Results
These sections show the function of SD-WAN with respect to DSCP tagged traffic steering, and can help confirm that it is running as expected:
- Verifying the DSCP tagged traffic on FortiGate
- Verifying the service rules
- Verifying traffic steering on the SD-WAN rules
- Verifying that steered traffic is leaving from the expected interface
Verifying the DSCP tagged traffic on FortiGate
Packet sniffing is used to verify the incoming DSCP tagged traffic. See Using the FortiOS built-in packet sniffer for more information.
Wireshark is used to verify that VoIP traffic is tagged with the expected DSCP tag, 0x70 or 0x30.
VoIP traffic marked with DSCP tag 0x70:
# diagnose sniffer packet any '(ip and ip[1] & 0xfc == 0x70)' 6 0 l
Web traffic marked with DSCP tag 0x30:
# diagnose sniffer packet any '(ip and ip[1] & 0xfc == 0x30)' 6 0 l
Verifying the service rules
To check that the expected DSCP tags and corresponding interfaces are used by the SD-WAN rules to steer traffic:
# diagnose sys sdwan service4
Service(5): Address Mode(IPV4) flags=0x0
Gen(1), TOS(0x70/0xf0), Protocol(0: 1->65535), Mode(manual)
Members:
1: Seq_num(4 Branch-HQ-B), alive, selected
Dst address:
0.0.0.0-255.255.255.255
Service(3): Address Mode(IPV4) flags=0x0
Gen(1), TOS(0x30/0xf0), Protocol(0: 1->65535), Mode(manual)
Members:
1: Seq_num(2 port5), alive, selected
Dst address:
0.0.0.0-255.255.255.255
Service(2): Address Mode(IPV4) flags=0x0
Gen(1), TOS(0x0/0x0), Protocol(0: 1->65535), Mode(sla), sla-compare-order
Members:
1: Seq_num(1 port1), alive, sla(0x1), cfg_order(0), cost(0), selected
2: Seq_num(2 port5), alive, sla(0x1), cfg_order(1), cost(10), selected
Dst address:
0.0.0.0-255.255.255.255
Verifying traffic steering on the SD-WAN rules
Go to Network > SD-WAN and select the SD-WAN Rules tab to check the Hit Count on the SD-WAN interfaces.
Verifying that steered traffic is leaving from the expected interface
To confirm that web traffic (port 443) flows through the correct underlay interface members, and VoIP traffic flows through the correct overlay interface members, go to Dashboard > FortiView Policies and double click on the policy name.
Web traffic is expected to leave on Interface_A (port1) or Interface_B (port5):
VoIP traffic is expected to leave on the preferred VPN_B_Tunnel (Branch-HQ-B) interface:
