Which statement about using BGP routes in SD-WAN is true?

FortiGate SD-WAN rules can use dynamic address objects as a destination. These objects can be populated with routes learned through dynamic routing protocols, specifically BGP and OSPF. When a BGP neighbor is specified in the dynamic address object, all routes learned from that neighbor are dynamically included. This allows SD-WAN rules to steer traffic towards destinations whose IP addresses are not static, such as services in a public cloud (AWS, Azure) or a remote data center, without requiring manual updates to the rules when network prefixes change.

B. You must use BGP to route traffic for both overlay and underlay links.

This is incorrect. Underlay routing can be managed by static routes or other protocols, while BGP is commonly used for the overlay, but it is not a strict requirement for both.

C. You must configure AS path prepending.

This is incorrect. AS path prepending is an optional BGP traffic engineering technique to influence inbound routing paths; it is not a mandatory configuration for using BGP with SD-WAN.

D. You must use external BGP.

This is incorrect. Internal BGP (iBGP) is very commonly used for the SD-WAN overlay, especially in hub-and-spoke or ADVPN topologies where all sites are part of the same Autonomous System.

1. Fortinet FortiOS 7.2.0 SD-WAN Administration Guide, Page 71, "SD-WAN rules > Destination".

The documentation states: "You can also use dynamic addresses as the destination. Dynamic addresses can be populated with routes learned through BGP and OSPF." This directly supports the correct answer (A).

2. Fortinet FortiOS 7.2.0 SD-WAN Architecture Guide, Page 28, "Routing".

This section explains the separation of underlay and overlay routing. It details that underlay routing depends on the ISP connection (often static or DHCP), while overlay routing uses protocols like BGP. It does not mandate BGP for both, refuting option B.

3. Fortinet FortiOS 7.2.0 ADVPN with BGP as the routing protocol Guide, Page 16, "Configuring BGP on the hub".

The configuration example shows the hub and spokes configured within the same AS number (e.g., set as 65000), which is an iBGP deployment. This directly refutes the claim that eBGP must be used (D).

4. Fortinet FortiOS 7.2.0 Routing Administration Guide, Page 111, "AS path prepending".

This section describes AS path prepending as a method to "make a route less preferable" for traffic engineering purposes. It is presented as an optional feature, not a requirement, which refutes option C.