Stackvora.tech

Enable SD-WAN on FortiGate

Detailed guide to enabling SD-WAN on FortiGate, covering initial setup, interface configuration, health checks, performance SLAs, and traffic steering rules.

FortiGate's SD-WAN capabilities allow organizations to optimize Wide Area Network performance, improve application experience, and simplify WAN management by intelligently routing traffic across multiple WAN links. This article details the steps to configure basic SD-WAN functionality on a FortiGate firewall, focusing on establishing member interfaces, defining performance SLAs, and implementing traffic steering rules.

This guide assumes a FortiGate running FortiOS 6.4 or later. While the core concepts remain consistent, specific CLI syntax and GUI locations might slightly vary in different FortiOS versions.

Initial SD-WAN Zone Configuration

The first step is to create the SD-WAN interface, which acts as a virtual overlay for your physical WAN links. All traffic steered by SD-WAN rules will exit through this virtual interface, allowing the FortiGate to decide which physical member link to use.

Via FortiGate CLI

config system sdwan
    set status enable
    config zone
        edit "virtual-wan-link"
        next
    end
    config members
        edit 1
            set interface "wan1"
            set gateway 192.168.1.1  # Replace with wan1's actual gateway
            set zone "virtual-wan-link"
        next
        edit 2
            set interface "wan2"
            set gateway 10.0.0.1     # Replace with wan2's actual gateway
            set zone "virtual-wan-link"
        next
    end
end

The set status enable command activates the SD-WAN feature. Each physical WAN interface (e.g., wan1, wan2) that you intend to use for SD-WAN must be added as a member. The gateway parameter is crucial for each member to ensure proper routing and reachability tests from the FortiGate itself. The zone "virtual-wan-link" associates these members with the default SD-WAN zone.

Via FortiGate GUI

  1. Navigate to Network > SD-WAN.
  2. Enable the SD-WAN feature if it's not already by toggling the switch.
  3. Under SD-WAN Zone, verify that 'virtual-wan-link' exists. If not, create it.
  4. Under SD-WAN Members, click Create New.
  5. Select your WAN interface (e.g., wan1), specify its gateway IP, and ensure the Zone is set to virtual-wan-link. Repeat for all desired WAN interfaces (e.g., wan2).

After configuring the members, remember to review your firewall policies. Any policies that previously referenced wan1 or wan2 for outbound traffic should now reference the virtual-wan-link interface. This tells the FortiGate to use its SD-WAN logic for that traffic.

Configuring Performance SLA (Health Checks)

Performance SLAs are essential for SD-WAN to actively monitor the health and performance of your member interfaces. These checks allow the FortiGate to detect link degradation or outages and dynamically steer traffic accordingly.

Via FortiGate CLI

config system sdwan
    config health-check
        edit "google_dns"
            set server "8.8.8.8"
            set protocol ping
            set members 1 2  # Member IDs for wan1 and wan2 respectively
            set interval 500
            set failtime 5
            set recoverytime 2
            set link-cost-tag enable # Link cost tag is crucial for rule-based steering
            set packet-size 64
        next
        edit "ISP_gateway_wan1"
            set server "192.168.1.1" # WAN1 gateway
            set protocol ping
            set members 1 # Only wan1
            set interval 1000
            set failtime 3
            set recoverytime 1
        next
        edit "ISP_gateway_wan2"
            set server "10.0.0.1" # WAN2 gateway
            set protocol ping
            set members 2 # Only wan2
            set interval 1000
            set failtime 3
            set recoverytime 1
        next
    end
end
  • server: The destination IP to ping. Public, reliable IPs like 8.8.8.8 (Google DNS) or 1.1.1.1 (Cloudflare DNS) are common for general internet reachability. You can also monitor ISP gateways.
  • protocol: ping or http. Ping is generally sufficient for basic link health.
  • members: Specifies which SD-WAN members this health check applies to. IDs correspond to the order in config members (e.g., 1 for wan1, 2 for wan2).
  • interval: How often (in milliseconds) to send probes (e.g., 500ms).
  • failtime: Number of consecutive failures before the link is marked 'down' (e.g., 5 failures).
  • recoverytime: Number of consecutive successes before a 'down' link is marked 'up' again.
  • link-cost-tag: (FortiOS 6.4+) Enables tagging a link with a specific cost when performance thresholds are breached. This is critical for SD-WAN rules that rely on best quality or specific SLAs.
  • packet-size: Size of the probe packet in bytes (e.g., 64).

Via FortiGate GUI

  1. Navigate to Network > SD-WAN.
  2. Go to the Performance SLA tab.
  3. Click Create New.
  4. Enter a Name (e.g., google_dns_ping).
  5. Set Protocol to Ping.
  6. Enter the server IP address (e.g., 8.8.8.8).
  7. Select the applicable SD-WAN Members.
  8. Adjust Interval, Fail Before Declaring Dead, and Restore After as needed.
  9. Enable Link Cost Tag if you plan to use policies based on performance quality.
  10. Repeat for other health checks as desired.

A typical strategy is to monitor both public internet IPs and the immediate ISP gateway for each link. This helps differentiate between an ISP outage and a general internet routing issue.

Defining SD-WAN Rules (Traffic Steering)

SD-WAN rules determine how traffic is steered across the available member interfaces based on various criteria like source/destination, application, or performance requirements.

