FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.


This article describes the ‘link-cost-threshold’ attribute available under the SD-WAN rules.


FortiGate SD-WAN offers four options for selecting outgoing interface(s):

- Manual (default).
- Best Quality.
- Lowest Cost (SLA).
- Maximize Bandwidth (SLA).

In the above picture, the ‘Best Quality’ strategy is used which is based on the performance of the link.
Both port1 and port2 are included in the interface preference. Port1 is used (because it is the first interface on the list) until the quality of the port1 link is 10%, or worse than the quality of the port2 link.
At that point, port2 takes over. By default, the quality threshold is 10%.
The threshold can be changed on the CLI using the set link-cost-threshold command.
Note that the ‘link-cost-threshold’ attribute is only available when the mode is set to either auto or priority.

set link-cost-threshold {integer} – Percentage threshold change of link cost values that will result in policy route regeneration (default = 10%).
Range: 0-10000000

In example 1, FortiGate will select port1 as the outgoing interface, because the difference in latency results is not 10%. In this case, FortiGate will consider interface preference to select an outgoing interface.

In example 2, port2 has better latency than port1, which exceeds the threshold of 10%. In this case, FortiGate will select port2 as the outgoing interface.

The output of ‘diagnose sys virtual-wan-link service’ OR ‘diagnose sys sdwan service’ shows the link-cost-threshold value.

FGT # diagnose sys sdwan service
Service(1): Address Mode(IPV4) flags=0x0
  TOS(0x0/0x0), Protocol(0: 1->65535), Mode(auto), link-cost-factor(latency), link-cost-threshold(10), health-check(ping)
    1: Seq_num(2), alive, latency: 0.011
    2: Seq_num(1), alive, latency: 0.018, selected
  Dst address:
If you set link-cost-threshold to 0, then FortiGate performs a strict metric comparison. That is, there is no advantage , and the preferred member  becomes the member with the best metric. In case two or more member have the same metric, FortiGate uses the member priority as a tiebreaker.