Skip to main content
HS08
HS08
Visitor III
September 11, 2025
Question

SDWAN rule

  • September 11, 2025
  • 2 replies
  • 601 views

If i have 2 internet link how we can configure sdwan policy to fullfill my below requirement

- group 1 use link1 and will be switch to link2 if link1 have high latency or packet loss.

- group 2 use link2 and will be switch to link1 if link2 have high latency or packet loss.

 

in shortway i want to use best quality but also load balance. If we use only best quality for all users there will be bottleneck for one link and no traffic for another link.

2 replies

kaman
Staff
kaman
Staff
September 13, 2025

Hi HS08,

In this scenario, best practice is to use 'Best Quality". When using Best Quality mode, SD-WAN will choose the best link to forward traffic by comparing the link-cost-factor. A link-cost factor is a specific metric of participating link(s) (such as, latency, packet loss, and so on) evaluated against a target that you define (such as a health-check server).

Please refer to the document below for more information.


https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/22371/best-quality-strategy

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SD-WAN-Best-Quality-SLA-Customized-Profile/ta-p/220383

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SD-WAN-Best-Quality-Rules-link-cost-threshold/ta-p/193077


Regards,
Aman

HS08
HS08Author
Visitor III
September 13, 2025

But if we use best quality and two have good performance then only one link used for passing the traffic and other link only standby.

What i want is when both of link have good performance then we can use both link simulatneous with some prefered.

The prefered i mean is example for IT prefer using link1 and accounting use link2.

    Markus_M
    Staff & Editor
    Markus_M
    Staff & Editor
    September 13, 2025

    You need an identifying factor to tell FortiGate "this traffic is from group2".

    If the groups are in certain subnets, design your rules for these subnets.

    Otherwise, you may have to implement some sort of authentication and refer to users in the user group (also a possible source of a group).

    HS08
    HS08Author
    Visitor III
    September 13, 2025

    Of course i already make 2 group based on the department.

    If i have 3 sdwan rule below

     

    Rule-1

    set name "Internet1"

    set mode priority

     set dst "all"

     set src "IT Subnet"

     set health-check "microsoft"

    set priority-members 1

     

    Rule-2

    set name "Internet2"

    set mode priority

    set dst "all"

    set src "Accounting Subnet"

    set health-check "microsoft"

    set priority-members 2

     

    Rule-3

    set name "Internet-LB"

    set mode priority

    set dst "all"

    set src "All Subnet"

    set health-check "microsoft"

    set priority-members 1 2

     

    Will:

    IT goes to rule-3 if Internet1 have bad performance and user Internet2?

    Accounting goes to rule-3 if Internet2 have bad performance and user Internet1?

    IT always use Internet1 and Accounting always use Internet2 if both internet in good condition?

    Terms & ConditionsAccessibility statement