Stackvora.tech

FortiGate SD-WAN: quick-start with two WAN links

FortiGate SD-WAN offers a robust solution for enhancing network resilience and intelligently routing traffic across multiple WAN links. This guide details…

FortiGate SD-WAN offers a robust solution for enhancing network resilience and intelligently routing traffic across multiple WAN links. This guide details the precise configuration steps for establishing a dual-WAN SD-WAN setup on a FortiGate running FortiOS 7.6, leveraging specific commands and parameters.

Prerequisites and Initial Setup

Before beginning, ensure your FortiGate meets the following criteria:

  • FortiOS Version: This guide is written for FortiOS 7.6. Minor command variations might exist in other versions (e.g., FortiOS 7.0 or 7.2).
  • WAN Interfaces: Two distinct physical or VLAN interfaces designated as WAN links. For this example, we'll use wan1 and wan2. Each must be connected to a different ISP and configured with appropriate IP addressing (static or DHCP).
  • LAN Interface: A configured internal network interface (e.g., internal or a software switch) from which client traffic originates.
  • Administrative Access: Full administrator access to the FortiGate GUI or CLI.
  • IP Addressing: Ensure wan1 and wan2 have valid IP configurations. For instance:
    • wan1: IP 203.0.113.10/29, Gateway 203.0.113.1
    • wan2: IP 198.51.100.10/29, Gateway 198.51.100.1

Disable any existing static routes pointing traffic out through wan1 or wan2, as the SD-WAN implicit route will take precedence.

Step 1: Create the SD-WAN Zone and Members

The first step involves enabling SD-WAN, creating a virtual SD-WAN zone, and adding your physical WAN interfaces as members to this zone. Each member must be associated with its respective gateway.

config system sdwan
    set status enable
    config zone
        edit "virtual-wan"
            next
    end
    config members
        edit 1
            set interface "wan1"
            set gateway 203.0.113.1
            set zone "virtual-wan"
            set weight 0
            set priority 0
            next
        edit 2
            set interface "wan2"
            set gateway 198.51.100.1
            set zone "virtual-wan"
            set weight 0
            set priority 0
            next
    end
end

Explanation of parameters:

  • set status enable: Globally enables the SD-WAN feature.
  • config zone edit "virtual-wan": Defines a new SD-WAN zone. All traffic exiting through SD-WAN will be routed through this logical zone.
  • config members edit 1 and edit 2: Defines the individual WAN links as SD-WAN members. The ID (1, 2) is an internal reference.
  • set interface "wan1" / "wan2": Specifies the physical interface for this member.
  • set gateway 203.0.113.1 / 198.51.100.1: The next-hop gateway IP provided by your ISP for each WAN link. This is crucial for routing.
  • set zone "virtual-wan": Associates the member with the previously created SD-WAN zone.
  • set weight 0, set priority 0: These are default values. weight is used for load balancing (equal weights mean equal distribution). priority is used for failover in certain rule types (lower number means higher priority).

Step 2: Configure Performance SLAs (Health Checks)

Performance SLAs (Service Level Agreements), often referred to as health checks, are vital for SD-WAN. They monitor the reachability and performance (latency, jitter, packet loss) of the WAN links, allowing SD-WAN to make intelligent routing decisions based on real-time link quality. FortiOS 7.6 provides various monitoring protocols.

config system sdwan
    config health-check
        edit "ISP-Performance-Check"
            set server "8.8.8.8" "1.1.1.1"
            set protocol ping
            set interval 500
            set failtime 3
            set probe-timeout 1000
            set packet-size 64
            set ha-priority-sync enable
            set members 1 2
            config sla
                edit 1
                    set latency-threshold 200
                    set jitter-threshold 30
                    set packetloss-threshold 2
                    next
            end
            next
    end
end

Explanation of parameters:

  • edit "ISP-Performance-Check": Creates a new health check profile. A descriptive name is recommended.
  • set server "8.8.8.8" "1.1.1.1": Specifies the target IP addresses for monitoring. Public DNS servers (Google DNS, Cloudflare DNS) are common choices for their reliability. Using multiple servers improves accuracy.
  • set protocol ping: Uses ICMP Echo Request/Reply for monitoring. Other options include tcp-echo, udp-echo, http.
  • set interval 500: How often (in milliseconds) the probes are sent. 500ms (0.5 seconds) is frequent for quick detection.
  • set failtime 3: The number of consecutive failed probes before a link is marked as down. With a 500ms interval, 3 failures mean 1.5 seconds of sustained unreachability.
  • set probe-timeout 1000: How long (in milliseconds) to wait for a response to a probe before considering it a loss.
  • set packet-size 64: Size of the probe packet in bytes.
  • set ha-priority-sync enable: Ensures SD-WAN member health status is synchronized in an HA cluster.
  • set members 1 2: Specifies which SD-WAN members this health check applies to.
  • config sla: Defines the SLA thresholds for link performance.
  • set latency-threshold 200: Maximum acceptable round-trip latency in milliseconds.
  • set jitter-threshold 30: Maximum acceptable jitter (variation in latency) in milliseconds.
  • set packetloss-threshold 2: Maximum acceptable packet loss percentage.

