Fortinet black logo

Cookbook

Setting up the load balancing SD-WAN configuration

Copy Link
Copy Doc ID 4d801240-7ccc-11e9-81a4-00505692583a:285196
Download PDF

Setting up the load balancing SD-WAN configuration

The SD-WAN configuration sets up load balancing based on link quality. Link quality is determined by health checking; which measures jitter, packet loss, and latency on each link. FortiOS dynamically creates policy routes that send traffic over the link with the highest quality.

  1. Create an SD-WAN Interface (also called a virtual WAN link) and add the IPsec VPN tunnel interfaces to it. These members are also the BGP neighbors that are tied to specific interfaces.

    config system virtual-wan-link

    set status enable

    config members

    edit 1

    set interface "vpn_dc1-1"

    next

    edit 2

    set interface "vpn_dc1-2"

    next

    end

    end

  2. Create SD-WAN Health-Checks for each data center network. Set server to the IP address of a server on the data center network.

    config system virtual-wan-link

    config health-check

    edit "datacenter1-net"

    set server "10.200.1.1"

    set interval 1

    set failtime 1

    set recoverytime 3

    next

    edit "datacenter2-net"

    set server "10.200.2.1"

    set interval 1

    set failtime 1

    set recoverytime 3

    end

    end

  3. Add SD-WAN Service Rules to define the criteria for the policy routes. Criteria include:
    • Protocol
    • Destination Address
    • Source Address
    • Identity Based Group
    • Internet Service Definition
    • Source Port
    • Destination Port
    • Destination Tag

    config system virtual-wan-link

    config service

    edit 1

    set mode priority

    set dst-tag 10

    set health-check "datacenter1-net"

    set priority-members 1 2

    next

    edit 2

    set mode priority

    set dst-tag 10

    set health-check "datacenter2-net"

    set priority-members 1 2

    next

    end

    end

To dynamically determine the networks the policy routes point to, the routes learned from a BGP neighbor are matched against a route map and matching routes are tagged. The service rules determine the routes to use based on these tags.

Setting up the load balancing SD-WAN configuration

The SD-WAN configuration sets up load balancing based on link quality. Link quality is determined by health checking; which measures jitter, packet loss, and latency on each link. FortiOS dynamically creates policy routes that send traffic over the link with the highest quality.

  1. Create an SD-WAN Interface (also called a virtual WAN link) and add the IPsec VPN tunnel interfaces to it. These members are also the BGP neighbors that are tied to specific interfaces.

    config system virtual-wan-link

    set status enable

    config members

    edit 1

    set interface "vpn_dc1-1"

    next

    edit 2

    set interface "vpn_dc1-2"

    next

    end

    end

  2. Create SD-WAN Health-Checks for each data center network. Set server to the IP address of a server on the data center network.

    config system virtual-wan-link

    config health-check

    edit "datacenter1-net"

    set server "10.200.1.1"

    set interval 1

    set failtime 1

    set recoverytime 3

    next

    edit "datacenter2-net"

    set server "10.200.2.1"

    set interval 1

    set failtime 1

    set recoverytime 3

    end

    end

  3. Add SD-WAN Service Rules to define the criteria for the policy routes. Criteria include:
    • Protocol
    • Destination Address
    • Source Address
    • Identity Based Group
    • Internet Service Definition
    • Source Port
    • Destination Port
    • Destination Tag

    config system virtual-wan-link

    config service

    edit 1

    set mode priority

    set dst-tag 10

    set health-check "datacenter1-net"

    set priority-members 1 2

    next

    edit 2

    set mode priority

    set dst-tag 10

    set health-check "datacenter2-net"

    set priority-members 1 2

    next

    end

    end

To dynamically determine the networks the policy routes point to, the routes learned from a BGP neighbor are matched against a route map and matching routes are tagged. The service rules determine the routes to use based on these tags.