Per-link controls for policy and SLA checks 6.2.1
The following SD-WAN features are available for per-link controls for policy and SLA checks:
- Firewall policies can use SD-WAN members as source and destination interfaces. This allows controlling traffic so that certain types of traffic can only use certain SD-WAN members.
- Per link health-check parameters are supported in SLA configurations using the following CLI command:
config system virtual-wan-link config service edit <priority_rule> set sla-compare-method number next end end
SLA values are compared based on the number of satisfied health-checks, and health-checks are limited to configured member interfaces only. The member with the most health-check passes is set as the priority member. This only applies to SLA mode and load-balance mode rules.
- The size of the virtual WAN link destination wildcard table in a policy route entry is increased to 32768 entries.
In this example, a customer has four health checks and two SD-WAN members:
- health-check1 and health-check2 check SD-WAN member1
- health-check3 and health-check4 check SD-WAN member2
The customers wants traffic that is going to destination A to use the SD-WAN member that passes the most SLAs. For example, if health-check1 fails, then member1 only has one pass, while member2 has two passes, and traffic will use member2 for forwarding. If both of member2's checks also failed, then traffic would use member1.
To configure the FortiGate device:
config system virtual-wan-link config members edit 1 set interface "port1" next edit 2 set interface "port2" next end config health-check edit "ping1" set server "x.x.x.x" set members 1 config sla edit 1 next end next edit "ping2" set server "x.x.x.x" set members 1 config sla edit 1 next end next edit "ping3" set server "x.x.x.x" set members 2 config sla edit 1 next end next edit "ping4" set server "x.x.x.x" set members 2 config sla edit 1 next end next end config service edit 1 set mode sla set dst "destination-A" config sla edit "ping1" set id 1 next edit "ping2" set id 1 next edit "ping3" set id 1 next edit "ping4" set id 1 next end set priority-members 1 2 set sla-compare-method number next end end