FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
nageentaj
Staff
Staff
Article Id 210812
Description This article describes how to do ECMP load balancing with SD-WAN configuration.
Scope FortiGate.
Solution

Using SD-WAN load balance of traffic can be done by navigating to SD-WAN -> SD-WAN Rules ->Implicit Rule. There are 5 ways to load balance the traffic as shown below.

 

nageentaj_0-1651155394260.png

 

The traffic will hit the implicit rule only when traffic does not match any of the rules in the SD-WAN rules or if no rules are configured as shown below.

 

nageentaj_1-1651155394264.png


In a scenario where there are SD-WAN rules that are configured based on certain strategies example Manual, Best quality, Lowest cost (SLA), and Maximum Bandwidth (SLA): these strategies help in selecting how the traffic will choose the outgoing interface, but it cannot do load balancing as it does not match the implicit rule.

 

In this case, create a static route for the same destination with the same administrative distance and priority as shown below, the traffic will match the longest prefix even though there is an SD-WAN interface, and load balancing will happen between the two interfaces PORT1 and PORT2.

 

nageentaj_2-1651155394269.png

 

The routing table will look as shown below. Here, the '8.8.8.8' prefix length is 32 and the one with the default route is '0', so the table will consider one with a 32 prefix length by default.

 

Find the active routes for the specific destination.

 

nageentaj_3-1651155394274.png

nageentaj_3-1651155394274.png

Note: 

 

config system sdwan

    set load-balance-mode measured-volume-based

end

 

The measured-volume-based and SD-WAN load-balancing mode settings found under the system sub-menu are solely applicable to the implicit rule. Volume-based load balance is not available in the custom SD-WAN rules

 

To set a load balance strategy in the custom rules use the following commands:

 

config system sdwan  

    config service

       edit <id>

           set load-balance enable 

           set hash-mode round-robin/source-ip-based/source-dest-ip-                 

           based/inbandwidth/outbandwidth/bibandwidth

      end

    end

end

 

If the SD-WAN rules are required to be configured the load balance option can be found for the 'Manual' and 'Lowest Cost(SLA)' interface selection strategy with all the hash modes mentioned above.

lb-sdwan.jpg

 

Related articles:

Implicit rules - FortiGate administration guide

Configuring SD-WAN load balancing - FortiGate handbook

Technical Tip: ECMP Load balancing algorithms for IPv4 and IPv6