Which two statements correctly describe what happens when traffic matches the implicit SD-WAN rule? (Choose two.)

When traffic does not match any explicitly configured SD-WAN rule, it is processed by the implicit SD-WAN rule (ID 0). The function of this rule is to revert to standard routing behavior. Consequently, the session created for this traffic will have an sdwanserviceid of 0, which can be interpreted as no specific user-defined SD-WAN service. Furthermore, the FortiGate session is marked with specific flags: vwldefault to signify it is handled by the default virtual-wan-link logic (i.e., the routing table), and maydirty, which indicates the session can be re-evaluated if the underlying routing information changes.

B. The implicit rule defers to the routing table; it does not perform load balancing itself. ECMP load balancing only occurs if the routing table has multiple equal-cost routes for the destination.

C. Traffic is routed based on the single best path in the routing table (or ECMP paths if available), honoring administrative distance and metrics. It is not distributed across all available static routes.

D. The SD-WAN rule check occurs before the policy route check. Matching the implicit SD-WAN rule causes the packet to be passed to the routing engine, which then checks policy routes.

1. FortiOS SD-WAN Administration Guide 7.6.0, Page 33, Section: Implicit rule: "The implicit rule is the last rule in the list. It has a Rule ID of 0... Traffic that does not match any other SD-WAN rule is handled by the implicit rule. The implicit rule forwards traffic based on the best route in the routing table." This supports the core behavior and explains why options B and C are incorrect. The sdwanserviceid in session diagnostics corresponds to this Rule ID, confirming option A.

2. Fortinet FortiOS 7.2 Study Guide, Page 319, Section: SD-WAN Troubleshooting: "If a session matches the implicit SD-WAN rule, the output of the diagnose sys sdwan session list command shows the rule ID as 0." This directly validates answer A.

3. Fortinet Knowledge Base Article FD50232, Technical Tip: FortiGate session flags: This article describes various session flags. The vwldefault flag is specifically associated with sessions matching the implicit SD-WAN rule. The maydirty flag indicates the session is subject to re-evaluation, which is the case for sessions dependent on the dynamic state of the routing table. This confirms option E.