Fortinet Document Library

Version:

Version:


Table of Contents

Cookbook

Download PDF
Copy Link

Creating the SD-WAN interface

This recipe provides an example of how to start using SD-WAN for load balancing and redundancy.

In this example, two ISP internet connections (wan1 and wan2) use SD-WAN to balance traffic between them at 50% each.

To configure SD-WAN using the GUI:
  1. On the FortiGate, enable SD-WAN and add interfaces wan1 and wan2 as members:
    1. Go to Network > SD-WAN.
    2. Set the Status to Enable.
    3. Click the plus icon to add members, using the ISPs' proper gateways for each member.

      If IPv6 visibility is enabled in the GUI, an IPv6 gateway can also be added for each member. See Feature visibility for details.

    4. Click Apply to save your settings.
  2. Create a static route with virtual-wan-link enabled:
    1. Go to Network > Static Routes.
    2. Click Create New. The New Static Route page opens.
    3. From the Interface drop-down list, select SD-WAN.
    4. Click OK to save your changes.
  3. Create a firewall policy to allow the traffic:
    1. Go to Policy & Objects > IPv4 Policy.
    2. Click Create New. The New Policy page opens.
    3. For the Incoming Interface, select DMZ.
    4. For the Outgoing Interface, select SD-WAN.
    5. Configure the remaining settings as needed, then click OK to create the policy.

    Outgoing traffic will balance between wan1 and wan2 at a 50:50 ratio.

To configure SD-WAN using the CLI:
  1. On the FortiGate, configure the wan1 and wan2 interfaces:
    config system interface 
        edit "wan1"
            set alias to_ISP1
            set ip 172.16.20.1 255.255.255.0
        next
        edit "wan2"
            set alias to_ISP2
            set ip 10.100.20.1 255.255.255.0
        next
    end
  2. Enable SD-WAN and add the interfaces as members:
    config system virtual-wan-link
        set status enable
        config members
            edit 1
                set interface "wan1"
                set gateway 172.16.20.2
            next
            edit 2
                set interface "wan2"
                set gateway 10.100.20.2
            next
        end
    end
  3. Configure a static route:
    config router static
        edit 1
            set distance 1
            set virtual-wan-link enable
        next
    end
  4. Configure a firewall policy:
    config firewall policy
        edit 2
            set name "VWL"
            set srcintf "dmz"
            set dstintf "virtual-wan-link"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set nat enable
        next
    end
  5. Use a diagnose command to check the state of the SD-WAN:
    # diagnose sys virtual-wan-link member
    Member(1): interface: wan1, gateway: 172.16.20.2, priority: 0, weight: 0
    Member(2): interface: wan2, gateway: 10.100.20.2, priority: 0, weight: 0 

Creating the SD-WAN interface

This recipe provides an example of how to start using SD-WAN for load balancing and redundancy.

In this example, two ISP internet connections (wan1 and wan2) use SD-WAN to balance traffic between them at 50% each.

To configure SD-WAN using the GUI:
  1. On the FortiGate, enable SD-WAN and add interfaces wan1 and wan2 as members:
    1. Go to Network > SD-WAN.
    2. Set the Status to Enable.
    3. Click the plus icon to add members, using the ISPs' proper gateways for each member.

      If IPv6 visibility is enabled in the GUI, an IPv6 gateway can also be added for each member. See Feature visibility for details.

    4. Click Apply to save your settings.
  2. Create a static route with virtual-wan-link enabled:
    1. Go to Network > Static Routes.
    2. Click Create New. The New Static Route page opens.
    3. From the Interface drop-down list, select SD-WAN.
    4. Click OK to save your changes.
  3. Create a firewall policy to allow the traffic:
    1. Go to Policy & Objects > IPv4 Policy.
    2. Click Create New. The New Policy page opens.
    3. For the Incoming Interface, select DMZ.
    4. For the Outgoing Interface, select SD-WAN.
    5. Configure the remaining settings as needed, then click OK to create the policy.

    Outgoing traffic will balance between wan1 and wan2 at a 50:50 ratio.

To configure SD-WAN using the CLI:
  1. On the FortiGate, configure the wan1 and wan2 interfaces:
    config system interface 
        edit "wan1"
            set alias to_ISP1
            set ip 172.16.20.1 255.255.255.0
        next
        edit "wan2"
            set alias to_ISP2
            set ip 10.100.20.1 255.255.255.0
        next
    end
  2. Enable SD-WAN and add the interfaces as members:
    config system virtual-wan-link
        set status enable
        config members
            edit 1
                set interface "wan1"
                set gateway 172.16.20.2
            next
            edit 2
                set interface "wan2"
                set gateway 10.100.20.2
            next
        end
    end
  3. Configure a static route:
    config router static
        edit 1
            set distance 1
            set virtual-wan-link enable
        next
    end
  4. Configure a firewall policy:
    config firewall policy
        edit 2
            set name "VWL"
            set srcintf "dmz"
            set dstintf "virtual-wan-link"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set nat enable
        next
    end
  5. Use a diagnose command to check the state of the SD-WAN:
    # diagnose sys virtual-wan-link member
    Member(1): interface: wan1, gateway: 172.16.20.2, priority: 0, weight: 0
    Member(2): interface: wan2, gateway: 10.100.20.2, priority: 0, weight: 0