Skip to main content
Jirka1
Jirka1
Explorer II
October 17, 2020
Question

Question about SD-WAN design

  • October 17, 2020
  • 1 reply
  • 3496 views

Hello, we are preparing a project to change 13 branches to SD-WAN architecture. The following scenario is planned:

- the HQ FortiGate will have one primary line (it is located in DC, so the backup is solved technologically) - each branch will have 2 independent lines with public IP (1x optics, 1x VDSL) - two IPsec tunnels will be built from the branch to the HQ and added to the SD-WAN

- the default route will be via SD-WAN (IPsec) to HQ - all other operations (NAT, UTM, etc.) will be performed in HQ

My questions:  Does it make sense to build an SD-WAN in HQ even if it has only one line? Most traffic and sessions will start at branches, ie. there it makes sense to me. But there are applications (surveillance systems, push antivirus updates, etc.) that start the connection towards HQ-> branch. How will it behave in this case? If I don't use SD-WAN in HQ do I have to have two routes to the LAN branch in HQ with a different priority + BH? How will I define which traffic should go on which line (from HQ to the branch)? Using policy routing? We normally use SD-WAN but in a configuration where HQ has two lines and branch has only one lines (and SD-WAN is also set here). Thanks for explaining. Jirka

    1 reply

    lobstercreed
    lobstercreed
    New Member
    October 18, 2020

    I hope there are other answers to this post, but in the mean time I'll say that I'm in a somewhat similar situation and planning to use SD-WAN only for the multiple VPN tunnels to my branches.  So yes?  I think it makes sense.  But I'm still building this and not fully to the point of testing it, so we'll see if I'm right I guess.

     

    In general from what I'm reading though, SD-WAN is kind of like zones.  Set it up now even if you don't see why because it's sooo much harder later.  It can always do "nothing" for you now.

    boneyard
    boneyard
    Valued Contributor
    October 20, 2020

    personally i have tried to the not use sd-wan on the central location. just let priority on the routes do there work.

     

    if you are planning to do sd-wan there remember you need quite some sd-wan rules and health monitoring per remote location. it is possible but is it worth all the effort for limited need.

    Terms & ConditionsAccessibility statement