5.4 SD-WAN
Key Takeaways
- FortiGate SD-WAN groups two or more WAN links (broadband, MPLS, LTE, IPsec overlays) into one logical SD-WAN interface (zone) that firewall policies and routes reference as a single egress.
- SD-WAN members are the underlying interfaces; performance SLAs actively probe each member's latency, jitter, and packet loss to measure link health in real time.
- SD-WAN rules (services) steer traffic by source, destination, application, or Internet Service onto the member that best meets the configured strategy.
- Load-balancing strategies include Source IP, Sessions (volume), Bandwidth (spillover), and Lowest Cost (best quality SLA); Best Quality picks the member with the best measured SLA.
- An SD-WAN member's gateway is reached through a static route, but inside the SD-WAN zone the SD-WAN rules and SLAs, not administrative distance, choose the member.
Why SD-WAN Is on the NSE 4 Exam
The FortiOS 7.6 Routing domain explicitly lists SD-WAN to load balance traffic between multiple WAN links, so it is no longer optional knowledge. Software-Defined WAN (SD-WAN) lets a single FortiGate use several internet or WAN connections at once — for example a fast broadband line, an MPLS circuit, and an LTE backup — and intelligently decide which link each application should use based on real-time link quality, not just a static default route.
Before SD-WAN, an administrator typically configured a primary default route and a floating static route for failover. That model only reacts to a link going fully down; it cannot react to a link that is up but degraded (high latency, jitter, or packet loss). SD-WAN replaces that brittle approach with continuous measurement and per-application steering.
SD-WAN Zone and Members
SD-WAN is built from two core objects:
- SD-WAN members (interfaces) — the underlying WAN connections: physical ports (
wan1,wan2), VLANs, or even IPsec tunnel interfaces used as overlays. Each member is the actual path traffic can take. - SD-WAN zone — a logical container that groups members. Firewall policies and routes reference the zone, not the individual physical links. This is the key abstraction: you write one policy to the SD-WAN zone, and SD-WAN decides which member carries each session.
A FortiGate can have multiple zones (for example an underlay zone of internet links and an overlay zone of IPsec tunnels), but every member belongs to exactly one zone.
The Two Building Blocks Table
| Object | What it represents | How it is used |
|---|---|---|
| Member | One WAN link (port, VLAN, or IPsec tunnel) | Carries actual traffic; measured by SLAs |
| Zone | Logical group of members | Referenced by firewall policies and routes as one egress |
| Performance SLA | Active health check on a member | Measures latency, jitter, packet loss |
| SD-WAN rule (service) | Traffic-steering rule | Maps matching traffic to a preferred member/strategy |
Exam tip: Firewall policies use the SD-WAN zone as the outgoing interface. You do not write a separate policy per WAN link — that is the whole point of the zone abstraction.
Performance SLAs (Health Checks)
A performance SLA (also called a health check) is the mechanism that makes SD-WAN intelligent. For each member, the FortiGate periodically sends a probe to a target server and measures three quality metrics:
- Latency — round-trip delay in milliseconds.
- Jitter — variation in latency between probes.
- Packet loss — percentage of probes that get no reply.
Probe protocols include Ping (ICMP), HTTP, DNS, TCP-echo, and TWAMP. You configure SLA thresholds (for example, latency under 150 ms, jitter under 30 ms, packet loss under 2%). If a member breaches its thresholds for the configured number of consecutive probes, SD-WAN marks that member out of SLA and stops steering SLA-sensitive traffic onto it — even though the link is still physically up.
This is the decisive advantage over a floating static route: SD-WAN reacts to a brownout (degraded but live link), not just a hard failure. A common exam scenario describes a VoIP link with rising jitter; the correct answer is that the performance SLA detects the breach and SD-WAN moves voice traffic to a healthier member.
Link Status vs SLA Status
| Condition | Floating static route reaction | SD-WAN reaction |
|---|---|---|
| Link physically down | Fails over to backup | Member removed; rules use another member |
| Link up but high latency/loss | No reaction — keeps using it | SLA breach -> traffic steered off the degraded member |
| Link recovers within SLA | Manual/route-distance dependent | Automatically eligible again |
The SLA target must be reachable through the member's own gateway, which is why each SD-WAN member still needs a static route to its gateway (often a 0.0.0.0/0 route per member). Inside the SD-WAN zone, though, the SD-WAN rules and SLAs choose the member, not administrative distance.
SD-WAN Rules and Load-Balancing Strategies
An SD-WAN rule (called an SD-WAN service in the CLI) steers traffic onto members. Each rule matches traffic by source, destination, Internet Service (ISDB), application, or protocol/port, then applies a strategy that picks the member. Rules are evaluated top-down, and the first matching rule wins; traffic that matches no rule falls back to the implicit SD-WAN rule, which load-balances across all members using the configured default strategy.
The member-selection strategies are the most-tested SD-WAN detail:
| Strategy | How it picks a member |
|---|---|
| Manual | Administrator lists members in strict priority order |
| Best Quality (Lowest Cost SLA) | Picks the member with the best measured SLA metric (e.g. lowest latency) |
| Lowest Cost (SLA) | Among members meeting the SLA, picks the one with the lowest assigned cost |
| Maximize Bandwidth (SLA) | Load-balances across all members that currently meet the SLA |
Load-balancing methods for the implicit rule and bandwidth strategies include Source IP (sessions from one source stay on one link — keeps sessions consistent), Sessions (balance by session count, optionally weighted), Bandwidth (spillover — fill one link to a threshold, then overflow), and Source-Destination IP.
A Worked Steering Example
Suppose wan1 is fast broadband and wan2 is MPLS. You want VoIP to always use the link with the best quality and bulk backup traffic to use the cheaper link:
- Rule 1 — match VoIP (by application/ISDB), strategy Best Quality measured on latency+jitter. SD-WAN puts voice on whichever member currently has the lowest latency, moving it if quality changes.
- Rule 2 — match the backup destination, strategy Manual preferring
wan2. Bulk traffic stays on MPLS. - Everything else falls to the implicit rule and load-balances by Source IP across both.
This per-application steering is exactly what the blueprint phrase load balance traffic between multiple WAN links refers to.
What is the main advantage of SD-WAN performance SLAs over a traditional floating static route for WAN failover?
In a FortiGate SD-WAN configuration, what does a firewall policy use as its outgoing interface?
An administrator must ensure VoIP traffic always uses the WAN member with the lowest measured latency and jitter, moving it automatically if quality changes. Which SD-WAN rule strategy fits best?
You've completed this section
Continue exploring other exams