SD-WAN configuration is required to load balance based on the quality of the links. It can be configured to select the best link based on characteristics such as jitter, packet loss, and latency. A policy route is created by the FortiGate to select the best link based on the defined criteria.
For SD-WAN interfaces, or members, the peer is defined to reference the BGP neighbor that is tied to that specific interface.
The health check is the ping server that gathers the link characteristics used for link selection. It is recommended that the minimum
failtime be set to
The service definition defines the criteria for the policy routes. It can match based on the following characteristics:
- Destination Address
- Source Address
- Identity Based Group
- Internet Service Definition
- Source Port
- Destination Port
- Destination Route Tag
To dynamically determine the networks of the policy routes, routes that are learned from a BGP neighbor are matched against a route map, and a tag is defined for the matching routes. The service rules learn the networks based on these tags, instead of defining objects based on the learned addresses' network prefixes . See Dynamic definition of SD-WAN routes for details on configuring the FortiGate to use the destination tags for the SD-WAN service definition.
To define the SD-WAN member interfaces:
config system virtual-wan-link set status enable config members edit 1 set interface "vpn_dc1-1" next edit 2 set interface "vpn_dc1-2" next end end
To define the SD-WAN health checks:
config system virtual-wan-link config health-check edit "datacenter1" set server "10.200.1.1" set interval 1 set failtime 2 set recoverytime 10 next end end
To define the SD-WAN service rules:
config system virtual-wan-link config service edit 1 set mode priority set dst n-corporate set health-check "datacenter1" set priority-members 1 2 next end end