SD WAN Problem with 4 Interfaces - Whats the best solution?

[RolandBaumgaertner72]

hello,

I am taking over the management of a FG101F Cluster with 7.2.10 and 4 Interfaces WANs.

Tha actual situation of the SD WAN is kind of messy:

> Virtual WAN Link with 2 x 1GB Internet Access lines

> UPG Zone Port 4 with 1 x 1GB Internet Access

> UPG Zone Port WAN with 1 GB Internet Access

I would like to use 2 x Internet Access volume based Load Balancing and the other 2 lines exclusively for the VPN connections and SSL VPN / IPSec.

So I would change all Policy with the WAN Interfaces with Port X to get them out of the actual situation and than start over with Virtual LAN and under that my SASE with Internet A and internet B leaving Internet C and D out of the load balancing.

What are you suggestions, what woluld be the best configuration and whats the best way to do so.

Thanks!

[fiesta]

Hi,

Probably make SDWAN Rules only to A and B enable load balance use maximize bandwidth don't use any helathcheck, remove C and D from any SDWAN Rules so internet will always using A and B.

Or if you able to reconfigure and redesign, use other VDOM instead for VPN using C and D.

Best regards.

FWD~

[AdaCasper]

You're stepping into a complex SD-WAN setup on a FortiGate 101F cluster running 7.2.10, and your plan to restructure the WAN usage makes sense given the current messy state. If your goal is to implement volume-based load balancing across two internet links and dedicate the remaining two for VPN and remote access services (SSL VPN/IPSec), the best approach would be to first cleanly separate the interfaces based on purpose. Start by reviewing and updating all firewall policies and static routes that currently reference individual WAN interfaces (like Port X), ensuring they're reassigned appropriately—either to the SD-WAN zone or to standalone interfaces for VPN use.