Skip to main content
kstotz
New Member
February 25, 2026
Question

Existing Fortigate dual wan setup, trying to introduce SDWAN

  • February 25, 2026
  • 3 replies
  • 332 views

We have an existing Fortigate 7.4.11 firewall configuration with 100+ firewall policies and 10 VPN, IPSec connections and 2 WAN connections. 

 

We are wanting to now configure SDWAN to handle the 2 WAN Connections. Has anyone retrospectively added SDWAN to your existing config? 

 

We are looking for options.

Current options seem like

1. configure SDWAN and remove all references to the WAN interfaces (ie assigning those references to some other interface), then building SDWAN and reassigning to the zones. 

 Pros: point and click

 Cons: take the network down for a bit while this configuration is being done and then troubleshoot issues

2. dump the config, and integrate the changes, then try to import that new config into the fortigate

 Pros: seems quick, little downtime

 cons: seems like it will fail. 

3. script the changes and dump those into the CLE

 Pros: seems quick, prone to errors

 cons: troubleshooting after it fails

4. Building another SDWAN zone with a 3rd wan connection

 Pros: move policies one at a time, test along the way

 cons: not sure Fortigate will allow this

 

Any recommendations?

 

Thanks

   

3 replies

AEK
SuperUser
SuperUser
February 25, 2026

The Interface Migration Wizard is the best solution.

https://docs.fortinet.com/document/fortigate/7.4.11/administration-guide/885870

Take a backup before the migration and do it during off hours.

AEK
kstotz
kstotzAuthor
New Member
February 25, 2026

I will look into that, thank you.

One of the challenges of SDWAN is that it wants to create that default static route and if one exists on the box, then sdwan won't enable. The migration tool seems to expect the sdwan to be enabled already which implies the sdwan has created the default static route already.  Our problem seems to be getting sdwan enabled with an existing default static route

 

kstotz
kstotzAuthor
New Member
February 25, 2026

What about creating the necessary default routes (1.x.x.x, 2.x.x.x, 3.x.x.x...254.x.x.x) point those to wan1 and then delete the static route and enable sdwan at that point?