5.2 SD-WAN Architecture, Performance SLAs & Balancing Rules

5.2 SD-WAN Architecture, Performance SLAs & Balancing Rules

Software-Defined Wide Area Networking (SD-WAN) in FortiOS 7.6 integrates multi-WAN link management, continuous performance SLA monitoring, and dynamic traffic steering into the native FortiGate architecture. SD-WAN eliminates the complexity of static routing across redundant WAN links, allowing organizations to maximize bandwidth utilization and ensure high application availability.

---

1. SD-WAN Architecture & Interface Virtualization

FortiOS SD-WAN abstracts multiple physical WAN interfaces (such as fiber broadband, cable, 5G/LTE) and logical interfaces (such as IPsec VPN overlay tunnels) into consolidated virtual constructs called SD-WAN Zones.

Key Architectural Concepts

• SD-WAN Members: Individual physical or logical interfaces assigned to participate in SD-WAN traffic forwarding. Each member interface is configured with a Gateway IP address and an optional interface Cost metric.
• SD-WAN Zones: Logical groupings of SD-WAN member interfaces. FortiOS 7.6 provides default zones (virtual-wan-link, underlay, overlay) and permits custom zone creation (e.g., Internet-Zone, VPN-Overlay-Zone). Firewall policies reference SD-WAN Zones directly rather than individual interfaces.
• Prerequisites for Adding SD-WAN Members: Before an interface can be added as an SD-WAN member, all existing references to that interface in firewall policies, static routes, and service configurations must be removed or migrated to point to the SD-WAN interface/zone.

SD-WAN Global and Zone CLI Configuration

config system sdwan
    set status enable
    config zone
        edit "Internet-Zone"
        next
        edit "VPN-Overlay-Zone"
        next
    end
    config members
        edit 1
            set interface "port1"
            set zone "Internet-Zone"
            set gateway 203.0.113.1
            set cost 10
        next
        edit 2
            set interface "port2"
            set zone "Internet-Zone"
            set gateway 198.51.100.1
            set cost 10
        next
        edit 3
            set interface "ipsec-tun1"
            set zone "VPN-Overlay-Zone"
            set gateway 10.250.0.1
            set cost 5
        next
    end
end

---

2. Performance SLA Probes (Health-Checks)

Performance SLAs continuously measure the quality and real-time health of every SD-WAN member link using active synthetic probes.

Supported Probe Protocols & Metrics

FortiOS health-checks support multiple probe protocols:

• Ping (ICMP): Sends echo requests to target IP destinations (e.g., 8.8.8.8 or internal corporate gateways).
• HTTP / HTTPS: Performs GET/HEAD requests to evaluate web service responsiveness.
• TWAMP (Two-Way Active Measurement Protocol): Measures precise two-way delay and performance across high-performance enterprise networks.
• DNS: Sends domain resolution queries.

Probes measure three critical quality metrics across each link:

1. Latency: Round-trip time (RTT) delay in milliseconds (ms).
2. Jitter: Variation in latency over time in milliseconds (ms).
3. Packet Loss: Percentage of dropped probe packets over a defined sampling window (%).

Performance SLA CLI Configuration

config system sdwan
    config health-check
        edit "Corporate_SLA_Check"
            set server "203.0.113.50"
            set protocol ping
            set interval 1000
            set probe-timeout 500
            set recoverytime 5
            set members 1 2
            config sla
                edit 1
                    set latency-threshold 50
                    set jitter-threshold 10
                    set packetloss-threshold 1
                next
            end
        next
    end
end

If a member interface fails to receive probe responses exceeding the probe-timeout and failure threshold, FortiOS marks the link as DEAD or OUT OF SLA. SD-WAN rules immediately update traffic steering logic to divert sessions to healthy links.

---

3. SD-WAN Steering Strategies & Load-Balancing Rules

SD-WAN Rules evaluate matching network traffic (based on Source, Destination, Application Signatures, Protocol/Port, or User Groups) and select the optimal egress member interface using one of four core strategy modes:

SD-WAN Rule CLI Example (Lowest Cost SLA for Microsoft 365)

config system sdwan
    config service
        edit 1
            set name "M365_Traffic_Steering"
            set mode sla
            set dst "Office365"
            set src "10.0.0.0/8"
            config sla
                edit "Corporate_SLA_Check"
                    set id 1
                next
            end
            set priority-members 1 2
        next
    end
end

---

4. FortiOS Routing Lookup & SD-WAN Decision Logic

Understanding how FortiOS combines destination FIB routing with SD-WAN rules is a core requirement for the FCP exam.

Step-by-Step Packet Forwarding Flow

1. FIB Route Lookup First: FortiOS evaluates the destination IP against the FIB routing table. To trigger SD-WAN processing, a static route (typically default route 0.0.0.0/0) MUST point to the virtual sdwan interface.
2. SD-WAN Rule Table Evaluation: If destination lookup matches the sdwan virtual interface, FortiOS evaluates the SD-WAN service rule table from top to bottom (ID priority order).
3. Strategy & Health-Check Verification: When a custom SD-WAN rule matches, FortiOS inspects the real-time SLA probe status of the rule's priority members. It selects the winning member interface based on the configured strategy (Manual, Best Quality, Lowest Cost, Max Bandwidth).
4. Implicit SD-WAN Rule Fallback: If no custom SD-WAN rule matches the traffic flow, the packet falls through to the Implicit SD-WAN Rule. The implicit rule load balances traffic across all active member interfaces using the configured global load-balancing mode (Source IP hash, Spillover, Volume, or Session-based).

Diagnostics and Verification Commands

# Display SD-WAN service rules and active link decisions
diagnose sys sdwan service

# Display real-time Performance SLA probe measurements
diagnose sys sdwan health-check

# Display SD-WAN member interface status and metrics
diagnose sys sdwan intf-list