need network advice

hi,

local-out traffic, generated by the fortigate towads different services can be done with Local Out Routing and/or via CLI with set source-interface for other settings.

sd-wan or ecmp i think should be present/configured so the other path can be used.

You do it with local-out routing.

And if you already have sd-wan you can set local out routing select method to sd-wan and you configure sd-wan policy for that (better avoid PBR).

Edit: You may also try leave it to auto and just create a sd-wan policy to route the Fortinet ISDB through the desired WAN interface. I think this will also work.

First the “Local Out Routing” in GUI is just a collection of each service’s, such as DNS, FortiGuard, Log, Remote Auth methods, etc., settings for source IP and interface selection under each service’s configuration in CLI, like “config system DNS”, “config system fortiguard”, and so on.
So there is no additional/new “routing” table exist for local out traffic. Routing for local out is based on the regular routing-table. Therefore, if you want to specify the outgoing interface different from the regular traffic’s outgoing interface, you have to have a proper route toward the specific interface, which is generally a default route unless you can list the destination IPs and set up all with specific static routes.

SD-WAN generally have a default route to all member interfaces (if you use SD-WAN for internet), so the routing is covered by default. But if you don’t use SD-WAN or don’t include the local-out interface as a member, you need to set a static default route in addition to the main interface default route. You might want to use “priority” for the other traffic not to use the new default route.

Policy Based Routing still require the default route toward the local-out interface to be able to steer the local out traffic toward it. PBR is more static&sticky, compared to SD-WAN, which is a kind of PBR but can change based on rules&SLAs.

So, take care of the routing (default-route) first, then you can chose either method to specify the outgoing interface. I would just set source interface of each service to avoid any complication and confusion in the future. But it’s your choice.

Toshi

In addition to all the said above, consider creating VDOMs - root VDOM becomes management VDOM automatically, and all FortiGuard/etc services will be sourced from this VDOM and its own WAN interface, while user’s traffic exits to the Internet from its own VDOM and its own WAN interface. Clear separation and no head ache with PBR/SD-WAN.