SD-WAN and none interface

[AEK]

Hi FortiGate admins

Any one used the "none" interface as SD-WAN member?

I wonder if we can use it like a black hole, like when we don't want to route some traffic through any SD-WAN members when some SD-WAN members are down (not to fall in the implicit SD-WAN rule). I know we can do that with firewall policies but I wonder if we can do it at SD-WAN rules level.

[akristof]

Hello,

No, this SDWAN on FortiOS does not support. You can only use standard blackhole routes but only if you are using update-static-route enabled in health-checks (because of AD values). But this is not very nice solution, much better at least in my opinion is the one you mentioned - with firewall policies.

[AEK]

Hi AKristof

Thanks for your reply.

However I made a mistake.. I forgot that with firewall policy it is not possible since with SD-WAN we can't select a member as destination interface.

[akristof · Accepted solution]

Hi,

True. For that are SDWAN zones. Recommended best practice is to group interfaces with similar access rights, technology etc into same zone - for example internet zone, VPN zone, etc. And then if you have traffic for VPN zone only, firewall policy with this traffic over Internet zone can be blocked.

[AEK]

You are right Kristof, the solution is as simple as that.. I need to review my SD-WAN lesson.