Fortinet black logo

Administration Guide

SD-WAN configuration portability

SD-WAN configuration portability

When configuring SD-WAN, adding interfaces to members is optional.

This allows the SD-WAN to be configured without associating any interfaces to SD-WAN members. It also allows a configuration to be copied directly from one device to another, without requiring the devices to have interfaces with the same names.

After the configuration is created, add interfaces to the members make it functional.

Example 1

In this example, we create a template with two SD-WAN members configured without assigned interfaces that are used in a performance SLA and SD-WAN rule. The template can be used to configure new devices, as in Example 2. Interfaces are then assigned to the members, and the configuration becomes active.

To create the SD-WAN members in the GUI:
  1. Go to Network > SD-WAN, select the SD-WAN Zones tab, and click Create New > SD-WAN Member.
  2. Leave all the settings set to their default values and click OK.

  3. Repeat the above steps to create a second member.

    The empty members are listed on the SD-WAN Zones tab.

    The members are disabled until interfaces are configured, but can still be used in performance SLAs and SD-WAN rules.

To create a performance SLA in the GUI:
  1. Go to Network > SD-WAN and select the Performance SLAs tab.
  2. Click Create New.
  3. Configure the performance SLA, specifying the empty members as participants.

  4. Click OK.
To create an SD-WAN rule in the GUI:
  1. Go to Network > SD-WAN, select the SD-WAN Rules tab, and click Create New.
  2. Configure the rule, adding both members to the Interface preference field:

  3. Click OK.
To assign interfaces to the SD-WAN members in the GUI:
  1. Go to Network > SD-WAN and select the SD-WAN Zones tab.
  2. Edit the first member
  3. Set Interface to an actual interface.

  4. Click OK.
  5. Repeat the above steps to assign an interface to the second member.
To configure the SD-WAN in the CLI:
  1. Create SD-WAN members:
    config system sdwan
        set status enable
        config members
            edit 1
            next
            edit 2
            next
        end
    end
  2. Create a health check (performance SLA):
    config system sdwan
        config health-check
            edit "office"
                set server "office365.com"
                set protocol http
                set sla-fail-log-period 300
                set sla-pass-log-period 300
                set members 2 1
                config sla
                    edit 1
                        set latency-threshold 300
                        set jitter-threshold 200
                    next
                    edit 2
                        set link-cost-factor latency
                        set latency-threshold 20
                    next
                end
            next
        end
    end
  3. Create a service (rule):
    config system sdwan
        config service
            edit 3
                set name "Office365"
                set mode sla
                set internet-service enable
                set internet-service-app-ctrl 33182
                config sla
                    edit "office"
                        set id 2
                    next
                end
                set priority-members 1 2
            next
        end
    end

    The SD-WAN configuration can now be used in as a template for new spokes, as in Example 2.

To assign interfaces to the SD-WAN members in the CLI:
config system sdwan
    config members
        edit 1
            set interface "_OCVPN4-0.0"
        next
        edit 2
            set interface "_OCVPN4-0.1"
        next
    end
end
Note

If no SD-WAN zone is specified, members are added to the default virtual-wan-link zone.

Example 2

In this example, the configuration from Example 1 is copied onto a new FortiGate.

Using the CLI console and the GUI

To copy the SD-WAN configuration from the original FortiGate:
  1. Optionally, change the console screen paging setting. See Screen paging for details.
  2. Open the CLI console.
  3. If necessary, click Clear console to empty the console.
  4. Enter the following command:

    show system sdwan

  5. Either click Download and open the file in a text editor, or click Copy to clipboard and paste the content into a text editor.

  6. Edit the CLI configuration as necessary. For example, the first line that shows the show command should be deleted, and the default health checks can be removed.
  7. If required, save the CLI configuration as a text file.
To paste the SD-WAN configuration onto a new FortiGate:
  1. Copy the SD-WAN configuration from the text editor.
  2. On the new FortiGate, open the CLI console.
  3. Press Ctrl + v to paste the CLI commands.
  4. In necessary, press Enter to apply the last end command.

    The SD-WAN configuration is copied to the new FortiGate.

    If the interfaces do not exist, the SD-WAN members are created without interfaces, and are disabled until interfaces are configured.

To assign interfaces to the SD-WAN members:
  1. Go to Network > SD-WAN and select the SD-WAN Zones tab.
  2. Edit the first member
  3. Set Interface to an actual interface.
  4. Click OK.
  5. Repeat the above steps to assign an interface to the second member.

Using a terminal emulator

The following instructions use PuTTy. The steps may vary in other terminal emulators.

To copy the SD-WAN configuration from the original FortiGate:
  1. Connect to the FortiGate. See Connecting to the CLI for details.
  2. Enter the following command:

    show system sdwan

  3. Select the output, press Ctrl + c to copy it, and then paste it into a text editor.
  4. Edit the CLI configuration as necessary. For example, the default health checks can be removed.
  5. If required, save the CLI configuration as a text file.
To paste the SD-WAN configuration onto a new FortiGate:
  1. Connect to the new FortiGate. See Connecting to the CLI for details.
  2. Copy the SD-WAN configuration from the text editor.
  3. Right-click to paste the SD-WAN configuration.
  4. In necessary, press Enter to apply the last end command.

    The SD-WAN configuration is copied to the new FortiGate.

    If the interfaces do not exist, the SD-WAN members are created without interfaces, and are disabled until interfaces are configured.

To assign interfaces to the SD-WAN members in the CLI:
config system sdwan
    config members
        edit 1
            set interface "_OCVPN4-0.0"
        next
        edit 2
            set interface "_OCVPN4-0.1"
        next
    end
end
Note

If no SD-WAN zone is specified, members are added to the default virtual-wan-link zone.

