Skip to main content
Ashishdeep
Staff
Staff
June 25, 2025

Technical Tip: SD-WAN behavior when a secondary IP is configured over one of the SD-WAN members

  • June 25, 2025
  • 0 replies
  • 634 views
Description This article describes the behavior of SD-WAN when a secondary IP address is configured over one of the SD-WAN members, and the performance SLA/health check is down for that specific member.
Scope FortiGate.
Solution

Example: SDWAN has two-member Port 9 and Port 10.

 

Port 10 has a primary IP  x.x.x.x and a secondary IP y.y.y.y configured over it.

If SD-WAN sla on port 10 fails, then the SD-WAN will mark port 10 as inactive, but the routing table database will show route via y.y.y.y as active.

 

image (30).png

 

This is an expected behavior because the secondary IP address is tied to the interface, not to the SD-WAN status. When the SLA is down, the SD-WAN will try to prevent the route from getting installed in the routing table database, but it won't bring the 

interface down.

 

Note: The SD-WAN rule will not use port 10 to route the traffic.