Per-link controls for policies and SLA checks

Firewall policies can use SD-WAN members as source and destination interfaces. This allows controlling traffic so that certain types of traffic can only use certain SD-WAN members.

Per link health-check parameters are supported in SLA configurations using the following CLI command:

config system virtual-wan-link
    config service
        edit <priority_rule>
            set sla-compare-method number
        next
    end
end

SLA values are compared based on the number of satisfied health checks, and health checks are limited to configured member interfaces only. The member with the most health check passes is set as the priority member. This only applies to SLA mode and load balance mode rules.

Example

In this example, a customer has four health checks and two SD-WAN members:

• health-check1 and health-check2 check SD-WAN member1
• health-check3 and health-check4 check SD-WAN member2

The customer wants traffic going to destination A to use the SD-WAN member that passes the most SLAs. For example, if health-check1 fails, then member1 only has one pass, while member2 has two passes, and traffic will use member2 for forwarding. If both checks fail for member2, then traffic would use member1.

To configure the FortiGate device:

config system virtual-wan-link
    config members
        edit 1
            set interface "port1"
        next
        edit 2
            set interface "port2"
        next
    end
    config health-check
        edit "ping1"
            set server "x.x.x.x"
            set members 1
            config sla
                edit 1
                next
            end
        next
        edit "ping2"
            set server "x.x.x.x"
            set members 1
            config sla
                edit 1
                next
            end
        next
        edit "ping3"
            set server "x.x.x.x"
            set members 2
            config sla
                edit 1
                next
            end
        next
        edit "ping4"
            set server "x.x.x.x"
            set members 2
            config sla
                edit 1
                next
            end
        next
    end
    config service
        edit 1
            set mode sla
            set dst "destination-A"
            config sla
                edit "ping1"
                    set id 1
                next
                edit "ping2"
                    set id 1
                next
                edit "ping3"
                    set id 1
                next
                edit "ping4"
                    set id 1
                next
            end
            set priority-members 1 2
            set sla-compare-method number
        next
    end
end