Step 3: Define SD-WAN Rules (Application Steering)

SD-WAN rules dictate how traffic is steered across the WAN links based on various criteria, including applications, source/destination, and performance requirements. We'll set up a rule to prefer wan1 for Microsoft 365 traffic, falling back to wan2 if wan1's performance degrades or it fails.

config system sdwan
    config service
        edit 1
            set name "M365-Prefer-WAN1"
            set mode auto
            set internet-service enable
            set internet-service-name "Microsoft-Office.365"
            set health-check "ISP-Performance-Check"
            set strategy "sla"
            config sla
                edit 1
                    set latency-threshold 200
                    set jitter-threshold 30
                    set packetloss-threshold 2
                    next
            end
            set priority-members 1 2
            next
        edit 2
            set name "Default-Internet"
            set mode auto
            set src "all"
            set dst "all"
            set health-check "ISP-Performance-Check"
            set strategy "load-balance"
            set load-balance-mode "source-ip-based"
            set members 1 2
            next
    end
end

Explanation of parameters:

  • edit 1 set name "M365-Prefer-WAN1": Defines a rule for Microsoft 365 traffic.
  • set mode auto: Enables automatic selection of the best link based on rule criteria.
  • set internet-service enable and set internet-service-name "Microsoft-Office.365": Leverages FortiGuard's Internet Service Database (ISDB) for application identification, ensuring traffic to known Microsoft 365 IPs/ports is matched.
  • set health-check "ISP-Performance-Check": Links this rule to the defined health check profile.
  • set strategy "sla": This is key. The FortiGate will select the best member based on SLA performance. If one link fails to meet the SLA, it will switch to the next best.
  • config sla edit 1: You can optionally define specific SLA thresholds for this rule, overriding the health check's global thresholds if needed.
  • set priority-members 1 2: In "SLA" strategy, this specifies the preferred order. Member 1 (wan1) is preferred. If it fails SLA, member 2 (wan2) is used.
  • edit 2 set name "Default-Internet": A default rule catching all other traffic. This rule should generally be placed after more specific rules.
  • set src "all" and set dst "all": Matches all source and destination traffic.
  • set strategy "load-balance": Distributes traffic across active members.
  • set load-balance-mode "source-ip-based": A common load balancing method that ensures sessions from a single source IP consistently use the same WAN link. Other options include weighted, spillover, source-destination-ip-based.
  • set members 1 2: All available WAN links are included in the load-balancing pool.

Rule of thumb: SD-WAN rules are processed in order from top to bottom (lowest ID first). More specific rules should be placed before general rules.

Step 4: Configure Firewall Policy

A firewall policy is required to allow traffic from your internal network out through the SD-WAN zone. This policy will replace any old policies that routed traffic directly out wan1 or wan2.

config firewall policy
    edit 0
        set name "LAN_to_SD-WAN"
        set srcintf "internal"  (or your LAN interface name)
        set dstintf "virtual-wan"
        set srcaddr "all"       (or your internal network address object)
        set dstaddr "all"
        set service "ALL"
        set action accept
        set nat enable
        set comments "Allow LAN traffic out via SD-WAN"
        set schedule "always"
        set logtraffic all
        set utm-status enable
        config security-profile-status
            set av enable
            set webfilter enable
            set ips enable
            set application-list enable
            set ssl-ssh-profile "certificate-inspection"
        end
        set profile-group "default" (or your custom profile group)
        next
end

Explanation of parameters:

  • set srcintf "internal": The interface where internal client traffic originates.
  • set dstintf "virtual-wan": The destination interface is now your SD-WAN zone. This is crucial for SD-WAN to function.
  • set nat enable: Enables Network Address Translation, typically required for outbound internet access.
  • set logtraffic all: Recommended for visibility and troubleshooting.
  • set utm-status enable: Enables Unified Threat Management (UTM) profiles. Adjust specific profiles (AV, Webfilter, IPS, Application Control) as per your security requirements.

Verification and Monitoring

Once configured, verify the SD-WAN status and member performance using CLI commands:

diagnose sys sdwan health-check # Shows status of health check monitors
diagnose sys sdwan member # Displays status and performance of SD-WAN members
diagnose sys sdwan service # Lists SD-WAN rules and their current active members
get system sdwan # Shows overall SD-WAN configuration

Regularly review the SD-WAN monitoring dashboard in the GUI (Network > SD-WAN > Monitor) for visual representation of link status, quality, and traffic distribution. This dashboard provides real-time and historical data on latency, jitter, packet loss, and bandwidth utilization.

Common Pitfalls

  • Existing Static Routes: Any static routes pointing to wan1 or wan2 for general internet access will interfere with SD-WAN. SD-WAN creates an implicit default route (0.0.0.0/0) through the virtual-wan zone with a distance of 10. Ensure no other routes with lower distances conflict.
  • Incorrect Gateway IPs: Double-check the set gateway IP for each SD-WAN member. An incorrect gateway means traffic cannot exit the FortiGate correctly.
  • Firewall Policy Destination: Forgetting to change the firewall policy's destination interface from a physical WAN interface (e.g., wan1) to the virtual-wan zone. Traffic will not flow through SD-WAN otherwise.
  • Aggressive SLA Thresholds: Setting SLA thresholds too low (e.g., 1ms latency, 0% packet loss) can lead to excessive link flapping if the ISPs cannot consistently meet these high standards. Start with realistic thresholds and adjust as you collect baseline data.
  • Order of SD-WAN Rules: Ensure more specific application-based rules are placed before broader rules (like a default internet rule). Rules are processed sequentially. If a broad rule matches first, specific rules below it will never be hit.
  • DNS Resolution for Health Checks: While less common for common public DNS servers, ensure the FortiGate itself can resolve the server FQDNs if you use FQDNs instead of IP addresses for health check targets. Best practice is to use IP addresses for health checks.
  • No Default SD-WAN Rule: If no traffic matches any specific SD-WAN rule, it will fall to the implicit default rule which load-balances traffic based on the default strategy, or may not pass traffic at all if no general "all" rule is present. Always include a broad "Default-Internet" rule at the end.

Back to the knowledge base · Ask the AI assistant