Technical Tip: Best practice when implementing SD-WAN over heterogeneous links

[fwilliams]

Description	This article briefly highlights the best ways to implement SD-WAN in an environment where MPLS, VPN and internet links (mixed) co-exist and all of them require SD-WAN.
Scope	FortiGate v6.4.x and above.
Solution	It has been found in many reported cases that customers sometimes implement SDWAN over a mixture of links (MPLS, IPsec VPN tunnel, and Internet), but do not adequately segment them from one another. The best thing to do in an environment with a mixture of links is to ensure the following: Static default routing is properly configured: Do not configure a single static default route through the SDWAN interface; instead, configure the static default route through individual zones or interfaces. In a situation where there is no internet breakout at the other side of the VPN tunnel, it is NOT necessary to configure a default route 0.0.0.0/0 over the VPN SD-WAN zone. The configuration below, for example, will direct the default route to all SD-WAN member interfaces (Internet, MPLS, or VPN). This should be avoided in an environment with heterogeneous links. Instead, point the default route to individual interfaces that have internet access. The fact that the SD-WAN zone was not referenced in the static route does not mean SD-WAN will not work perfectly. There are more advantages to individual interfaces (as 2 links of capacity 256 Mbps and 1 Gbps will not be ECMP by default, as they would have been if an SD-WAN zone were used in the static routing). The following should also be avoided: Note: Point the default route to only zone(s) with internet access. The SD-WAN zones are segmented: Do not add two unrelated or heterogeneous interfaces into the same zone. For example, allocating 'Internet' and “MPLS” links into the same zone is not following best practice (for example, a zone named 'WAN' should not house both Internet and MPLS links just because both are WAN links/interfaces). This is not common, but is sometimes seen. Do NOT use an 'all' source to an 'all' destination in any of the SD-WAN rules: Make sure the only SD-WAN rule with 'all' to 'all' in the deployment is the implicit SD-WAN rule. Fortinet’s R&D team has warned that such a configuration could result in unexpected behavior, such as FortiGate will not follow the correct routing based on the routing-table since traffic that did not have an SD-WAN rule will hit this rule.