Refer to the exhibits. You collected the output shown in the exhibits and want to know which interface TCP traffic will flow through from the user device 10.0.1.101 to the corporate file server 10.0.0.125. All SD-WAN links are stable.
Correct Answer:
B
From the SD-WAN rule configuration (service ID 3, name 'Corp'), the rule is configured as:
set mode sla
set load-balance enable
set hash-mode source-ip-based
set priority-members 3 4 5
Two SLAs are referenced under config sla
In the diagnose firewall proute list output for service=3 (Corp), FortiGate shows the actual members considered for this rule and their SLA pass status:
oif=19 (HUB1-VPN1) num_pass=2
oif=20 (HUB1-VPN2) num_pass=2
oif=21 (HUB1-VPN3) num_pass=1
Because the rule is SLA-based, FortiGate selects only members that meet the SLA requirements for the rule. The output indicates that HUB1-VPN1 and HUB1-VPN2 pass both SLA checks (num_pass=2), while HUB1-VPN3 passes only one (num_pass=1) and therefore is not selected as an eligible forwarding interface for this rule.
Since load-balance is enabled and the rule uses hash-mode source-ip-based, FortiGate will consistently choose an eligible member based on the source IP hash. For traffic sourced from 10.0.1.101, the session can be steered through either HUB1-VPN1 or HUB1-VPN2 (whichever the hash selects), but not HUB1-VPN3.
Therefore, the correct answer is B.
