FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
sfernando
Staff
Staff
Article Id 390496
Description This article describes important factors to be considered when configuring the SD-WAN weight attribute for load balancing. 
Scope FortiGate SD-WAN
Solution
  1. When configuring weights on each member, the traffic will be sent out based on the distribution percentage of the weight.
  2. Weights can be used only with static routes, dynamic routing is not supported. Eg. When using ISPs' incoming BGP default routes, weights can not be applied to them, instead, it is required to use BGP attributes to route traffic based on different criteria for ISP links.

  

FGT# get router info routing-table all
Routing table for VRF=0
S* 0.0.0.0/0 [1/0] via 10.56.243.254, port1, [1/120] <----- Configured weights are propagated to routes.
[1/0] via 10.56.247.254, port2, [1/80]               <----- Configured weights are propagated to routes.

 

Below is a default route learnt from the ISP-advertised BGP route where weight information is not propagatedStatic routes will be preferred over dynamic routes due to the low AD value of Static routes.

FGT# get router info routing-table all

Routing table for VRF=0
B* 0.0.0.0/0 [20/0] via 2.5.1.4 (recursive is directly connected, Port1), 01w2d16h, [1/0]
[20/0] via 3.1.4.2 (recursive is directly connected, Port2), 01w2d16h, [1/0]

 

  1. Weights are applied only for implicit rule traffic on SD-WAN rules.

 

daddqded.jpg

 

By default, session is selected as the load balancing algorithm and can be changed as below:

 

Untisssssstled.jpg

 

  1. Traffic generated based on SD-WAN rules, apart from implicit rules, does not use a weight factor to send out traffic.
  2. The affected traffic of weight is only for outgoing traffic, not for incoming traffic.
  3. To have the effect of weight distribution on implicit traffic, it is required to set the static route using the SD-WAN zone as the interface, not individual members.

 

Untitlssadqed.jpg

Contributors