The exhibit shows the runtime details of two SD-WAN services (rules):
Service(2)
Mode(manual hash-mode=inbandwidth)
Members(2): port2 (WAN2), port1 (WAN1)
Application matching: Facebook, LinkedIn, Game
Source: 10.0.1.0–10.0.1.255This rule is clearly intended for internet/DIA application steering and does not show a corporate destination range.
Service(3)
Mode(sla hash-mode=round-robin)
Members(6): HUB1-VPN1/2/3 and HUB2-VPN1/2/3
Source: 10.0.1.0–10.0.1.255
Destination: 10.0.0.0–10.255.255.255
Traffic from 10.0.1.124 to 10.0.0.254 matches Service(3) because the destination IP 10.0.0.254 falls within the destination range 10.0.0.0–10.255.255.255.
Within Service(3), the member list shows SLA results per interface:
HUB1-VPN2 has sla(0x1) and num of pass(1)
HUB2-VPN2 has sla(0x2) and num of pass(1)
The remaining members (HUB1-VPN1, HUB2-VPN1, HUB1-VPN3, HUB2-VPN3) show sla(0x0) and num of pass(0)
This indicates that, for Service(3), only HUB1-VPN2 and HUB2-VPN2 are currently meeting the SLA requirements (passing), and because the rule uses hash-mode=round-robin, FortiGate load-balances sessions across the passing members.
Therefore, FortiGate will steer the traffic using HUB1-VPN2 or HUB2-VPN2, which corresponds to Option B.
