Stackvora.tech

FortiGate: SD-WAN setup walkthrough

Software-Defined Wide Area Networking (SD-WAN) on FortiGate firewalls enhances network resilience and optimizes application performance by intelligently…

Software-Defined Wide Area Networking (SD-WAN) on FortiGate firewalls enhances network resilience and optimizes application performance by intelligently steering traffic across multiple WAN links. This guide details the configuration of a basic FortiGate SD-WAN setup, covering zone creation, performance monitoring, rule definition, and security integration for FortiOS 7.0 and later.

Establishing the SD-WAN Zone

The first step in deploying FortiGate SD-WAN is to aggregate your WAN interfaces into a single logical entity: the SD-WAN zone. This abstraction simplifies routing and policy management.

Interface Member Configuration

Each physical or virtual WAN interface intended for SD-WAN participation must be added as a member. Consider a scenario with two internet links: wan1 (primary, fiber) and wan2 (secondary, DSL).

config system sdwan
    config zone
        edit "virtual-wan-link"
        end
    config health-check
        edit "GoogleDNS"
            set server "8.8.8.8"
            set protocol ping
            set update-static-route disable
            set failtime 3
            set interval 5
            set probe-timeout 1000
        edit "FortiGuard"
            set server "208.91.112.53"
            set protocol ping
            set update-static-route disable
            set failtime 3
            set interval 5
            set probe-timeout 1000
        end
    config members
        edit 1
            set interface "wan1"
            set zone "virtual-wan-link"
            set gateway "192.0.2.1"
            set health-check "GoogleDNS"
            set priority 10
        next
        edit 2
            set interface "wan2"
            set zone "virtual-wan-link"
            set gateway "203.0.113.1"
            set health-check "GoogleDNS"
            set priority 20
        next
    end
end
  • set interface "wan1": Specifies the physical interface.
  • set gateway "192.0.2.1": The gateway IP for this specific WAN interface. Essential for link health monitoring and policy routing.
  • set health-check "GoogleDNS": Associates a defined performance SLA with this member.
  • set priority 10: Lower values indicate higher priority. This is crucial for implicit rule behavior when no explicit SD-WAN rule matches.

Performance SLA Probes (Health Checks)

Performance SLA (Service Level Agreement) probes continuously monitor the health and performance of each WAN link. Metrics like latency, jitter, and packet loss dictate link usability.

config system sdwan
    config health-check
        edit "GoogleDNS_Latency"
            set server "8.8.8.8"
            set protocol ping
            set failtime 3
            set interval 5
            set packetsize 64
            set probe-timeout 1000
            set threshold-warning-latency 100
            set threshold-alert-latency 200
            set threshold-warning-jitter 20
            set threshold-alert-jitter 50
            set threshold-warning-packet-loss 5
            set threshold-alert-packet-loss 10
        end
        edit "Office365_Probe"
            set server "outlook.office365.com"
            set port 443
            set protocol tcp-echo
            set failtime 5
            set interval 10
            set probe-timeout 2000
        end
    end
end
  • set server "8.8.8.8": The destination IP for the probe. Use reliable, public IPs like Google DNS, Cloudflare DNS (1.1.1.1), or your ISP's DNS.
  • set protocol ping / tcp-echo / http: Determines the probe method. TCP/HTTP probes are useful for application-specific health checks.
  • set failtime 3: Number of consecutive failures before the link is considered down.
  • set interval 5: Time in seconds between probes.
  • set threshold-warning-latency 100: Latency (ms) that triggers a warning. Alerts occur at threshold-alert-latency. These thresholds are used by SD-WAN rules to select the best link.

Defining SD-WAN Rules

SD-WAN rules dictate how traffic is distributed across the available WAN links based on various criteria such as source, destination, application, or user. Rules are evaluated in order from top to bottom.

Strategy and Criteria

FortiGate offers several strategies:

  • Best Quality: Selects the link with the best performance based on user-defined SLA targets (latency, jitter, packet loss).
  • Lowest Cost (SLA): Prefers links with lower cost (defined per member) while still meeting SLA.
  • Maximize Bandwidth (SLA): Distributes traffic to maximize aggregate bandwidth, respecting SLA.
  • Redundant Link (SLA): Primary/secondary failover based on SLA.
  • Manual: Explicitly selects an interface. Useful for specific traffic or testing.
  • Measured Volume/Weighted Load Balance: Distributes traffic based on volume or weights.
config system sdwan
    config service
        edit 1
            set name "HighPriority_VoIP"
            set src "10.0.1.0/24"
            set dst "all"
            set service "VOIP"
            set priority-members 1 2  # wan1 (member 1), wan2 (member 2)
            set health-check "GoogleDNS_Latency"
            set strategy "best-quality"
            set link-cost-factor latency
            set link-cost-threshold 100 # ms
        next
        edit 2
            set name "Office365_Traffic"
            set src "all"
            set dst "all"
            set application "Microsoft.Office365"
            set strategy "redundant-link"
            set primary-members 1
            set secondary-members 2
            set health-check "Office365_Probe"
            set link-cost-factor packet-loss
            set link-cost-threshold 5 # %
        next
        edit 3
            set name "Default_Internet_Access"
            set src "all"
            set dst "all"
            set service "ALL"
            set strategy "weighted-load-balance"
            set members 1 2
            set weight-ratio 1:3 # wan1 gets 1 part, wan2 gets 3 parts
        next
    end
end
  • set name "HighPriority_VoIP": A descriptive name for the rule.
  • set src "10.0.1.0/24": Source subnet for this traffic.
  • set service "VOIP": Uses FortiGate's application control signatures for VoIP traffic.
  • set health-check "GoogleDNS_Latency": Ties the rule's decision-making to this specific SLA.
  • set strategy "best-quality": FortiGate will dynamically select the link meeting the best quality criteria.
  • set link-cost-factor latency / packet-loss: The metric used to compare link quality.
  • set link-cost-threshold 100: The maximum acceptable value for the chosen link-cost-factor. Links exceeding this are considered degraded.
  • set application "Microsoft.Office365": Leverage FortiGate's Application Control database for granular traffic identification.