Via FortiGate CLI

config system sdwan
    config service
        edit 1
            set name "web_browsing"
            set src "all"
            set dst "all"
            set service "HTTP" "HTTPS" # Can use application definitions too
            set gateway load-balance
            set health-check "google_dns"
            set bandwidth-weight 50  # For load-balance-based strategies
            set internet-service enable
            set internet-service-id 131072 # Example: FortiGuard category 'Web.Browsing'
            set strategy auto
            set auto-mode-sla "google_dns" # Reference the health check name
            set auto-mode-sla-tie-break latency # Or jitter, packet-loss
        next
        edit 2
            set name "voip_traffic"
            set src "internal_voip_subnet"
            set dst "external_voip_provider"
            set service "SIP" "RTP"
            set strategy best-quality
            set health-check "google_dns"
            set sla-log-period 10
            set link-cost-sla
                config sla
                    edit 1
                        set link-cost 10
                        set latency-threshold 50
                        set jitter-threshold 10
                        set packetloss-threshold 1
                    next
                    edit 2
                        set link-cost 20
                        set latency-threshold 100
                        set jitter-threshold 20
                        set packetloss-threshold 3
                    next
                end
        next
        edit 3
            set name "default_outbound"
            set src "all"
            set dst "all"
            set strategy least-cost-first # Or lowest-cost-first
            set member 1 2 # Specify preferred order or use cost
            set default enable # This rule catches all unmatched traffic
        next
    end
end
  • name: A descriptive name for the rule.
  • src / dst / service: Standard firewall policy match criteria.
  • strategy: Defines how traffic is steered. Common options include:
    • auto: Automatically selects the best quality link based on performance SLA.
    • best-quality: Prioritizes links meeting specified SLA thresholds.
    • load-balance: Distributes traffic across links based on various methods (e.g., source-ip, destination-ip, session).
    • manual: Explicitly defines the preferred order of interfaces.
    • least-cost-first / lowest-cost-first: Prioritizes links with lower administrative cost, useful when using Link Cost Tagging.
  • health-check: Links the rule to a specific Performance SLA definition.
  • auto-mode-sla: (With strategy auto) Specifies which health-check to use for automatic selection.
  • auto-mode-sla-tie-break: (With strategy auto) Specifies the metric to use when multiple links meet SLA.
  • link-cost-sla: (With strategy best-quality) Defines specific thresholds for latency, jitter, and packet loss, assigning a cost to the link if thresholds are breached. Higher cost means lower preference.
  • member: (With strategy manual or least-cost-first) Specifies the ordered list of preferred SD-WAN members.
  • default enable: Marks a rule as the catch-all for any traffic not matched by preceding rules. Ensure this is the last rule.

Via FortiGate GUI

  1. Navigate to Network > SD-WAN.
  2. Go to the SD-WAN Rules tab.
  3. Click Create New.
  4. Enter a Name for the rule.
  5. Configure Source, Destination, Service, and Application as needed.
  6. Choose the desired Strategy (e.g., Best Quality for critical applications, Load Balance for general web browsing).
  7. Based on the strategy, configure additional parameters:
    • For Best Quality or Auto: Select the relevant Performance SLA (e.g., google_dns_ping). Define SLA Targets (latency, jitter, packet loss) and associated Link Costs.
    • For Manual or Load Balance: Explicitly order or configure preferred interfaces.
  8. Ensure the rules are ordered correctly. FortiGate processes SD-WAN rules from top to bottom, similar to firewall policies.

Verifying SD-WAN Status

After configuration, it's crucial to verify that SD-WAN is operating as expected.

Via FortiGate CLI

diagnose sys sdwan health-check
diagnose sys sdwan service
get system sdwan

The diagnose sys sdwan health-check command shows the real-time status (latency, jitter, packet loss, and link quality/cost) of each member interface according to the configured performance SLAs. The diagnose sys sdwan service command provides insights into which rule is matching traffic and which interface it's currently using.

Via FortiGate GUI

  1. Navigate to Network > SD-WAN.
  2. The SD-WAN Monitoring widget on the dashboard provides a quick overview of link status and performance.
  3. Under the SD-WAN Members section, you can see the real-time performance data (Latency, Jitter, Packet Loss) for each member, along with its current status (Up/Down) and associated cost.
  4. Go to FortiView > Sessions and add a filter for the SD-WAN interface to observe traffic being routed.

Common Pitfalls

  • Firewall Policies Not Updated: Forgetting to change firewall policies to use the virtual-wan-link interface instead of individual WAN interfaces will prevent SD-WAN from taking effect.
  • Incorrect Gateway IPs for Members: Each SD-WAN member must have its correct gateway IP configured. Without it, the FortiGate cannot route traffic out that specific link and health checks will fail.
  • Overlapping Health Checks: While monitoring both ISP gateway and public IPs is good, ensure your primary SD-WAN rules rely on a health check that accurately reflects application reachability, not just link up/down status.
  • Rule Order: SD-WAN rules are processed sequentially. More specific rules should be placed higher in the list, with a general 'default' rule at the bottom.
  • Insufficient Health Check Interval/Failtime: If these values are too high, the FortiGate might be slow to react to link degradation. If too low, it might flap links unnecessarily. Tune these based on your network's stability.
  • Asymmetric Routing: If using SD-WAN for outbound traffic and a different mechanism (e.g., static route, policy route) for inbound, be mindful of potential asymmetric routing issues, especially with stateful firewalls.

Back to the knowledge base · Ask the AI assistant