SD WAN Rule routing aspect issue

I thiink in this case sdwan is the wrong way. If you put all VPNs into one SDWAN Zone and add a rule and a SLA then sdwan would select a member accoarding to your load balancing settings and sla once the rule is matched.

At least if I understand your setup correctly. 

You said star topology so you have spokes that all connect to the same hub correct?

at the hub you could create a zone containing all the tunnels and then use that as interface in policies and routes. But you would still have to create routes for each spoke subnet.

Hi @sw2090 ,

Thank you for your response,

Yes, Star topology means all Spokes are connected to the Hub. 

i need juste to confirm , if this is the correct design and implemntation : 

We have 1 Hub, and lot of spokes. we have use FortiManeger to manage this implementation. we created a Star community, create one SD WAN zone called HubToSpoke-SDW, and he contain all tunnel created from VPN Manager ( with Random ID _X) , after we created a STATIC route X.X.X.X/8 to spokes and HubToSpokes-SDW as destination & policies to permit traffic ( Inside to HubToSpokes-SDW), and a lot of SDWAN Rule & SLA to route traffic to the specific spoke.

It is the correct design/configuration, or i need mandatory to configure a dynamic routing protocol ? 

In my opinion sdwan is not the correct choice for this. sdwan is cool when you have redundancy and want to do like ha on tunnels. 

So if you have e.g. two S2S to the same site you could create an sdwan zone on both sides and set static routing to that zone and then have sdwan handle the rest accoarding to your rules. That means sdwan will have to chose a member of the sdwan zone accoarding to your rules and SLAs.

But here you don't have redundancy. You appear to have various sites that have an S2S IPSec to the same hub. This is imho not intended for sdwan. This is intended for a interface zone so you can use the zone for routes and policies.

Thank you @sw2090  for your response, 

I forgot to mention that each spoke is connected with 3 different links, so 3 tunnels for each spoke.

so i need to make 1 SD WAN zone, and which will contain all spokes tunnels , and 1 summurized static route ( X.X.XX/8 to branche ) . its correcte this configuration ?

you can use an sdwan zone on your spoke and one for each spoke on the hub to handle redundancy. But I don't think you can use one for all.

caveat: in this case you cannot use Interface zones on the hub hence you cannot put a zone into a zone...