FCSS SD-WAN 7.4 Architect cheat sheet

FortiGate SD-WAN is configured under Network > SD-WAN: members are physical/logical interfaces (or IPsec overlays), each with a cost/priority used by the default selection algorithm.

Interface members require a gateway and a health-check reference; SLA targets are defined per performance SLA (latency, jitter, packet loss) and evaluated by the referenced health check.

Two deployment models: (1) single FortiGate per site with all WAN links local, (2) hub-and-spoke or full-mesh IPsec overlays built by ADVPN (IPsec + BGP) for dynamic shortcut tunnels.

ADVPN requires: IPsec phase1 with net-device disable, BGP with a route reflector or hub as next-hop-self, and 'set auto-discovery-sender/receiver' on hub/spokes respectively.

SD-WAN zones group multiple members so firewall policies and static routes reference one logical object; zone members must be interfaces, not zones.

In FortiOS 7.4 the SD-WAN wizard creates members, performance SLAs, SD-WAN rules, and the required static routes in one flow; verify the implicit SD-WAN zone membership afterwards.

Overlay design rule: underlay routes must not be redistributed into the overlay BGP without filtering, or WAN prefixes leak between spokes.

IPsec overlay MTU: set phase1 MTU to account for ESP overhead (typically 1400 or lower) to avoid fragmentation on DSL/LTE links.

SD-WAN rule matching order: rules are evaluated top-down; the first matching rule wins. Implicit rules (SD-WAN implicit, Implicit load-balancing, BGP, static route) sit below explicit rules.

SD-WAN rule strategies: manual (priority-ordered members), best-quality (lowest latency/jitter/loss per SLA), lowest-cost, maximize-bandwidth, and load-balance.

Performance SLA health checks can be ping, TCP echo, HTTP, or UDP echo; 'update-static-route' controls whether the SLA result withdraws the member's static route.

BGP over SD-WAN: use 'set sdwan-zone' in the BGP neighbor config so neighbors bind to the SD-WAN zone and follow member changes; ADVPN shortcut routes are installed via BGP.

SLA target thresholds are per performance SLA; a member failing all configured SLA targets is treated as out-of-SLA and excluded by best-quality rules.

WAN optimization features: forward error correction (FEC), per-packet load balancing, and TCP session offloading; FEC is configured in IPsec phase1 or under the SD-WAN member.

Route selection: SD-WAN does not replace the routing table; the SD-WAN rule selects the egress interface, then the route lookup on that member determines next-hop.

Session persistence: SD-WAN rules with 'load-balance' can break stateful sessions unless the member selection is sticky; use manual/best-quality for session-oriented traffic.

Firewall policy references the SD-WAN zone; the SD-WAN rule then decides which member carries the session. Policy order: security profiles apply after SD-WAN member selection.

Traffic steering: application control / internet service database (ISDB) objects can be used as SD-WAN rule match criteria to steer SaaS traffic to a specific member.

SD-WAN rules match on source/destination address, internet service, application, user/group, DSCP, and protocol; use ISDB for cloud apps rather than IP objects.

For a hub-and-spoke overlay, steer traffic into the overlay via an SD-WAN rule matching the overlay zone, then let BGP/ADVPN choose the shortcut path.

Security profiles on SD-WAN policies: apply IPS, antivirus, web filter, and SSL inspection to the internet-bound policy; overlay-to-overlay policies usually need less inspection.

Centralized security: FortiManager can push SD-WAN templates and policy packages; FortiAnalyzer collects logs for SD-WAN SLA and traffic analytics.

DSCP marking: SD-WAN rules can match DSCP to prioritize voice/video; ensure DSCP is preserved across IPsec (default copy) or explicitly set.

SD-WAN + ZTNA: for private application access, steer via SD-WAN to the ZTNA gateway; do not expose internal apps directly on WAN members.

FortiManager SD-WAN templates: system templates, SD-WAN templates, and IPsec/BGP templates; the SD-WAN template references interface members defined in the system template.

Troubleshooting commands: 'diagnose sys sdwan health-check', 'diagnose sys sdwan member', 'diagnose sys sdwan service', and 'diagnose sys sdwan route' show SLA, member, rule, and route state.

'diagnose sys sdwan service' lists each SD-WAN rule with matched member(s) and current SLA status; use it to confirm which rule a flow hit.

'get system sdwan' and 'show system sdwan' display the running SD-WAN config; 'diagnose netlink interface list' confirms member up/down and link state.

FortiAnalyzer SD-WAN dashboards use performance SLA logs; enable 'log' on the health check or use the SD-WAN monitor in FortiView to see per-member quality.

Common failure: performance SLA shows member down because the health-check server is unreachable from that member; verify source IP and route to the health-check target.

ADVPN shortcut troubleshooting: 'diagnose vpn ike gateway list', 'diagnose ipsec tunnel list', and BGP 'get router info bgp summary' confirm spoke-to-spoke shortcut establishment.

FortiManager install preview shows config diffs per device; use 'Reinstall Policy' and check task monitor for failed SD-WAN template installs.