Manual SDWAN rule with two wan interfaces

[mateusguilherme]

hi

Let's say I have an SD-WAN rule based on the MANUAL strategy. This SD-WAN rule has two interfaces (WAN1 and WAN2), with WAN1 being the interface that was added first and therefore becomes the preferred interface for internet communication. If the WAN1 interface loses internet communication, will WAN2 be used?

If so, how does Fortigate determine that WAN1 has lost internet communication and should use WAN2? Since with the Manual strategy it is not possible to select a Performance SLA.

The final goal is to make all connections to a given destination IP on the Internet always go out through the WAN1 interface unless the WAN1 interface has lost communication with the Internet, in which case WAN2 can be used.

[Yurisk]

Hi

Performance SLA are for, well .. performance measuring monitoring - Latency/Packet loss/etc. REachability monitoring is still applicable to the interfaces in the SD-WAN rule. The ones that goes at the bottom of the page. 

For your use case, the usual set up is to have 1 SD-WAN rule (Manual) using just WAN1 interface with according rules. Once WAN1 fails, FGT will automatically use Implicit rule at the very bottom that includes both interfaces - WAN1 and WAN2. 

[hpenmetsa · Accepted solution]

Hi

1. Let's say I have an SD-WAN rule based on the MANUAL strategy. This SD-WAN rule has two interfaces (WAN1 and WAN2), with WAN1 being the interface that was added first and therefore becomes the preferred interface for internet communication. If the WAN1 interface loses internet communication, will WAN2 be used?

A. As long as the WAN1 interface status is UP, it will continue to route the traffic. WAN2 will only become active if the WAN1 status goes DOWN.

2. If so, how does Fortigate determine that WAN1 has lost internet communication and should use WAN2? Since with the Manual strategy it is not possible to select a Performance SLA.

A. While it's not possible to assign a Performance SLA directly to a Manual strategy SDWAN rule, but can add the SDWAN members to the performance SLA. Adding the SDWAN members in the performance SLA improves the detection of whether a member is alive or dead, because a member is considered alive only if the health-check can reach at least one configured server. Without a health-check, members are considered alive or dead according to the interface status (up or down).

Please check the below document for SD-WAN Rule Manual Interface Selection Strategy Behavior
https://community.fortinet.com/t5/FortiGate/Technical-Tip-SD-WAN-Rule-Manual-Interface-Selection-Str...

Thanks,
Hari