Which statement is correct about SD-WAN and ADVPN?

The primary purpose of integrating Fortinet SD-WAN with Auto-Discovery VPN (ADVPN) is to leverage dynamic, on-demand tunnels between spoke sites. These ADVPN IPsec overlays (hubs or dynamic shortcuts) are configured as members of the SD-WAN virtual interface. This allows the SD-WAN controller to perform health and performance monitoring (latency, jitter, packet loss) on these tunnels. Based on this monitoring and the configured SD-WAN rules (like best quality or lowest cost), SD-WAN can intelligently steer traffic across the most optimal path, whether it's a static hub-and-spoke tunnel or a dynamic spoke-to-spoke shortcut.

A. Routes for ADVPN shortcuts must be manually configured.

This is incorrect. ADVPN's core function is automation; it relies on a dynamic routing protocol, typically BGP, to automatically advertise and learn routes for the dynamically established shortcuts.

C. SD-WAN does not monitor the health and performance of ADVPN shortcuts.

This is incorrect. A fundamental feature of SD-WAN is to monitor all its member interfaces, including ADVPN tunnels and shortcuts, to make informed traffic-steering decisions based on real-time performance.

D. You must use IKEv2 on IPsec tunnels.

While IKEv2 is a mandatory prerequisite for the ADVPN auto-discovery feature to function, this statement describes a specific configuration requirement rather than the overarching functional relationship between SD-WAN and ADVPN, which option B correctly details.

1. Fortinet FortiOS 7.0.0 SD-WAN Architecture Guide, Page 41, "SD-WAN and ADVPN".

"FortiGate SD-WAN is fully compatible with Auto-discovery VPN (ADVPN). When you configure ADVPN, you can add the IPsec tunnels to the SD-WAN interface as members. SD-WAN can then use the tunnels to route traffic and measure their health." (This supports option B and refutes option C).

2. Fortinet FortiOS 7.0.0 SD-WAN Deployment Guide, "SD-WAN with ADVPN" section.

The configuration example shows adding the IPsec interfaces as members of the SD-WAN. It also details using BGP for dynamic route exchange. (This supports option B and refutes option A).

3. Fortinet FortiOS 7.0.0 Administration Guide, "Auto-discovery VPN (ADVPN)" section.

"ADVPN is supported for IKEv2 only." (This confirms that IKEv2 is a requirement for ADVPN, making option D factually correct but less descriptive of the integrated solution than option B).