Defining a preferred source IP for local-out egress interfaces on SD-WAN members

The preferred source IP can be configured on SD-WAN members so that local-out traffic is sourced from that IP. In the following example, two SD-WAN members (port5 and port6) will use loopback1 and loopback2 as sources instead of their physical interface address. A static route is created for destination 200.0.0.0/24 to use the virtual-wan-link. In turn, the FortiGate will create two ECMP routes to the member gateways and source the traffic from the loopback IPs.

To configure preferred source IPs for SD-WAN members:

1. Configure the SD-WAN members and other settings:

   config system sdwan
       set status enable
       config zone
           edit "virtual-wan-link"
           next
       end
       config members
           edit 1
               set interface "port5"
               set gateway 10.100.1.1
               set preferred-source 1.1.1.1
               set source 1.1.1.1
           next
           edit 2
               set interface "port7"
               set gateway 10.100.1.5
               set preferred-source 1.1.1.2
               set source 1.1.1.2
           next
       end
   end

   In the SD-WAN config members settings, configuring the source for the health check probes is still required. SD-WAN adds dedicated kernel routes (proto=17) for the health checks using the interface IP or source IP when specified. To view the kernel routes, use diagnose ip route list.

2. Configure the static route:

   config router static
       edit 2000
           set dst 200.0.0.0 255.255.255.0
           set distance 1
           set sdwan-zone "virtual-wan-link"
       next
   end

To verify the configuration:

1. Verify the kernel routing table for 200.0.0.0/24:

   # get router info kernel | grep -A 2 200.0.0.0/24
   tab=254 vf=0 scope=0 type=1 proto=11 prio=1 0.0.0.0/0.0.0.0/0->200.0.0.0/24 pref=0.0.0.0
           gwy=10.100.1.1 flag=14 hops=255 oif=13(port5) pref=1.1.1.1
           gwy=10.100.1.5 flag=14 hops=254 oif=15(port7) pref=1.1.1.2

2. Verify the routing table for 200.0.0.0/24:

   # get router info routing-table details 200.0.0.0/24
   Routing table for VRF=0
   Routing entry for 200.0.0.0/24
     Known via "static", distance 1, metric 0, best
     * vrf 0 10.100.1.1, via port5, prefsrc 1.1.1.1
     * vrf 0 10.100.1.5, via port7, prefsrc 1.1.1.2

3. Run a sniffer trace after some traffic passes.

   1. When traffic leaves port5:

      # diagnose sniffer packet any "host 200.0.0.1" 4
      interfaces=[any]
      filters=[host 200.0.0.1]
      6.592488 port5 out 1.1.1.1 -> 200.0.0.1: icmp: echo request
      7.592516 port5 out 1.1.1.1 -> 200.0.0.1: icmp: echo request
      8.592532 port5 out 1.1.1.1 -> 200.0.0.1: icmp: echo request

   2. When traffic leaves port7:

      # diagnose sniffer packet any "host 200.0.0.1" 4
      interfaces=[any]
      filters=[host 200.0.0.1]
      75.664173 port7 out 1.1.1.2 -> 200.0.0.1: icmp: echo request
      76.664194 port7 out 1.1.1.2 -> 200.0.0.1: icmp: echo request
      

   Traffic exiting each interface is sourced from the corresponding loopback IP.