Zone-Based Firewall Policy

With SD-WAN, firewall policies are simplified by using the SD-WAN zone as the outgoing interface. This eliminates the need for separate policies for each WAN link.

config firewall policy
    edit 0
        set name "LAN_to_SDWAN_Internet"
        set srcintf "internal"
        set dstintf "virtual-wan-link"
        set srcaddr "all"
        set dstaddr "all"
        set service "ALL"
        set schedule "always"
        set action accept
        set nat enable
        set logtraffic all
        set comments "Policy for general internet access via SD-WAN."
    next
end
  • set dstintf "virtual-wan-link": All traffic matching this policy will be directed to the SD-WAN zone, where SD-WAN rules then determine the specific outgoing physical interface.
  • Ensure NAT is enabled if your internal network uses private IP addresses.

Verifying SD-WAN Operations

After configuration, it's crucial to verify that SD-WAN is operating as expected.

Command Line Interface Diagnostics

The diagnose sys sdwan commands provide deep insight into the SD-WAN status.

diagnose sys sdwan health-check
diagnose sys sdwan health-check GoogleDNS_Latency
diagnose sys sdwan service
diagnose sys sdwan service 1
diagnose sys sdwan status
diagnose firewall iprope lookup src 10.0.1.10 dst 8.8.8.8 proto 17 dport 53
  • diagnose sys sdwan health-check [name]: Shows real-time performance metrics (latency, jitter, packet loss, bandwidth) for each configured health check and associated member interfaces.
  • diagnose sys sdwan service [id]: Displays the current status of SD-WAN rules, including which interfaces are active for that rule and why.
  • diagnose sys sdwan status: Provides a high-level overview of the SD-WAN system, including link status and aggregated statistics.
  • diagnose firewall iprope lookup src [src_ip] dst [dst_ip] proto [protocol_num] dport [dest_port]: This powerful command simulates traffic flow and shows which SD-WAN rule and outgoing interface would be used. For example, proto 17 dport 53 for UDP DNS.

Real-time Log Monitoring

Monitor FortiGate logs (FortiView or CLI execute log filter and execute log display) for traffic matching your SD-WAN policies. You should see traffic being routed through wan1 or wan2 based on your rules and link health.

execute log filter field subtype 2
execute log filter field action accept
execute log filter field dstintf wan1
execute log display

Look for the dstintf field to confirm which physical interface processed the traffic. When SD-WAN rules are working, you will observe traffic switching between interfaces based on your defined strategies and link performance.

Common Pitfalls

  • Missing Static Routes (Legacy Behavior): In older FortiOS versions (pre-7.0), configuring SD-WAN might override manually configured static routes for member interfaces. With modern FortiOS, SD-WAN operates by injecting dynamic routes when interfaces are added as members. However, ensure that your ISP's gateway is correctly set for each member interface, as SD-WAN uses this for its probes and routing decisions.
  • Firewall Policy Order: SD-WAN rules are processed before firewall policies. However, within firewall policies, the order still matters for general access and other rules not specifically using the SD-WAN interface as dstintf.
  • Incorrect Health Check Configuration: Using unreliable probe servers or too aggressive thresholds can cause links to be falsely marked down, leading to unnecessary failovers. Ensure probe servers are highly available and relevant to the services being accessed.
  • Overlapping SD-WAN Rules: If multiple SD-WAN rules match the same traffic, the rule appearing first in the list (lowest ID) will take precedence. Carefully order your rules from most specific to most general.
  • NAT Issues: If SNAT is enabled on the firewall policy but the outgoing interface IP is not correctly set for the specific WAN member (or the default IP for the member isn't public), outbound traffic might fail. Always verify source NAT is working correctly for each WAN link.
  • Asymmetric Routing: While SD-WAN aims to manage outbound traffic, if your network has complex routing (e.g., policy-based routing on other devices) or multiple ingress points, ensure that return traffic is also handled correctly to avoid asymmetric routing issues, which can break stateful connections.

Back to the knowledge base · Ask the AI assistant