Technical Tip: SD-WAN steering traffic based on TOS value with same source and destination

Traffic can be steered using SD-WAN rules based on TOS/DSCP value is supported and possible. For example:

config system sdwan

    config service
        edit 1
            set name "inbound-tos48-traffic"
            set tos 0x48
            set tos-mask 0xfc
            set dst "all"
            set src "all"
            set priority-members 2 1
        next

        edit 2
            set name "inbound-tosb8-traffic"
            set tos 0xb8
            set tos-mask 0xfc
            set dst "all"
            set src "all"
            set priority-members 3 1
        next

    end   

However, in the event of certain traffic types such as GPRS tunnel traffic, all UDP traffic will have the same source, destination, and ports. Due to this, the FortiGate will match the SD-WAN rule based on the TOS value inside the initial packets and create a session entry. If packets with a different TOS value arrive matching the existing connection, they will not be rematched and traffic will continue flowing through the existing connection entry and rule criteria.

Currently, FortiGate does not support the dynamic re-steering of an active session based on a change in the TOS value. Once a session is established, traffic continues to flow according to the initial SD-WAN rule match, regardless of subsequent modifications to the packet's TOS field.