SD-WAN compatibility with Internet Banking

[nbctcp]

SW INFO: -FortiOS vm 6.2.2 Eval License

I want to know whether SD-WAN dual isp would be no problem with Internet Banking, because what I know SD-WAN only for outgoing traffic.

While Internet Banking required source and incoming ip should have same ip address.

In my theory, would be possible using SD-WAN, outgoing and incoming traffic using different isp.

tq

[sw2090]

The NAT in the policies for internet via SD-WAN takes care for that not to happen. SD-WAN decides the WAN to use and NAT does the masquerading. The Baninkg server will replay to the external IP your connection came from and SD-WAN + NAT will take care for the replay to reach back to you.

Anything else would result in split routig and noone - including fortinet - wants split routing ;)

[nbctcp]

I am not clear

Let say I have dual ISP

Do you mean 1. all traffic in SD-WAN will always outgoing and incoming with the same ISP or 2. I need to create a policy which if destination category Internet Banking then choose ISP1

Do you have reference url or KB for your statement

[sw2090]

If you use SD-WAN then SD-WAn will choose the ISP accoardig to the configured blancing algorithm. IF you then connect to your banking server this will be used. Additionally this will create a session on your FGT for this connection.

As long as this session exists it will be reused for any connection from you to your banking. Sessions get dropped if they are not in use and reach their TTL, or if they are deleted by user.

If the session is gone SD-WAN could change the ISP and create a new one.

If you do need this to _always_ use the same ISP guaranteed you could create an sd-wan rule for this connection.

[ShawnZA]

Banking works fine with SD WAN.

Traffic does not go out over one interface and comes back over another, that is incorrect. The traffic will come back to the NAT IP your session went out over, so you will not have any issues.

[sw2090]

yeah that is what I tried to explain :)