FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
akileshc
Staff
Staff
Article Id 228952
Description This article describes how to change the SD-WAN Service rule order using CLI.
Scope FortiOS.
Solution

Dragging the policy to modify its order in the SD-WAN rule via GUI is achievable via CLI, as seen below.

 

Original SD-WAN service rule order:

 

# di firewall proute list
list route policy info(vf=root):

id=2130903042(0x7f030002) vwl_service=2(TEST2) vwl_mbr_seq=2 dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-65535 iif=0(any) dport=1-65535 path(1) oif=7(port5)
source(1): 0.0.0.0-255.255.255.255
destination(1): 0.0.0.0-255.255.255.255
hit_count=0 last_used=2022-11-03 11:47:22

 

id=2130903041(0x7f030001) vwl_service=1(TEST) vwl_mbr_seq=1 dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-65535 iif=0(any) dport=1-65535 path(1) oif=6(port4)
source(1): 0.0.0.0-255.255.255.255
destination(1): 0.0.0.0-255.255.255.255
hit_count=0 last_used=2022-11-03 11:46:56

 

Change the order of the SD-WAN service rule via CLI:

 

# config system sdwan

    # config service (SD-WAN)

        move 2 before 1 (service)

    end (service)

end (SD-WAN)

 

# move <id> <after/before> <id>

*id SD-WAN rule ID (1 - 4000).

after move after
before move before

 

After changing the SD-WAN service rule order:

 

# di firewall proute list
list route policy info(vf=root):

id=2130968578(0x7f040002) vwl_service=2(TEST2) vwl_mbr_seq=2 dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-65535 iif=0(any) dport=1-65535 path(1) oif=7(port5)
source(1): 0.0.0.0-255.255.255.255
destination(1): 0.0.0.0-255.255.255.255
hit_count=0 last_used=2022-11-03 11:47:22

 

id=2130968577(0x7f040001) vwl_service=1(TEST) vwl_mbr_seq=1 dscp_tag=0xfc 0xfc flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-65535 iif=0(any) dport=1-65535 path(1) oif=6(port4)
source(1): 0.0.0.0-255.255.255.255
destination(1): 0.0.0.0-255.255.255.255
hit_count=0 last_used=2022-11-03 11:46:56

 

This is analogous to dragging a policy into a new position in the SD-WAN rule/service table.