Technical Tip: Configure SD-WAN local break-out (DIA) on 2 or more WAN links with overlapping address allocation

[JavierM_CL]

Description	This article describes how to deploy 2 or more WAN links in the scenario where the WAN subnets have the same gateway, given it is the same Service Provider (for example: Starlink with 2 antennas), or when 2 Service Providers assign the same WAN IP address (for example: FortiGate behind the same 192.168.1.0/24 on both WANs). This approach makes use of multiple VRFs, one for each WAN. In this example, it will be deployed 3 VRFs. Finally, implement SD-WAN using those available links.
Scope	Scenarios Covered:
Solution	Configure the desired amount of WAN VRF, each for one link plus one main vrf for LAN connectivity (vrf 0 can be used). On Network -> Interfaces: assign wan1 to vrf 1 and wan2 to vrf 2, leave lan interface with vrf 0. Create the 2 inter-vdom links. Follow the TT: Technical Tip: VRFs route leaking. In this example, use: VDOM-LINK1:  vdl-SP1-  Interface0: vdl-SP1-0                 Virtual Domain: root                 vrf: 1                 IP netmask: 10.10.10.1/30 Interface1: vdl-SP1-1                 Virtual Domain: root                 vrf: 0                 IP netmask: 10.10.10.2/30 VDOM-LINK2:  vdl-SP2-  Interface0: vdl-SP2-0                 Virtual Domain: root vrf: 2                 IP netmask: 10.10.10.5/30 Interface1: vdl-SP2-1                 Virtual Domain: root vrf: 0                 IP netmask: 10.10.10.6/30 Configure Static Routes between the VRFs. Go to Network -> Static Routes -> Create New: 2x Default routes each for vdl-SP1-1 vdl-SP2-1 interfaces. 2x routes for lan subnet, each for vdl-SP1-0 vdl-SP2-0 interfaces. Configure NAT Policies. Policy & Objects -> Firewall Policy -> Create New:  -policy: Name: lanVRF-outbound Incoming interface: lan,  Outgoing interface: vdl-SP1-1, vdl-SP2-1 Source, Destination: all Service: ALL NAT: disabled -policy: Name: lanVRF-inbound Incoming interface: vdl-SP1-1, vdl-SP2-1 Outgoing interface: lan Source, Destination: all Service: ALL NAT: disabled -policy: Name: NatInternet Incoming interface: vdl-SP1-0, vdl-SP2-0 Outgoing interface: wan1 Source, Destination: all Service: ALL NAT: enabled Configure SD-WAN to use both links with the desired SD-WAN strategy. Refer to: Technical Tip: Configuring SD-WAN. In this example, use vdl-SP1-1 and vdl-SP2-1 as virtual-wan-link members. Test. With a host connected to the internal network test connectivity to the Internet. Verify Policy counters. Verify SD-WAN health checks.