Per-link controls for policies and SLA checks
Firewall policies can use SD-WAN members as source and destination interfaces. This allows controlling traffic so that certain types of traffic can only use certain SD-WAN members.
Per link health-check parameters are supported in SLA configurations using the following CLI command:
config system virtual-wan-link config service edit <priority_rule> set sla-compare-method number next end end
SLA values are compared based on the number of satisfied health checks, and health checks are limited to configured member interfaces only. The member with the most health check passes is set as the priority member. This only applies to SLA mode and load balance mode rules.
In this example, a customer has four health checks and two SD-WAN members:
- health-check1 and health-check2 check SD-WAN member1
- health-check3 and health-check4 check SD-WAN member2
The customer wants traffic going to destination A to use the SD-WAN member that passes the most SLAs. For example, if health-check1 fails, then member1 only has one pass, while member2 has two passes, and traffic will use member2 for forwarding. If both checks fail for member2, then traffic would use member1.
To configure the FortiGate device:
config system virtual-wan-link config members edit 1 set interface "port1" next edit 2 set interface "port2" next end config health-check edit "ping1" set server "x.x.x.x" set members 1 config sla edit 1 next end next edit "ping2" set server "x.x.x.x" set members 1 config sla edit 1 next end next edit "ping3" set server "x.x.x.x" set members 2 config sla edit 1 next end next edit "ping4" set server "x.x.x.x" set members 2 config sla edit 1 next end next end config service edit 1 set mode sla set dst "destination-A" config sla edit "ping1" set id 1 next edit "ping2" set id 1 next edit "ping3" set id 1 next edit "ping4" set id 1 next end set priority-members 1 2 set sla-compare-method number next end end