Security
Effective security within Fortinet's SD-WAN architecture begins with grouping interfaces into logical zones, such as “overlay” and “underlay.” These zones allow administrators to apply tailored firewall rules and security profiles to sets of interfaces serving similar functions. Not only does this simplify configuration, but it also ensures consistency and clarity in enforcing security policies across the network. An additional benefit is a reduction in the needed firewall policies to secure the traffic. As SD-WAN intelligence will steer application traffic between multiple interfaces as link performance fluctuates, the member interfaces grouped into zones are then used as the destination in firewall policies.
A critical principle of SD-WAN security is applying security at the originating site, particularly in hub-and-spoke topologies. This “shift-left” approach helps organizations address vulnerabilities at the earliest stage possible, reducing both cost and risk. By catching threats before they propagate downstream, you minimize potential damage to connected systems and users. This is particularly clear when implementing ADVPN, where spoke to spoke traffic may bypass the hub FortiGate completely. Often hubs typically maintain permissive policies for transit traffic, but will still implement security for policies that protect and provide access to hosted workloads.
Different traffic paths (e.g., direct internet access vs. corporate datacenter access) call for distinct security treatments. Rather than deploying a one-size-fits-all profiles, using purpose-built security profiles ensures that inspections are efficient and relevant. Mismatching security measures and traffic flows wastes resources and can create blind spots or increase false positives. Similarly, tuning each profile to reflect its target traffic type is essential. For example, a profile designed to protect a high-volume application server will have different thresholds, protocols, and inspection requirements compared to one safeguarding user web browsing.