Setting up the load balancing SD-WAN configuration

The SD-WAN configuration sets up load balancing based on link quality. Link quality is determined by health checking; which measures jitter, packet loss, and latency on each link. FortiOS dynamically creates policy routes that send traffic over the link with the highest quality.

1. Create an SD-WAN Interface (also called a virtual WAN link) and add the IPsec VPN tunnel interfaces to it. These members are also the BGP neighbors that are tied to specific interfaces.

   config system virtual-wan-link

   set status enable

   config members

   edit 1

   set interface "vpn_dc1-1"

   next

   edit 2

   set interface "vpn_dc1-2"

   next

   end

   end

2. Create SD-WAN Health-Checks for each data center network. Set server to the IP address of a server on the data center network.

   config system virtual-wan-link

   config health-check

   edit "datacenter1-net"

   set server "10.200.1.1"

   set interval 1

   set failtime 1

   set recoverytime 3

   next

   edit "datacenter2-net"

   set server "10.200.2.1"

   set interval 1

   set failtime 1

   set recoverytime 3

   end

   end

3. Add SD-WAN Service Rules to define the criteria for the policy routes. Criteria include:
   • Protocol
   • Destination Address
   • Source Address
   • Identity Based Group
   • Internet Service Definition
   • Source Port
   • Destination Port
   • Destination Tag

   config system virtual-wan-link

   config service

   edit 1

   set mode priority

   set dst-tag 10

   set health-check "datacenter1-net"

   set priority-members 1 2

   next

   edit 2

   set mode priority

   set dst-tag 10

   set health-check "datacenter2-net"

   set priority-members 1 2

   next

   end

   end

To dynamically determine the networks the policy routes point to, the routes learned from a BGP neighbor are matched against a route map and matching routes are tagged. The service rules determine the routes to use based on these tags.