Explorer

Question

SDWAN with one Internet line and one MPLS line

Forum|Forum|4 months ago
May 5, 2026
15 replies
156 views

Hi,

I would like to ask if we can deploy SDWAN with one Internet line and MPLS?

My topology:

HUB and Spokes have one internet line and one MPLS. The MPLS connect directly between Hub and Spokes. The internet using for VPN between them.

I dont want to config VPN via MPLS.

Is it possible to deploy sdwan for both VPN and MPLS for steering or control traffic to Dc behind the HUB via both MPLS and VPN?

Thank you

sjoshi

Staff

Hi @Dnk1 ,

Yes you can setup VPN(Bounded through internet line) and the MPLS on the SDWAN and keep it on same sdwan zone.

you can use sdwan rule and setup traffic flow based on the sdwan rule

https://docs.fortinet.com/document/fortigate/7.0.0/sd-wan-sd-branch-deployment-guide/727336/creating-sd-wan-rules

You can either load balance DC traffic to both VPN and MPLS link or can also create rule to sent certain destination from VPN and certain from MPLS

Thanks, Salon

msanjaypadma

Staff

Hi @Dnk1 ,

Additionally, ensure that at least one route is available to either the SD-WAN zone or individual SD-WAN members, allowing for the selection of the respective SD-WAN entity.

Thanks,
Mayur Padma

Thanks, Mayur Padma

Toshi_Esumi

SuperUser

VPN (assuming an IPsec) is just an interface like MPLS interface. You can put those two in one zone then set rules to control traffic.

D

Dnk1Author

Explorer

Hi All,

I reconfigured same configuration on another HUB and it worked as expected now.

I have another question that need the advice:

I have backup HUB in server zone of DC, spokes will dial another VPN tunnel to this HUB. The purpose is provide the backup link to server zone in DC if primary HUb down or both MPLS and primary VPN down.
The server zone has subnet 10.10.128.0/25.

In the routing table of spokes:

10.10.0.0/24 → MPLS

10.10.0.0/24 → VPN

10.10.128.0/25 → Bk_VPN

SDWAN rule:

Dest: 10.10.0.0/24

Strategy: Manual

Member: Mpls (1), VPN (2), BK_VPN (3)

Tiea-break: cfg-order

If I access to subnet 10.10.128.0/25, does it match the rule then traffic will priority to forward to MPLS interface? Then VPN if MPLS inactive?

Or traffic will go directly to BK_VPN because it have longer prefix of route in routing table?

These interface are member of separate sdwan zone

sjoshi

Staff

Hi @Dnk1

traffic will not match the rule defined as the destination is 10.10.0.0/24 subnet and does not cover 10.10.128.0/25 subnet.

You need below rule to make it work

Rule1

Dest: 10.10.0.0/24

Strategy: Manual

Member: Mpls (1), VPN (2)

Tiea-break: cfg-order

Rule2

Dest: 10.10.128.0/25

Strategy: Manual

Member: BK_VPN (1)

Tiea-break: cfg-order

Incase if the sdwan rule is not being hit, take the debug flow updated above to understand how it is picking the route

Thanks, Salon

D

Dnk1Author

Explorer

Hi @sjoshi

Thanks for your reply.

So with your suggested configuration, traffic for destination to 10.10.128.0/25 will always hit the rule2? If that it is not my expected. The BK_VPN only being used if both MPLS and VPN are deactived. If both still alive, traffic to 10.10.128.0/25 should be forwarded to Rule1.

Sign up

Login with SSO

Login to the community

Login with SSO