(You want FortiGate to use SD-WAN rules to steer ping local-out traffic. Which two constraints should you consider? Choose two answers.)

By default, traffic that originates from the FortiGate itself, known as local-out traffic (such as ping, traceroute, FortiGuard updates, or DNS queries), does not use SD-WAN rules for routing. Instead, it follows the standard routing table. To steer this traffic using SD-WAN, an administrator must explicitly enable this functionality. This is not a global setting; it must be configured individually for each service or feature. For example, enabling SD-WAN for DNS is a separate configuration from enabling it for FortiGuard updates or for CLI-initiated traffic like ping.

A. Local-out traffic is not restricted to the manual strategy. It can leverage any SD-WAN strategy, including performance-based ones like Best Quality, to dynamically select the best path.

B. This is incorrect. By default, no local-out traffic, including ping and traceroute, uses SD-WAN. The feature must be explicitly enabled before FortiGate will consider SD-WAN rules for this traffic.

1. Fortinet FortiOS 7.6.0 Administration Guide, SD-WAN > Local-out traffic, Page 101.

"By default, local-out traffic from the FortiGate does not go through the SD-WAN module. You must enable it on a per-feature basis." This statement directly supports both correct answers (C and D). It confirms that the default behavior is to not use SD-WAN (C) and that configuration is required on a per-feature basis (D).

2. Fortinet FortiOS 7.6.0 CLI Reference, system sdwan, Page 2299.

The command set local-out-traffic {enable | disable} is documented here. Its description states, "Enable/disable SD-WAN for traffic originating from the FortiGate CLI, such as ping and traceroute." The default setting is disable, which reinforces that local-out traffic does not use SD-WAN by default (C).

3. Fortinet FortiOS 7.6.0 Administration Guide, SD-WAN > Local-out traffic, Page 101.

The guide provides distinct CLI configuration examples for enabling SD-WAN for different local-out features, such as DNS (config system dns), FortiGuard (config system fortiguard), and central management (config system central-management). This demonstrates the requirement to configure each feature individually (D).