Technical Tip: SD-WAN zone in Local-in Policy

samandeep · ‎12-26-2024

Description

This article explains that the SD-WAN zone can be added to a local-in policy.

Scope

FortiGate v7.4.6 and above.

Solution

Starting from v7.4.6 and in v 7.6.x, SD-WAN zones can also be selected as an interface in the firewall local-in policy. In previous versions, only individual interfaces were available for selection.

For Example :

config firewall local-in-policy
edit 1
set intf "Underlay"

any Match any interface in the virtual domain.
virtual-wan-link sdwan
Underlay sdwan
ADVPN sdwan
Test for localin sdwan
fortilink interface
naf.root interface
port3 interface
port5 interface
port6 interface
port7 interface
port8 interface

set srcaddr "all"
set dstaddr "all"
set service "PING"
set schedule "always"
next
end

Config system sdwan

config members
edit 2
set interface "port2"
set zone "Underlay"
set gateway 10.9.15.254
set priority 5
next
edit 4
set interface "port4"
set zone "Underlay"
set gateway 10.10.10.5
set priority 5
next

end

In v7.6.x, the GUI allows the configuration of local-in policies. Although interfaces that are members of an SD-WAN zone are visible in the list, selecting them will prevent the policy from being saved and result in an error.

In contrast, when using the CLI, interfaces that are members of an SD-WAN zone will not be presented as available options.

As shown in the screenshot below, Internal2 is a member of an SD-WAN zone, and selecting this individual interface in the local-in policy generates an error.

For more information on local-in policies, refer to our documentation/resources:

Local-in policy | FortiGate / FortiOS 7.6.1 | Fortinet Document Library