Technical Tip: Adding an interface to an SD-WAN zone

Description

This article describes how to add an existing and used interface to an SD-WAN zone.

Scope

FortiGate, SD-WAN.

Solution

By default, adding an interface to an SD-WAN zone should only be a couple of clicks away. However, some wish to add an existing and used interface in a newly created (or possibly existing) SD-WAN zone.

Below is a demonstration of how to add a new interface to the zone.

Port4 is a new interface with no references:

Under Network -> SD-WAN, select Create New -> SD-WAN Member -> OK.

The interface is already added to the virtual-wan link zone. The example above uses DHCP, which is why the Gateway option is set to Dynamic.

If the IP mode is set to Manual or Static IP, select Specify under Gateway and manually enter the gateway IP address.

In this case, an admin wanted to add the existing WAN interface, which is port1. Note that this interface was already used as this was the only WAN that the admin initially had.

• Port1 does not show in the 'Interface' drop-down menu for an SD-WAN member:
  
  

This is because port1 has references which may include policy config, VPN config, VIP config and etc.

To resolve this, all references should be deleted or moved to a different interface until the number of references becomes 0, and the port can be added on the zone interface.

Deleted references:

A new SD-WAN member was created, and port1 is now visible on the drop-down list:

Note:

Do not add an SD-WAN member when its gateway is in the firewall's IP pool list, as this could cause issues when installinga  route to the Kernel and cause an outage. This SD-WAN configuration limitation will be added in the upcoming v8.0.