the solution is: 'The auxiliary-session feature, enabled under config system settings, allows FortiGate to consider multiple egress interfaces for reply traffic, not just the original ingress interface. This is crucial for SD-WAN environments where the best path may differ between forward and return directions, especially when performance or policy rules are dynamically evaluated.' Activating this ensures reply traffic is always sent on the member with the best real-time metrics. Reference:

[FCSS_SDW_AR-7.4 1-0.docx Q23]

FortiOS 7.4 CLI Reference, 'auxiliary-session for SD-WAN Path Optimization'

Answer: A, C