I have a Fortinet 60D firewall running 6.0.4 firmware. I just added a second ADSL line to the firewall on WAN 2. I currently have a ADSL line on WAN 1. Both ADSL lines have static ip's and the speed is equal on both links. Currently I have get 25mbs down and 2mbs up. I followed the white paper that Fortinet put out reference to SDWAN and configured my firewall the same. In the criteria section I selected volume and gave wan 1 50 percent and wan 2 50 percent to total a 100 percent. From there I configured the policies to use the SDWAN interface.
I have been monitoring both WAN interfaces in the Fortinet dashboard and what I have been noticing is that WAN 1 will have about 20mbs of usage and WAN 2 will be around 1.58kps and this will stay like this for an hour or so and then WAN 2 will have about 20mbs and WAN 1 will be around a couple kps. I was looking at the logs and it doesn't seem that either of my WAN connections are dropping.
I am trying to load balance between both of these WAN connections but it seems not to be working correctly. Is there something I am missing or need to change in my configuration or does Fortinet firewalls don't load balance good.
Thank you in advance
Sincerely,
Richard
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Load-balancing in later firmwares suppose to be a lot better than say 5.0.x and under. But I understand load-balancing is still a session-based affair. I don't think there is any way in predetermination as to how much traffic will be transferred over an established tcp (eg. port 80) connection, say downloading large iso files vs someone browsing a website.
That said, I am going to assume that volume-based load-balancing should eventually even out over a longer stretch of time. For better accuracy you will want to set the ingress/outgress values of both WAN interfaces so the fgt will know what the bandwidth limits to expect. And I would check the routing distance on both WAN connections to confirm they are equal.
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Thanks Dave - I have set bandwidth ingress and outgress for WAN connections and the distance for each connection is set 1. Yesterday I was monitoring that connection periodically and noticed that it would be maxed out at 25mbs and the other wan connection would be sitting at 100kps. and they would flip back and forth which makes no sense at all. I am thinking to change the settings to session base to see if that helps. If it doesn't I might have to invest in an SDWAN product which I am trying to avoid.
Richard
Hi,
I have it like this and no problem:
config system virtual-wan-link
set status enable
set load-balance-mode measured-volume-based
config members
edit 3
set interface "wan1"
set gateway bla1
set volume-ratio 50
next
edit 2
set interface "wan2"
set gateway bla2
set volume-ratio 50
next
end
config health-check
edit "googleping"
set server "8.8.8.8"
set interval 3
set members 3 2
config sla
edit 1
set latency-threshold 15
set jitter-threshold 35
set packetloss-threshold 10
next
end
next
end
end
So I'm using "volume" based LB..
Thank you for the config.. I just ran mine and it's completely different.. I am going to give yours a try and see what happens.
What Ver are you running?
Here is a copy of mine.
baggins wrote:status : enable load-balance-mode : weight-based fail-detect : disable members: == [ 1 ] seq-num: 1 interface: wan1 == [ 2 ] seq-num: 2 interface: wan2 == [ 3 ] seq-num: 3 interface: internal5 health-check: == [ Google ] name: Google service:
rpozywak wrote:Thank you for the config.. I just ran mine and it's completely different.. I am going to give yours a try and see what happens.
What Ver are you running?
I'm on 6.0.3 at the moment.
Thank you all for your post. I am running 6.0.4 and looking at the configure that was posted and compared it to my and it appears that I needed to set enable under the config system virtual-wan-link and the system started to work like it should.
Thank you for all of your help.
Richard
I have issue with SD-WAN on FGT-140D-POE (FortiOS 6.0.4). There are two WAN interface (WAN1 - static IP, WAN2 - PPPoE) on virtual-interface.
Part of config:
config system virtual-wan-link set status enable set load-balance-mode weight-based set fail-detect enable config members edit 1 set interface "wan1" set gateway XX.XX.XX.XX set source XX.XX.XX.XX set weight 5 next edit 2 set interface "wan2" set gateway XX.XX.XX.XX set source XX.XX.XX.XX set weight 95 next end
config health-check edit "Ping DotOne" set server "1.1.1.1" set interval 2 set failtime 2 set recoverytime 2 set members 1 2 config sla edit 1 set latency-threshold 10 set jitter-threshold 0 next end end end
The are numerous pppoe daemon freezing every 5-10 minutes on WAN2. Link is up, but due to health-checking failing is not forwarding traffic. When I shut it down and up - all fine for some time.
When I delete SD-WAN and set two separate WAN interface with different distance and priorities - all works fine without problems.
I think you may also want to find out what is "hogging" all the bandwidth. From personal experience, it take little (like 2-3) individuals to bring down the Internet for everyone in a LAN environment just by bittorrenting or similar activities. So unless you drill down to the individual sessions, you may not get a true picture of bandwidth usage.
Also, you may want to check/confirm the second WAN connection is getting the expected max bandwidth. It may be more common then you think that newly install ISP lines require a hard reboot and/or a "configuration" file hasn't been pushed down to the gateway device. On top of this, you may want perform a diag hardware deviceinfo nic wan2 from the CLI to see if there are any duplex/speed issues.
rpozywak wrote:Yesterday I was monitoring that connection periodically and noticed that it would be maxed out at 25mbs and the other wan connection would be sitting at 100kps. and they would flip back and forth which makes no sense at all. I am thinking to change the settings to session base to see if that helps.
NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
Were are you seeing in the system where the PPPOE daemon freezing. I am still having problems with the system load balancing it's goes over one or the other.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.