Skip to main content
sean3
sean3
Explorer II
February 24, 2025
Solved

how the sd-wan SLA probing traffic is steered

  • February 24, 2025
  • 3 replies
  • 1134 views

greetings guys,


I am trying to understand how the sd-wan performance SLA probing traffic (for example, Ping/ICMP) is steered.

I have configured the SD-WAN performance SLA, two member interfaces are selected in the SLA, let's say, port1 (MPLS in the picture) and port2 (OL_INET in the picture). the SLA is using Ping as the probing protocol probing the detect server 10.74.x.x.

Screenshot 2025-02-24 170319.png

port 1 is an MPLS underlay interface, port 2 is an overlay based on Internet IPsec tunnel.

 

If I use the CLI in fortigate, I do see the probing traffic (ICMP echo/request) is flowing through the member interface added in the SLA.

 

diag sniffer packet OL_INET 'dst host 10.74.x.x' 4 0 a
interfaces=[OL_INET]
filters=[dst host 10.74.x.x]
2025-02-24 06:43:45.156019 OL_INET -- 10.250.a.b -> 10.74.x.x: icmp: echo request

 

diag sniffer packet OL_INET 'src host 10.74.x.x' 4 0 a
interfaces=[OL_INET]
filters=[src host 10.74.x.x]
2025-02-24 08:01:03.828714 OL_INET -- 10.74.x.x -> 10.250.a.b: icmp: echo reply

 

the 10.250.a.b in the traffic log is the IP address assigned to OL_INET, the ipsec tunnel address.

 

but the probing traffic is not showing up in the fortiAnalyzer traffic log. So, I lost the visibility to the probing traffic, like, which rule they are following? are they following the SD-WAN rule as they are local-out traffic? or are they following the traditional route in routing-table?

 

thanks for any advice.

Best answer by kxu_FTNT

The probing traffic likely follows SD-WAN rules as a part of local-out traffic, adhering to the configured performance SLAs, which critically determine their routing. Because this traffic is categorized as local-out, it might not appear in FortiAnalyzer logs by default. To enhance visibility, ensure your logging configuration includes settings for local-out traffic or use CLI diagnostics for real-time monitoring.

3 replies

Anthony_E
Staff
Anthony_E
Staff
February 27, 2025

Hello Sean,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
Anthony_E
Staff
Anthony_E
Staff
March 3, 2025

Hello,

 

We are still looking for someone to help you.

We will come back to you ASAP.


Thanks,

Best Regards
    kxu_FTNT
    Staff
    kxu_FTNTAnswer
    Staff
    March 3, 2025

    The probing traffic likely follows SD-WAN rules as a part of local-out traffic, adhering to the configured performance SLAs, which critically determine their routing. Because this traffic is categorized as local-out, it might not appear in FortiAnalyzer logs by default. To enhance visibility, ensure your logging configuration includes settings for local-out traffic or use CLI diagnostics for real-time monitoring.

      Terms & ConditionsAccessibility statement
      Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
      Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.