Refer to the exhibit. The exhibit shows an active-passive high availability FortiGate pair with external and internal Azure load balancers. There is no SDN connector used in this solution. Which…

Question

Exhibit

Options

• ASingle BGP route to Azure probe IP address.
• BOne static route to Azure Lambda IP address.
• CTwo static routes to Azure probe IP address.
• DTwo BGP routes to Azure probe IP address.

• A
  4% (1)
• B
  9% (2)
• C
  74% (17)
• D
  13% (3)

Explanation

In an active-passive FortiGate HA pair on Azure without an SDN connector, failover is driven entirely by Azure Load Balancer health probes. Both the external and internal Azure Load Balancers send probes from Azure's reserved probe IP (168.63.129.16). Because each FortiGate has two interfaces receiving those probes (one toward the external LB, one toward the internal LB), two static routes to the Azure probe IP are required - one per interface - so probe responses exit the correct interface and avoid asymmetric routing that would cause false failover.

Why the distractors fail:

• A (single BGP route): One route can't serve both load balancers, and BGP is not configured in this scenario at all.
• B (one static route to Azure Lambda IP): "Lambda" is an AWS construct, not Azure; the correct destination is the Azure probe IP 168.63.129.16, and a single route is still insufficient.
• D (two BGP routes): BGP is unnecessary complexity here; the question specifies no SDN connector, and static routes are the correct mechanism.

Memory tip: Count your load balancers - "2 LBs = 2 static routes." Every Azure LB that probes a FortiGate interface needs its own return path, so the number of static routes to 168.63.129.16 always matches the number of probed interfaces.

No community discussion yet for this question.