SD-WAN or Health link monitor for ISP failover?

[StuartH]

Dear All,

I'm deploying a new Fortigate 301E running v 6.2.0 in a scenario where we will have 2 ISP's requiring failover (not load balance) for general internet access, with both ISP interfaces currently assigned to an "outside" zone. I've been researching and can see there are a couple of options for this:-

Either failover using SD-WAN 

https://docs.fortinet.com/document/fortigate/5.6.0/cookbook/597321/redundant-internet-with-sd-wan

Or failover using a health link monitors. 

https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-networking/Interfaces/Dual%20Interne...

I've seen a number of posts detailing configuration of each option but I'm really having trouble trying to understand what the preferred option is in this scenario and would appreciate any advise. 

Eventually I'll also setup dual VPN links (one over each ISP) to our other site and the intention is to use SD-WAN here to maximize available bandwidth. 

Kind Regards

Stuart. 

[James_G]

I currently have link health monitors, so interested how this works out.

I am thinking of setting up SD-WAN, but using the SD-WAN interface only for site to site traffic (VPN tunnels). You can only have 1 SD-WAN interface, and I don't like the idea of both trusted (site to site) and non trusted (aka internet) being in the same interface when showing up in policies.

Having a zone of the 2 interfaces, and a link monitor, is a simple solution if all you need is active / passive, and from the years I have been using it, works well. Just make sure you monitor a few things on the internet for health check, to reduce the chance of false positive fail-over. You also need to setup 2 default routes with different distance / priority.

config system link-monitor edit "Failover to FTTC" set srcintf "port3" set server "8.8.8.8" "1.1.1.1" set gateway-ip xx.xx.xx.xx set recoverytime 3 set update-cascade-interface disable next end

[StuartH]

Thanks for the response, I wasn't aware that you could only have one SD-WAN interface. Additionally it seems that you can't add interfaces to an SD-WAN interface if they are already in a zone, essentially the SD-WAN interface is its own zone. So your solution seem the best way to go if you want to keep the wan and SD-WAN interfaces separated in terms of your security policies. 

I've created some IPSec tunnels and added them to the SD-WAN interface. Need to do some testing but looks good so far. I think now it's just a matter of configuring a policy to pass traffic from our inside zones to the SD-WAN interface (and vice versa) for site-to-site communications. 

Had some trouble with the SD-WAN setup as I'm configuring this through a FortiManger and not the Fortigates. Turning off central management to handle on a per device basis made it easier. Not sure if that's the correct approach.