SD-WAN configuration portability

When configuring SD-WAN, adding interfaces to members is optional.

This allows the SD-WAN to be configured without associating any interfaces to SD-WAN members. It also allows a configuration to be copied directly from one device to another, without requiring the devices to have interfaces with the same names.

After the configuration is created, add interfaces to the members make it functional.

Example 1

In this example, we create a template with two SD-WAN members configured without assigned interfaces that are used in a performance SLA and SD-WAN rule. The template can be used to configure new devices, as in Example 2. Interfaces are then assigned to the members, and the configuration becomes active.

To create the SD-WAN members in the GUI:
  1. Go to Network > SD-WAN, select the SD-WAN Zones tab, and click Create New > SD-WAN Member.
  2. Leave all the settings set to their default values and click OK.

  3. Repeat the above steps to create a second member.

    The empty members are listed on the SD-WAN Zones tab.

    The members are disabled until interfaces are configured, but can still be used in performance SLAs and SD-WAN rules.

To create a performance SLA in the GUI:
  1. Go to Network > SD-WAN and select the Performance SLAs tab.
  2. Click Create New.
  3. Configure the performance SLA, specifying the empty members as participants.

  4. Click OK.
To create an SD-WAN rule in the GUI:
  1. Go to Network > SD-WAN, select the SD-WAN Rules tab, and click Create New.
  2. Configure the rule, adding both members to the Interface preference field:

  3. Click OK.
To assign interfaces to the SD-WAN members in the GUI:
  1. Go to Network > SD-WAN and select the SD-WAN Zones tab.
  2. Edit the first member
  3. Set Interface to an actual interface.

  4. Click OK.
  5. Repeat the above steps to assign an interface to the second member.
To configure the SD-WAN in the CLI:
  1. Create SD-WAN members:
    config system sdwan
        set status enable
        config members
            edit 1
            next
            edit 2
            next
        end
    end
  2. Create a health check (performance SLA):
    config system sdwan
        config health-check
            edit "office"
                set server "office365.com"
                set protocol http
                set sla-fail-log-period 300
                set sla-pass-log-period 300
                set members 2 1
                config sla
                    edit 1
                        set latency-threshold 300
                        set jitter-threshold 200
                    next
                    edit 2
                        set link-cost-factor latency
                        set latency-threshold 20
                    next
                end
            next
        end
    end
  3. Create a service (rule):
    config system sdwan
        config service
            edit 3
                set name "Office365"
                set mode sla
                set internet-service enable
                set internet-service-app-ctrl 33182
                config sla
                    edit "office"
                        set id 2
                    next
                end
                set priority-members 1 2
            next
        end
    end

    The SD-WAN configuration can now be used in as a template for new spokes, as in Example 2.

To assign interfaces to the SD-WAN members in the CLI:
config system sdwan
    config members
        edit 1
            set interface "_OCVPN4-0.0"
        next
        edit 2
            set interface "_OCVPN4-0.1"
        next
    end
end
Note

If no SD-WAN zone is specified, members are added to the default virtual-wan-link zone.

Example 2

In this example, the configuration from Example 1 is copied onto a new FortiGate.

Using the CLI console and the GUI

To copy the SD-WAN configuration from the original FortiGate:
  1. Optionally, change the console screen paging setting. See Screen paging for details.
  2. Open the CLI console.
  3. If necessary, click Clear console to empty the console.
  4. Enter the following command:

    show system sdwan

  5. Either click Download and open the file in a text editor, or click Copy to clipboard and paste the content into a text editor.

  6. Edit the CLI configuration as necessary. For example, the first line that shows the show command should be deleted, and the default health checks can be removed.
  7. If required, save the CLI configuration as a text file.
To paste the SD-WAN configuration onto a new FortiGate:
  1. Copy the SD-WAN configuration from the text editor.
  2. On the new FortiGate, open the CLI console.
  3. Press Ctrl + v to paste the CLI commands.
  4. In necessary, press Enter to apply the last end command.

    The SD-WAN configuration is copied to the new FortiGate.

    If the interfaces do not exist, the SD-WAN members are created without interfaces, and are disabled until interfaces are configured.

To assign interfaces to the SD-WAN members:
  1. Go to Network > SD-WAN and select the SD-WAN Zones tab.
  2. Edit the first member
  3. Set Interface to an actual interface.
  4. Click OK.
  5. Repeat the above steps to assign an interface to the second member.

Using a terminal emulator

The following instructions use PuTTy. The steps may vary in other terminal emulators.

To copy the SD-WAN configuration from the original FortiGate:
  1. Connect to the FortiGate. See Connecting to the CLI for details.
  2. Enter the following command:

    show system sdwan

  3. Select the output, press Ctrl + c to copy it, and then paste it into a text editor.
  4. Edit the CLI configuration as necessary. For example, the default health checks can be removed.
  5. If required, save the CLI configuration as a text file.
To paste the SD-WAN configuration onto a new FortiGate:
  1. Connect to the new FortiGate. See Connecting to the CLI for details.
  2. Copy the SD-WAN configuration from the text editor.
  3. Right-click to paste the SD-WAN configuration.
  4. In necessary, press Enter to apply the last end command.

    The SD-WAN configuration is copied to the new FortiGate.

    If the interfaces do not exist, the SD-WAN members are created without interfaces, and are disabled until interfaces are configured.

To assign interfaces to the SD-WAN members in the CLI:
config system sdwan
    config members
        edit 1
            set interface "_OCVPN4-0.0"
        next
        edit 2
            set interface "_OCVPN4-0.1"
        next
    end
end
Note

If no SD-WAN zone is specified, members are added to the default virtual-wan-link zone.