Fortinet white logo
Fortinet white logo

SD-WAN Deployment for MSSPs

SD-WAN as default route

SD-WAN as default route

According to rule #2, by default, SD-WAN rules select a member only if there is a valid route to the destination through that member. For Spoke-to-Hub and Spoke-to-Spoke traffic, this valid route will normally be learned through BGP. However, for Spoke-to-Internet traffic, no specific route is learned. Hence, for example, in order for the Remote Internet Access to work as desired in our examples, it is required to have a default gateway through the MPLS overlays (H1_MPLS, H2_MPLS). Otherwise the traffic destined to the Internet would never be backhauled to the Hubs.

Configuring SD-WAN to act as a default route for the "overlay" zone solves this problem. Furthermore, it eliminates the need to adjust the routing configuration whenever your SD-WAN rules change. Simply put, it ensures that there will always be a valid route to any destination through any SD-WAN member that is selected by the SD-WAN rules. Thus, SD-WAN rules become fully responsible for the traffic steering, in accordance with our recommended design approach. For these reasons, we have recommended this configuration throughout this document.

Nevertheless, it is worth noting a few alternatives to this approach:

SD-WAN as default route

SD-WAN as default route

According to rule #2, by default, SD-WAN rules select a member only if there is a valid route to the destination through that member. For Spoke-to-Hub and Spoke-to-Spoke traffic, this valid route will normally be learned through BGP. However, for Spoke-to-Internet traffic, no specific route is learned. Hence, for example, in order for the Remote Internet Access to work as desired in our examples, it is required to have a default gateway through the MPLS overlays (H1_MPLS, H2_MPLS). Otherwise the traffic destined to the Internet would never be backhauled to the Hubs.

Configuring SD-WAN to act as a default route for the "overlay" zone solves this problem. Furthermore, it eliminates the need to adjust the routing configuration whenever your SD-WAN rules change. Simply put, it ensures that there will always be a valid route to any destination through any SD-WAN member that is selected by the SD-WAN rules. Thus, SD-WAN rules become fully responsible for the traffic steering, in accordance with our recommended design approach. For these reasons, we have recommended this configuration throughout this document.

Nevertheless, it is worth noting a few alternatives to this approach: