SD-Wan / Load Balancing

[rpozywak]

I have a Fortinet 60D firewall running 6.0.4 firmware.    I just added a second ADSL line to the firewall on WAN 2.   I currently have a ADSL line on WAN 1.  Both ADSL lines have static ip's and the speed is equal on both links.   Currently I have get 25mbs down and 2mbs up.   I followed the white paper that Fortinet put out reference to SDWAN and configured my firewall the same.  In the criteria section I selected volume and gave wan 1 50 percent and wan 2 50 percent to total a 100 percent.  From there I configured the policies to use the SDWAN interface.

I have been monitoring both WAN interfaces in the Fortinet dashboard and what I have been noticing is that WAN 1 will have about 20mbs of usage and WAN 2 will be around 1.58kps and this will stay like this for an hour or so and then WAN 2 will have about 20mbs and WAN 1 will be around a couple kps.   I was looking at the logs and it doesn't seem that either of my WAN connections are dropping.   

I am trying to load balance between both of these WAN connections but it seems not to be working correctly.   Is there something I am missing or need to change in my configuration or does Fortinet firewalls don't load balance good.   

Thank you in advance

Sincerely,

Richard       

[Dave_Hall]

Load-balancing in later firmwares suppose to be a lot better than say 5.0.x and under.  But I understand load-balancing is still a session-based affair.  I don't think there is any way in predetermination as to how much traffic will be transferred over an established tcp (eg. port 80) connection, say downloading large iso files vs someone browsing a website.

That said, I am going to assume that volume-based load-balancing should eventually even out over a longer stretch of time.  For better accuracy you will want to set the ingress/outgress values of both WAN interfaces so the fgt will know what the bandwidth limits to expect.   And I would check the routing distance on both WAN connections to confirm they are equal. 

[rpozywak]

Thanks Dave - I have set bandwidth ingress and outgress for WAN connections and the distance for each connection is set 1.   Yesterday I was monitoring that connection periodically and noticed that it would be maxed out at 25mbs and the other wan connection would be sitting at 100kps.  and they would flip back and forth which makes no sense at all.   I am thinking to change the settings to session base to see if that helps.    If it doesn't I might have to invest in an SDWAN product which I am trying to avoid.    

Richard 

[baggins]

Hi,

I have it like this and no problem:

config system virtual-wan-link
    set status enable
    set load-balance-mode measured-volume-based
    config members
        edit 3
            set interface "wan1"
            set gateway bla1
            set volume-ratio 50
        next
        edit 2
            set interface "wan2"
            set gateway bla2
            set volume-ratio 50
        next
    end
    config health-check
        edit "googleping"
            set server "8.8.8.8"
            set interval 3
            set members 3 2
            config sla
                edit 1
                    set latency-threshold 15
                    set jitter-threshold 35
                    set packetloss-threshold 10
                next
            end
        next
    end
end

So I'm using "volume" based LB..

[rpozywak]

Thank you for the config..  I just ran mine and it's completely different.. I am going to give yours a try and see what happens.  

What Ver are you running?

Here is a copy of mine.

baggins wrote:

status : enable load-balance-mode : weight-based fail-detect : disable members: == [ 1 ] seq-num: 1 interface: wan1 == [ 2 ] seq-num: 2 interface: wan2 == [ 3 ] seq-num: 3 interface: internal5 health-check: == [ Google ] name: Google service:

[baggins]

rpozywak wrote:

Thank you for the config..  I just ran mine and it's completely different.. I am going to give yours a try and see what happens.  

What Ver are you running?

I'm on 6.0.3 at the moment.

[rpozywak]

Thank you all for your post.  I am running 6.0.4 and looking at the configure that was posted and compared it to my and it appears that I needed to set enable under the config system virtual-wan-link and the system started to work like it should.  

Thank you for all of your help.

Richard 

[alex_buric]

I have issue with SD-WAN on FGT-140D-POE (FortiOS 6.0.4). There are two WAN interface (WAN1 - static IP, WAN2 - PPPoE) on virtual-interface.

Part of config:

config system virtual-wan-link     set status enable     set load-balance-mode weight-based     set fail-detect enable     config members         edit 1             set interface "wan1"             set gateway XX.XX.XX.XX             set source XX.XX.XX.XX             set weight 5         next         edit 2             set interface "wan2"             set gateway XX.XX.XX.XX             set source XX.XX.XX.XX             set weight 95         next     end

config health-check         edit "Ping DotOne"             set server "1.1.1.1"             set interval 2             set failtime 2             set recoverytime 2             set members 1 2             config sla                 edit 1                     set latency-threshold 10                     set jitter-threshold 0                 next             end     end end

The are numerous pppoe daemon freezing every 5-10 minutes on WAN2. Link is up, but due to health-checking failing is not forwarding traffic. When I shut it down and up - all fine for some time.

When I delete SD-WAN and set two separate WAN interface with different distance and priorities - all works fine without problems.

[Dave_Hall]

I think you may also want to find out what is "hogging" all the bandwidth.  From personal experience, it take little (like 2-3) individuals to bring down the Internet for everyone in a LAN environment just by bittorrenting or similar activities.  So unless you drill down to the individual sessions, you may not get a true picture of bandwidth usage. 

Also, you may want to check/confirm the second WAN connection is getting the expected max bandwidth.  It may be more common then you think that newly install ISP lines require a hard reboot and/or a "configuration" file hasn't been pushed down to the gateway device.  On top of this, you may want perform a diag hardware deviceinfo nic wan2 from the CLI to see if there are any duplex/speed issues. 

rpozywak wrote:

Yesterday I was monitoring that connection periodically and noticed that it would be maxed out at 25mbs and the other wan connection would be sitting at 100kps.  and they would flip back and forth which makes no sense at all.   I am thinking to change the settings to session base to see if that helps.

[rpozywak]

Were are you seeing in the system where the PPPOE daemon freezing.  I am still having problems with the system load balancing it's goes over one or the other.