FCSS SD-WAN 7.4 Architect key terms

A logical tunnel network built over one or more underlay transports (MPLS, internet, LTE), carrying encrypted IPsec traffic between FortiGate edges. It decouples policy from physical links and lets the hub-and-spoke or full-mesh topology be defined in software.

The physical or provider transport (MPLS circuit, broadband, 5G/LTE modem, dedicated internet) that actually carries packets. SD-WAN performance monitoring and SLA selection operate on the underlay interfaces that members inherit.

A logical grouping of interfaces and IPsec tunnels that share a role in SD-WAN rules. Zones can be virtual-wan-link, or custom zones used to bundle members by provider, region, or cost so rules reference the zone rather than individual links.

A single participating interface or tunnel inside an SD-WAN zone, identified by sequence number. Members carry cost, priority, and health-check association, and FortiOS ranks them per rule when choosing a path.

A policy entry that matches traffic by source, destination, application, or internet service and then applies a strategy (manual, best quality, lowest cost, maximize bandwidth) across zone members. Rules also define SLA targets and optional priority ordering.

The selection method inside an SD-WAN rule. Manual uses member order, best quality picks the member with the best measured SLA compliance, lowest cost prefers cheaper links, and maximize bandwidth load-balances sessions across members that meet the SLA.

A probe (ICMP, UDP echo, or HTTP) sent at a configured interval to one or more servers, measuring latency, jitter, and packet loss for a member. Results feed SLA decisions and can trigger link removal from a rule.

Thresholds for latency, jitter, and packet loss that a member must satisfy to be considered usable by a rule. Members violating targets are deprioritized or excluded until the probe results recover.

The FortiOS object that binds health-check probes to SLA thresholds and a status-change behavior. It is referenced by SD-WAN rules and by SD-WAN monitor views to decide in-SLA versus out-of-SLA state per member.

Auto-Discovery VPN: spokes register with a hub over IPsec, and the hub brokers direct shortcut tunnels between spokes on demand. This avoids backhauling spoke-to-spoke traffic through the hub while keeping a simple hub-and-spoke configuration.

An encrypted point-to-point association between FortiGates defined by phase 1 (IKE) and phase 2 (IPsec SA) settings. In SD-WAN it is added as a zone member so overlay paths can be steered and monitored like physical links.

Internet Key Exchange, the protocol that authenticates peers and negotiates IPsec security associations. Version, pre-shared key or certificate, and mode (main or aggressive) must match on both ends for tunnels to establish.

Border Gateway Protocol, used in SD-WAN designs to advertise overlay and underlay prefixes between hubs and spokes. Common patterns include eBGP over ADVPN shortcuts and route reflectors at the hub to scale peer counts.

A link-state interior gateway protocol often run over SD-WAN tunnels for dynamic routing between sites. Cost and area design affect which overlay path is preferred, and it can be combined with BGP at redistribution points.

Importing routes learned by one routing protocol or source (connected, static, BGP, OSPF) into another. In SD-WAN it stitches overlay routing to LAN routing and is constrained by route maps and prefix lists.

A route that forwards traffic based on criteria beyond destination, such as source, protocol, or incoming interface. SD-WAN rules are implemented through policy routes, so ordering and gateway references matter for correct steering.

A WAN optimization feature that sends redundant parity packets so the receiver can reconstruct lost packets without retransmission. It improves quality on lossy links such as internet or LTE at the cost of extra bandwidth.

A set of FortiGate features including protocol optimization, byte caching, and web caching that reduce bandwidth and improve throughput across slow or high-latency tunnels. It requires a tunnel and matching settings on both peers.

The percentage of probe or data packets that never arrive at the destination, one of the three SLA metrics. It drives SD-WAN member selection and is often the first metric to degrade on congested or wireless links.

Fortinet's integrated architecture linking FortiGate, FortiManager, FortiAnalyzer, FortiSwitch, and other products for shared telemetry and policy. In SD-WAN it enables centralized management, logging, and coordinated enforcement across sites.

Directing traffic to a specific egress path or inspection point based on application, user, source, or destination. SD-WAN rules, policy routes, and security profiles together determine where traffic leaves and whether it is inspected.

A FortiGuard-maintained catalog of IP addresses and ports for thousands of internet services. SD-WAN rules and firewall policies can match services by name, enabling steering of SaaS and cloud traffic without manual address objects.

Sending internet-bound traffic directly from a branch to the internet instead of backhauling it to a central hub. It reduces latency and hub load but requires branch security inspection and consistent policy enforcement.

A security profile that identifies applications by signature regardless of port and can allow, block, or shape them. In SD-WAN it often supplies the application match used by rules to steer business-critical traffic.

The centralized management platform for FortiGate configuration, policy packages, and provisioning. It pushes SD-WAN templates and zones to many devices and provides revision control and install previews.

The centralized logging and analytics appliance that stores FortiGate logs, including SD-WAN health-check and traffic logs. It provides reports and event correlation used for troubleshooting and compliance.

A FortiManager object that defines reusable configuration (system settings, interfaces, SD-WAN zones) applied to many managed devices. Metadata variables let one template adapt to per-device values such as IP addresses.

A FortiManager container holding firewall policies, objects, and SD-WAN rules that is installed to one or more managed FortiGates. Shared packages keep common policy consistent while per-device packages handle site specifics.

A FortiOS CLI command family used for live troubleshooting, such as checking SD-WAN health status, routing tables, and IPsec SAs. Examples include diagnose sys sdwan health-check and diagnose netlink interface list.

The GUI view showing per-member latency, jitter, packet loss, and SLA state for each performance SLA. It is the first place to check when traffic fails over unexpectedly or a rule selects an unexpected member.

FortiOS and FortiAnalyzer functions that record traffic, event, and SD-WAN logs for review. Filtering logs by policy ID or health-check event helps confirm whether steering and failover behaved as designed.

Capturing live packets on an interface or tunnel using the FortiOS sniffer or diagnose sniffer packet command. It verifies whether traffic actually traverses the expected member and whether IPsec encapsulation is present.

A topology where branch sites connect to one or more central hubs, which relay inter-branch traffic. It simplifies policy and routing but can add latency, which ADVPN shortcuts are used to avoid.

A topology where every site has a direct tunnel to every other site. It minimizes latency for any-to-any traffic but increases tunnel count and configuration complexity, often managed with ADVPN or dynamic routing.

Deploying two hubs for redundancy so spokes maintain overlay connectivity if one hub fails. Spokes typically build tunnels to both hubs, and routing or SD-WAN rules prefer the primary while keeping the secondary ready.

Using SD-WAN rules and internet service matching to send traffic for named cloud applications over the best available path, often direct internet rather than backhaul. It improves user experience while security profiles still inspect the flow.