"If a tree falls down in a forest but there's nobody to hear it..." :)
Link monitoring is there to steer traffic away from non-functional, or badly performing, links. But if you have absolutely no traffic trying to pass through a given link, why would the perceived link state matter? If you need constant probing, nobody is stopping you from using active or prefer-passive monitoring.
In a real-life corporate scenario, a VPN link or a WAN link will have some traffic flowing through pretty much constantly. Link monitors can thus afford to be fully passive in these cases.
If you have a scenario where your monitored link can go completely silent for extended periods of time due to no interesting traffic being generated, then surely we can agree that fully-passive monitoring is not the right choice for such a link.
with detect mode "passive", Fortigate doesn't really detect whether link is alive or dead. Instead, It can be used to select sdwan member under sdwan rules based on latency, packet loss or jitter threshold.
@BusinessUser In other words, active mode will send probes, passive mode will use information from inside fortigate (data gathered from active sessions) to determine link status. For example if one user sends a ping (echo-request) and then receives a reply (echo-reply), fortigate decides that link is up because there were back and forth packets. Another example would be a TCP session from an internal user. Fortigate checks packets SYN, SYN ACK, ACK, FIN etc, to decide that there is a stream that flows from inside network to outside world, so link is still alive or not.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.