Results

These sections show the function of SD-WAN with respect to DSCP tagged traffic steering, and can help confirm that it is running as expected:

• Verifying the DSCP tagged traffic on FortiGate
• Verifying the service rules
• Verifying traffic steering on the SD-WAN rules
• Verifying that steered traffic is leaving from the expected interface

Verifying the DSCP tagged traffic on FortiGate

Packet sniffing is used to verify the incoming DSCP tagged traffic. See Using the FortiOS built-in packet sniffer for more information.

Wireshark is used to verify that VoIP traffic is tagged with the expected DSCP tag, 0x70 or 0x30.

VoIP traffic marked with DSCP tag 0x70:

# diagnose sniffer packet any '(ip and ip[1] & 0xfc == 0x70)' 6 0 l

Web traffic marked with DSCP tag 0x30:

# diagnose sniffer packet any '(ip and ip[1] & 0xfc == 0x30)' 6 0 l

Verifying the service rules

To check that the expected DSCP tags and corresponding interfaces are used by the SD-WAN rules to steer traffic:

# diagnose sys sdwan service

Service(5): Address Mode(IPV4) flags=0x0

Gen(1), TOS(0x70/0xf0), Protocol(0: 1->65535), Mode(manual)

Members:

1: Seq_num(4 Branch-HQ-B), alive, selected

Dst address:

0.0.0.0-255.255.255.255

Service(3): Address Mode(IPV4) flags=0x0

Gen(1), TOS(0x30/0xf0), Protocol(0: 1->65535), Mode(manual)

Members:

1: Seq_num(2 port5), alive, selected

Dst address:

0.0.0.0-255.255.255.255

Service(2): Address Mode(IPV4) flags=0x0

Gen(1), TOS(0x0/0x0), Protocol(0: 1->65535), Mode(sla), sla-compare-order

Members:

1: Seq_num(1 port1), alive, sla(0x1), cfg_order(0), cost(0), selected

2: Seq_num(2 port5), alive, sla(0x1), cfg_order(1), cost(10), selected

Dst address:

0.0.0.0-255.255.255.255

Verifying traffic steering on the SD-WAN rules

Go to Network > SD-WAN and select the SD-WAN Rules tab to check the Hit Count on the SD-WAN interfaces.

Verifying that steered traffic is leaving from the expected interface

To confirm that web traffic (port 443) flows through the correct underlay interface members, and VoIP traffic flows through the correct overlay interface members, go to Dashboard > FortiView Policies and double click on the policy name.

Web traffic is expected to leave on Interface_A (port1) or Interface_B (port5):

VoIP traffic is expected to leave on the preferred VPN_B_Tunnel (Branch-HQ-B) interface: