Technical Tip: Functionality of 'set update-cascade-interface' under 'config healthcheck; in SD-WAN

[sagha]

Description
This article describes the functionality of 'set update-cascade-interface' when configured under 'config health-check' in SD-WAN.

Related documentation:
https://docs.fortinet.com/document/fortigate/6.2.1/cli-reference/93620/system-virtual-wan-link

Solution
As a first step, 'update-cascade-interface' cannot function independently and it works with fail-detect' that needs to configured under 'config system virtual-wan-link'.

# config system virtual-wan-link
    set status enable
    set fail-detect enable                     <-----
    set fail-alert-interfaces "internal3"      <-----
# config members
    edit 4
        set interface "wan2"
        set gateway 192.168.0.1
    next
    edit 1
        set interface "wan1"
        set gateway 192.168.0.1
    next
end

# config health-check
    edit "8.8.8.8"
        set server "8.8.8.8"
        set update-cascade-interface enable     <-----
        set members 4 1
    next
end
end

In the above example, when health check for wan1 and wan2 fails, i.e. if we cannot reach the configured “server” at 8.8.8.8, the internal3 interface would be disabled as defined in fail-alert interface. This is shown in the this output:

Testing and examples:

The status shows alive:

# diagnose sys virtual-wan-link health-check
Health Check(8.8.8.8):
Seq(4): state(alive), packet-loss(3.000%) latency(19.610), jitter(14.388) sla_map=0x0
Seq(1): state(alive), packet-loss(3.000%) latency(20.623), jitter(14.182) sla_map=0x0

Internal3 interfaces also shows as up:

# diagnose hardware deviceinfo nic internal3
========== Link Status ==========
Admin           :up
netdev status   :up
link_status     :Up

Health-check failure:

# diagnose sys virtual-wan-link health-check 8.8.8.8
Health Check(8.8.8.8):
Seq(4): state(dead), packet-loss(85.000%) sla_map=0x0
Seq(1): state(dead), packet-loss(73.000%) sla_map=0x0

Internal3 interfaces is taken down as well:

# diagnose hardware deviceinfo nic internal3
========== Link Status ==========
Admin           :down
netdev status   :N/A
link_status     :Down

Note.
Verification of this can also be done via GUI under Log & reports -> Events.