Per-link controls for policy and SLA checks 6.2.1

The following SD-WAN features are available for per-link controls for policy and SLA checks:

• Firewall policies can use SD-WAN members as source and destination interfaces. This allows controlling traffic so that certain types of traffic can only use certain SD-WAN members.
• Per link health-check parameters are supported in SLA configurations using the following CLI command:

  config system virtual-wan-link
      config service
          edit <priority_rule>
              set sla-compare-method number
          next
      end
  end

  SLA values are compared based on the number of satisfied health-checks, and health-checks are limited to configured member interfaces only. The member with the most health-check passes is set as the priority member. This only applies to SLA mode and load-balance mode rules.

• The size of the virtual WAN link destination wildcard table in a policy route entry is increased to 32768 entries.

Example

In this example, a customer has four health checks and two SD-WAN members:

• health-check1 and health-check2 check SD-WAN member1
• health-check3 and health-check4 check SD-WAN member2

The customers wants traffic that is going to destination A to use the SD-WAN member that passes the most SLAs. For example, if health-check1 fails, then member1 only has one pass, while member2 has two passes, and traffic will use member2 for forwarding. If both of member2's checks also failed, then traffic would use member1.

To configure the FortiGate device:

config system virtual-wan-link
    config members
        edit 1
            set interface "port1"
        next
        edit 2
            set interface "port2"
        next
    end
    config health-check
        edit "ping1"
            set server "x.x.x.x"
            set members 1
            config sla
                edit 1
                next
            end
        next
        edit "ping2"
            set server "x.x.x.x"
            set members 1
            config sla
                edit 1
                next
            end
        next
        edit "ping3"
            set server "x.x.x.x"
            set members 2
            config sla
                edit 1
                next
            end
        next
        edit "ping4"
            set server "x.x.x.x"
            set members 2
            config sla
                edit 1
                next
            end
        next
    end
    config service
        edit 1
            set mode sla
            set dst "destination-A"
            config sla
                edit "ping1"
                    set id 1
                next
                edit "ping2"
                    set id 1
                next
                edit "ping3"
                    set id 1
                next
                edit "ping4"
                    set id 1
                next
            end
            set priority-members 1 2
            set sla-compare-method number
        next
    end
end