Technical Tip: How to add the interface in SD-WAN member without deleting references

• To deploy SD-WAN on the current running setup without having a large downtime window.
• Initially, if a migration needs to be done from non-SD-WAN to SD-WAN, then while adding the ISP links in SD-WAN, it was asked to delete all the references of the link(port) to add in the SD-WAN member.
• Due to the deletion of the reference, it required a large downtime window also along with additional configuration.
• From version 7.0.x, without deleting the reference, it is possible to add the interface to the SD-WAN existing zone or to create a new zone.

Prerequisite :

Enable the SD-WAN feature on the firewall before migrating to the default SD-WAN zone.

From CLI:

config system sdwan

    set status enable

end

Steps:

1. Go to Dashboard -> Network -> Interfaces.
2. Select the interface from the list that needs to be added to the SD-WAN member.
3. After selecting the interface, select the option Integrate Interface at the top, as shown in the picture below.

On FortiOS v7.6.x, 'right-click' on the interface and select Integrate Interface.

4. Selecting the Integrate Interface gives 3 options: select the last option to add in SD-WAN, select 'Next', and select the zone from the drop-down list.

    

   

    

   

    

5. Before selecting the zone, select Next, it will show all the references and ask to delete the reference or replace the same with a new instance.

    

   

    

6. Once the settings are applied, it will reflect in the SD-WAN, so it avoids any additional configuration in the policies.

    

It is possible to change the interface type and define VLAN IDs with the help of the Integrated Interface Option.

Note:

Once the changes are done, i.e., from the Physical interface to another, later on, this does not support turning an aggregate, software switch, redundant, zone, or SD-WAN zone interface back into a physical interface.

Before FortiOS versions 7.4.8, 7.6.3, 7.6.4, and 8.0.0, the Integrate Interface feature did not work when migrating an interface that has an IPsec tunnel bound to it.  

Interface migration wizard

Related documents:

Technical Tip: Moving an Interface that has existing references to SD-WAN zone using Integrate Interface feature 

Interface migration wizard