The flow matches the SD-WAN rule that applies to source 10.0.1.0/24 and destination
128.66.0.0/16, and that rule is configured for SLA-based load balancing using round-robin across the two active members (port7 and port8).

FortiGate devices with extensions like FortiExtender can participate as hubs in an SD-WAN topology. SD-WAN supports mixed environments with NGFW functions and various Fortinet extensions, allowing a single topology to include devices with different roles and features.

Template groups can include both system and SD-WAN templates to streamline configuration deployment.
A CLI template group can include both CLI Script and CLI Snippet types.
CLI templates are applied in top-to-bottom order, which affects configuration precedence.

This is because the setting minimum-sla-meet-members = 2 requires at least two SD-WAN zone members (in this case, HUB2-VPN1, HUB2-VPN2, and HUB2-VPN3) to pass the defined SLA health check (HUB1_HC) before the FortiGate will establish ADVPN shortcuts. If fewer than two members meet the SLA, shortcuts will not be created.

The SD-WAN rule (config service edit 1) is configured with set mode priority. This means the rule selects the best interface based on a defined performance metric, as opposed to a simple static priority or SLA. The event log (image_41cfb5.png) shows Metric latency and Message Service prioritized by performance metric will be redirected in sequence order. This indicates that the rule is using latency to determine the preferred member. Given that the log message is about a change, and the most logical reason for a change in a priority mode is that a different member is now the best performer, it implies that the latency on port2 has become lower than that on port1.
The log message Service prioritized by performance metric will be redirected in sequence order confirms that FortiGate is changing the member being used for this service. Because the mode is priority, FortiGate dynamically selects the member that currently meets the best performance criteria, which in this case is latency. The log implies a new member has been selected as the most optimal, and with the default configuration, the members are sorted based on their performance, so the outgoing interface list is effectively updated to prefer the new best- performing member (port2).