Overview
Domain 4 has two objectives. The first is configuring and routing packets with static routes: building routes, reading the FortiGate routing table, and using distance, priority and equal-cost multipath for redundancy and load balancing. The second is configuring SD-WAN to balance traffic across several WAN links: members and zones, performance SLAs that measure link health, SD-WAN rules that steer traffic, and how SD-WAN interacts with normal routing.
Dynamic routing protocols such as OSPF and BGP are not listed in the current FortiOS 7.6 objectives, so the focus is on how FortiGate decides between routes it already has. Questions are usually built on a routing table output or an SD-WAN monitor screen, and they test whether you can predict the egress interface for a flow, especially when one link degrades or fails.
How it's tested
Routing items typically show the output of get router info routing-table, a static route list or an SD-WAN rule and SLA configuration, and then ask where a packet goes. You must apply distance, priority and SLA status in the right order rather than guess from the interface names.
-
Predict the egress interface
Two or more routes to the same destination are shown with distances and priorities, and you choose the one FortiGate uses.
-
Explain an SD-WAN decision
An SD-WAN rule with a strategy and SLA results is shown, and you decide which member carries the traffic.
-
Fix redundancy
A failover requirement is described, and you choose distance, priority, link health monitoring or an SLA setting to meet it.
Two default static routes exist: one through port1 with distance 10 and one through port2 with distance 20. Both links are up, so only the distance 10 route is active and traffic leaves port1. If the port1 gateway stops responding but the interface stays up, the route remains active unless link health monitoring or an SD-WAN SLA detects the failure and removes it.
Objectives 2
Official objectives from the Fortinet outline, in outline order.
4.1 Configure and route packets using static routesStatic routing, the FortiGate routing table, route redundancy and load balancing.
- What it means
- Static routes tell FortiGate which gateway and interface to use for a destination. This objective covers creating them, reading the routing table, and combining routes for redundancy and load sharing with distance, priority and ECMP.
- What to understand
- The routing information base holds all known routes, but only the best ones are active for forwarding. For the same prefix, the lowest administrative distance wins; static routes default to distance 10. Routes with equal distance are all active, and among them the lowest priority is preferred; routes with equal distance and priority are used together for ECMP, by source IP by default. Policy routes are checked before the routing table. Reverse path forwarding checks drop packets arriving on an unexpected interface.
- How it shows up
- Expect to predict the egress route from a table, or choose settings for failover or load sharing.
- Common confusion
- Mixing up distance and priority: distance chooses which routes are active, priority chooses among active routes.
4.2 Configure SD-WAN to load balance traffic between multiple WAN links effectivelySD-WAN concepts, members and zones, routing behavior, link quality and use cases.
- What it means
- SD-WAN groups multiple WAN interfaces into a logical zone and steers sessions across them based on rules and measured link quality. Typical use cases are load balancing internet traffic, keeping business applications on the best link and failing over automatically.
- What to understand
- Interfaces are added as members of SD-WAN zones, and firewall policies reference the zone. Performance SLAs probe targets with protocols such as ping, HTTP or DNS and measure latency, jitter and packet loss to mark links in or out of SLA, or dead. SD-WAN rules match traffic and apply a strategy such as manual, best quality, lowest cost (SLA) or maximize bandwidth (SLA). Traffic matching no rule uses the implicit rule and its load-balancing algorithm. A member needs a valid route to the destination to be selected.
- How it shows up
- Expect to choose a rule strategy or predict which member is used when one link degrades.
- Common confusion
- Assuming an SD-WAN rule overrides routing completely; a member without a valid route is skipped.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Administrative distance
Selects which route for a prefix becomes active.
- Remember
- Lower distance wins; static default is 10.
- Tested as
- Route selection questions.
- Trap
- Treating it as a tie-breaker among active routes.
-
Route priority
Selects among active routes with the same distance.
- Remember
- Lower priority is preferred.
- Tested as
- Route selection questions.
- Trap
- Expecting it to beat a lower distance.
-
ECMP
Equal distance and priority routes share traffic.
- Remember
- Default method is source IP based.
- Tested as
- Load sharing questions.
- Trap
- Expecting per-packet balancing.
-
Routing table versus RIB
All routes are known, only the best are installed for forwarding.
- Remember
- Inactive routes wait as backups.
- Tested as
- Reading routing outputs.
- Trap
- Assuming every listed route forwards traffic.
-
Policy routes
Rules that steer traffic before the routing table is consulted.
- Remember
- They take precedence over normal routes.
- Tested as
- Unexpected egress questions.
- Trap
- Forgetting they exist.
-
Reverse path forwarding check
Drops packets that arrive on an interface with no return route.
- Remember
- Asymmetric paths can trigger it.
- Tested as
- Debug flow drop reasons.
- Trap
- Blaming the firewall policy.
-
Link health monitor
Probes a gateway and removes static routes when it fails.
- Remember
- Detects failures beyond the interface.
- Tested as
- Failover questions.
- Trap
- Relying on interface status alone.
-
SD-WAN zone
Logical grouping of member interfaces used in firewall policies.
- Remember
- Policies reference zones, not members.
- Tested as
- SD-WAN configuration questions.
- Trap
- Writing policies per member.
-
Performance SLA
Health probes measuring latency, jitter and packet loss.
- Remember
- Results mark members in or out of SLA.
- Tested as
- Steering decisions.
