Technical Tip: SD-WAN usage-based (spillover) load-balance method’s interface selection behavior while member priorities are used

[fortiraj_FTNT]

Description	This article describes the SD-WAN usage-based (spillover) load-balance method’s interface selection behavior while member priorities are used.
Scope	FortiGate.
Solution	As per the spillover load balancing algorithm, the highest priority member is used until bandwidth exceeds ingress and egress thresholds. Additional traffic is then sent through the next SD-WAN member. The priority is often managed by manually configuring a priority value in the SD-WAN member configuration. config system sdwan     config members         edit 1             set interface "tunnel-A"             set zone "VPN"             set spillover-threshold 90000             set ingress-spillover-threshold 90000             set priority 10         next         edit 3             set interface "tunnel-B"             set zone "VPN"             set priority 20         next Note: For the above configuration, member interface commands, i.e., 'set spillover-threshold' and 'set ingress-spillover-threshold', will be only available if load-balance-mode is set to 'usage-based' under SD-WAN.  SD-WAN will not consider member priorities when dynamic routing (BGP) is in use. For the following routing entry pushed by BGP, interface tunnel-B is considered despite the priority set on the SD-WAN member interfaces (where tunnel-A is prioritized). FortiOS routes the traffic to 10.1.0.0/20 via tunnel-B (which is listed above tunnel-A in the route table), and it will never spill over. Routing information: * i10.1.0.0/20      172.16.23.2              0    100      0        0 65002 65001 65000 ? <1/-> *>i                 172.16.22.1            192    100      0        0 65000 ? <1/1> *>i                 172.16.24.1            192    100      0        0 65000 ? <1/2> Routing entry for 10.1.0.0/20   * 172.16.22.1 (recursive via tunnel-B tunnel 1.1.1.1)   * 172.16.24.1 (recursive via tunnel-A  tunnel 2.2.2.2) Further information on why BGP selects tunnel-B over tunnel-A can be seen in Technical Tip: Usage of BGP multipath and description of the BGP NLRI table. SD-WAN implicit rule with spillover as a load-balance method works only with static routes. Configure a static route to override BGP routes. When a static route is configured, a priority value assigned to each SD-WAN member will be considered. config router static     edit 0         set dst 10.1.0.0 255.255.240.0         set distance 1         set sdwan-zone "VPN"     next end Note: This is not a separate priority that can be configured specifically for the Spillover load-balancing algorithm. It is the same as the SD-WAN member priority; changing it here will also change the member priority in the SD-WAN zone configuration. If any non-zero spillover threshold values are configured, traffic is routed through the SD-WAN interface member with the lowest priority; else, keep the priority the same and use interface order for preference. Related article: Technical Tip: How to bond 2 ISP with SD-WAN and load balance traffic with Spillover algorithm under...