Love the product . Found a huge headache

Question

If you don't create your SDWAN interfaces upfront you have to un-associate the interfaces with every policy to do so. This is a major PITA and wasn't an problem on Sonicwall. Time to step up the FG game here and make a wizard or utility or amend the OS to allow this to happen. This is very frustrating. Does anyone have any clever ideas? I was going to download the config edit it and re-upload it. However that sounds like I might open a can of worms. I called support, no known work-arounds.

Dave_Hall · Accepted Answer

Any "free/unused" interface can be added to the the SD-WAN (virtual-wan-link) interface - It's mostly to act as a placeholder for revising the firewall policy section.

Any static route setting should still be retained after placing a WAN interface into the SD_WAN, though I would try some testing on your part.

Shame you are not on site, if all possible I would set up a backup connection to a free port on the fgt in the event that you do lose connection to it, at least someone on site could swap cables/ports. (Just make sure the authorized admin port settings are also set up on the backup wan interface. And perhaps you may want to test that connection first.)

Dave_Hall · Answer

Personally, in a quick pinch (though not advisable), I likely do the same if there is like a lot of firewall policies. Though I would add one of your WAN interfaces to the SD-WAN first then edit a copy of that config:

- In the firewall policy section, replace "<wan interface name>" with "virtual-wan-link".

- Then add the other (WAN) interface(s) to the config system virtual-wan-link section. - Save the revised config (new copy) and load that into the fgt. Use the CLI to check for any errors : diagnose debug config-error-log read

And example of the SD-WAN section may look like in the CLI:

config system virtual-wan-link set status enable set load-balance-mode measured-volume-based config members edit 1 set interface "wan1" set volume-ratio 60 next edit 2 set interface "wan2" set volume-ratio 40 next next end

And an example (edited) firewall policy:

config firewall policy edit 11 set name "Access-appoved-DNS" set srcintf "internal_net"

set dstintf "virtual-wan-link"

set srcaddr "All_Internal"

set dstaddr "approved-dns" set service "DNS" set action accept next end

Again, the above is not recommended nor advised.

kubimike wrote:
[...]I was going to download the config edit it and re-upload it. However that sounds like I might open a can of worms. I called support, no known work-arounds.

Sign up

Login with SSO

Login to the community

Login with SSO