- Trap
- Confusing a dead link with an out-of-SLA link.
-
SD-WAN rule strategies
Manual, best quality, lowest cost (SLA) and maximize bandwidth (SLA).
- Remember
- Each picks members differently.
- Tested as
- Rule design questions.
- Trap
- Choosing best quality when cost matters.
-
Implicit SD-WAN rule
Handles traffic matching no SD-WAN rule.
- Remember
- Uses the configured load-balancing algorithm.
- Tested as
- Default behavior questions.
- Trap
- Assuming unmatched traffic is dropped.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Distance versus priority versus ECMP
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Distance | Which routes become active | Compared first | Using it to rank active routes |
| Priority | Preference among same-distance routes | Compared second | Expecting it to beat distance |
| ECMP | Equal distance and priority | Traffic shared across routes | Expecting per-packet distribution |
SD-WAN rule strategies
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Manual | Uses the configured member order | No SLA consideration | Expecting automatic failover on quality |
| Best quality | Picks the member with the best measured metric | Quality first | Ignoring link cost |
| Lowest cost (SLA) | Cheapest member that meets the SLA | Cost first, within SLA | Confusing it with best quality |
| Maximize bandwidth (SLA) | Load balances across members meeting the SLA | Uses several links together | Expecting a single preferred link |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Priority beats distance
- What candidates pick
- Pick the route with the lowest priority even though it has a higher distance.
- Why it looks right
- Lower priority sounds preferred.
- Why it's wrong
- Distance is compared first, and the higher-distance route is not active at all.
Clue to watch for The routes show different distances and priorities.
-
Interface up means path up
- What candidates pick
- Assume failover happens when the ISP gateway fails.
- Why it looks right
- The interface still shows link.
- Why it's wrong
- Without link health monitoring or an SD-WAN SLA, the route stays active while the gateway is unreachable.
Clue to watch for Upstream failure with the physical link still up.
-
Per-packet ECMP
- What candidates pick
- Expect each packet to alternate between ECMP routes.
- Why it looks right
- Load balancing suggests even split.
- Why it's wrong
- FortiGate balances per session, by source IP by default, so one host may use one route.
Clue to watch for A single client appears to use only one link.
-
SD-WAN ignores routes
- What candidates pick
- Expect an SD-WAN rule to send traffic over a member with no route to the destination.
- Why it looks right
- Rules appear to override routing.
- Why it's wrong
- SD-WAN only selects members that have a valid route to the destination.
Clue to watch for One member lacks a matching route in the table.
-
Out of SLA means dead
- What candidates pick
- Treat an out-of-SLA member as removed from all traffic.
- Why it looks right
- Both are failure states.
- Why it's wrong
- An out-of-SLA member can still carry traffic for rules that allow it; a dead member is unusable.
Clue to watch for The SLA status shows thresholds exceeded but the link responding.
Answer framework
Use these steps to predict where FortiGate sends a packet in a Domain 4 scenario.
- Check for a matching policy route or SD-WAN rule first, because both are evaluated before the standard routing table.
- Find all routes for the most specific matching prefix, since the longest prefix match wins before distance is considered at all.
- Among those routes, keep only the lowest distance; these are the active routes, while higher-distance routes remain as inactive backups.
- Among active routes, prefer the lowest priority; if distance and priority are equal, apply ECMP using the configured method.
- For SD-WAN, apply the rule strategy using current SLA results, skip dead members and members without a valid route, and fall back to the implicit rule.
Practice question
Want more like this? The NSE 4 practice test has questions for every domain.
Checklist
0 of 11
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with route selection on paper. Write out several sets of routes with different prefixes, distances and priorities and predict the active route for each, then confirm in a lab with get router info routing-table all and the database view. Break a gateway while leaving the interface up to see why link health monitoring matters.
Next, build SD-WAN with two WAN members. Create a performance SLA probing a public target, then add rules using each strategy. Introduce latency or packet loss on one link, using a lab tool or by shutting a next hop, and watch the SD-WAN monitor and the rule's selected member change.
Alongside, run debug flow on traffic that matches an SD-WAN rule so you see how the decision appears in a trace. Revise with a short table: distance, priority, ECMP, policy routes and each SD-WAN strategy, with one line on when each applies, and redo the paper exercises until they feel automatic.
FAQ
How much of the exam is Routing?
Fortinet weights Routing at 10-15% of the FortiOS 7.6 Administrator exam, roughly 6 to 8 questions on a 50-55 question form.
What is the difference between distance and priority?
Distance decides which routes to a prefix become active; lower is better. Priority ranks routes that share the lowest distance, and again the lower value is preferred.
Are OSPF and BGP on the exam?
They are not listed in the current FortiOS 7.6 objectives, which name static routing and SD-WAN only. Older FortiGate outlines included more routing topics.
How does FortiGate load balance with ECMP?
When routes share distance and priority, FortiGate spreads sessions across them, by source IP by default. Other methods include source-destination IP, weighted and spillover.
What does a performance SLA measure?
It sends probes to a target and measures latency, jitter and packet loss, marking each member as within SLA, out of SLA or dead.
Which SD-WAN strategy should I pick to save cost?
Lowest cost (SLA) chooses the cheapest member that still meets the SLA, while best quality picks the best performing link regardless of cost.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 4 knowledge
You have covered static routes, distance, priority, ECMP and SD-WAN rules and SLAs. Test whether you can predict the egress interface for each scenario quickly.