Policy example

Given a topology that has already been previously orchestrated using the SDWan Overlay, the following example demonstrates how to create overlay policies between two FortiGate sites in that topology using these steps:

1. Configure an overlay policy to allow traffic from the Datacenter LAN (10.1.100.0/24) to the Branch 1 LAN (10.1.1.0/24).

2. Test and verify connectivity from the Datacenter LAN to the Branch 1 LAN.

3. Test and verify connectivity from the Branch 1 LAN and the Datacenter LAN is not allowed by the overlay policy configured in Step 1.

4. Configure an overlay policy to allow traffic from the Branch 1 LAN (10.1.1.0/24) to the Datacenter LAN (10.1.100.0/24).

5. Test and verify connectivity from the Branch 1 LAN to the Datacenter LAN.

For granularity, overlay policies are destined for the source and destination specified only. Therefore, an overlay policy from site A crossing overlay networks to site B does not automatically allow traffic in the opposite direction from site B to site A. You must create a separate overlay policy for traffic in the opposite direction between sites.

To configure an overlay policy to allow traffic from the Datacenter LAN to the Branch 1 LAN:

1. Go to SDWan Overlay > Overlay policy.

2. Click Create.

3. Configure the policy as follows:

   Name		DCport3-to-Br1port3
   Source		Address
   	Site	Datacenter
   	Interface	port3 10.1.100.0/24
   	Address	port3@Datacenter
   Destination		Address
   	Site	Branch-1
   	Interface	port3 10.1.1.0/24
   	Address	port3@Branch-1
   Service		ALL
   Service Group
   Schedule/Schedule Group		Schedule
   Schedule		always
   Action		accept
   Security Profiles
   	AntiVirus	default
   	Web Filter	default
   	Application Control	default
   	Intrusion Prevention	default
   Logging Options
   	Log Allowed Traffic	Enabled, All Sessions
   	Generate Logs when Session Starts	Disabled
   	Description	DC port3 to Br1 port3
   Enable this policy		Enabled

4. Click OK.

5. In SDWan Overlay > Overlay policy:

   1. Status is new. Right-click the policy, then click Save.

   2. Status is unsynced. Right-click the policy, then click Apply.

   3. Status is synced. The policy has been applied to the FortiGate devices in the specified sites.

To test and verify connectivity from the Datacenter LAN to the Branch 1 LAN:

1. Run these CLI commands on the Datacenter FortiGate:

   # execute ping-options source <IP address in Datacenter LAN>
   # execute ping <IP address in Branch 1 LAN>

2. Observe the following output:

   Datacenter# execute ping-options source 10.1.100.1
   
   Datacenter# execute ping 10.1.1.99
   PING 10.1.1.99 (10.1.1.99): 56 data bytes
   64 bytes from 10.1.1.99: icmp_seq=0 ttl=255 time=0.7 ms
   64 bytes from 10.1.1.99: icmp_seq=1 ttl=255 time=2.7 ms
   64 bytes from 10.1.1.99: icmp_seq=2 ttl=255 time=1.2 ms
   64 bytes from 10.1.1.99: icmp_seq=3 ttl=255 time=1.9 ms
   64 bytes from 10.1.1.99: icmp_seq=4 ttl=255 time=0.6 ms
   
   --- 10.1.1.99 ping statistics ---
   5 packets transmitted, 5 packets received, 0% packet loss
   round-trip min/avg/max = 0.6/1.4/2.7 ms

To test and verify connectivity from the Branch 1 LAN and the Datacenter LAN is not allowed by the overlay policy:

1. Run these CLI commands on the Branch 1 FortiGate:

   # execute ping-options source <IP address in Branch 1 LAN>
   # execute ping <IP address in Datacenter LAN>

2. Observe the following output:

   Branch-1# execute ping-options source 10.1.1.99
   
   Branch-1# execute ping 10.1.100.1
   PING 10.1.100.1 (10.1.100.1): 56 data bytes
   
   --- 10.1.100.1 ping statistics ---
   5 packets transmitted, 0 packets received, 100% packet loss

To configure an overlay policy to allow traffic from the Branch 1 LAN to the Datacenter LAN:

1. Go to SDWan Overlay > Overlay policy.

2. Configure the policy as follows:

   Name		Br1port3-to-DCport3
   Source		Address
   	Site	Branch-1
   	Interface	port3 10.1.1.0/24
   	Address	port3@Branch-1
   Destination		Address
   	Site	Datacenter
   	Interface	port3 10.1.100.0/24
   	Address	port3@Datacenter
   Service		ALL
   Service Group
   Schedule/Schedule Group		Schedule
   Schedule		always
   Action		accept
   Logging Options
   	Log Allowed Traffic	Enabled, All Sessions
   	Generate Logs when Session Starts	Disabled
   	Description
   Enable this policy		Enabled

3. Click OK.

4. In SDWan Overlay > Overlay policy:

   1. Status is new. Right-click the policy, then click Save.

   2. Status is unsynced. Right-click the policy, then click Apply.

   3. Status is synced. The policy has been applied to the FortiGate devices in the specified sites.

To test and verify connectivity from the Branch 1 LAN to the Datacenter LAN:

1. Run these CLI commands on the Branch 1 FortiGate:

   # execute ping-options source <IP address in Branch 1 LAN>
   # execute ping <IP address in Datacenter LAN>
   

2. Observe the following output:

   Branch-1# execute ping-options source 10.1.1.99
   
   Branch-1# execute ping 10.1.100.1
   PING 10.1.100.1 (10.1.100.1): 56 data bytes
   64 bytes from 10.1.100.1: icmp_seq=0 ttl=254 time=50.6 ms
   64 bytes from 10.1.100.1: icmp_seq=1 ttl=255 time=0.4 ms
   64 bytes from 10.1.100.1: icmp_seq=2 ttl=255 time=0.5 ms
   64 bytes from 10.1.100.1: icmp_seq=3 ttl=255 time=0.7 ms
   64 bytes from 10.1.100.1: icmp_seq=4 ttl=255 time=0.4 ms
   
   --- 10.1.100.1 ping statistics ---
   5 packets transmitted, 5 packets received, 0% packet loss
   round-trip min/avg/max = 0.4/10.5/50.6 ms