Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
bfakhriddi
New Contributor

SDWAN and question

Hi ,

was watching couple videos about sdwan and how to set it up, all videos shows to send all traffic via sdwan. But is this possible to send some traffic via sdwan and other via regular wan interfaces and  via ipsec also ?  Can anyone share any link or steps how to do this? 

8 REPLIES 8
JW
New Contributor

I also have the same question and additional enquiry:

 

1. Can the same sdwan interface support SDWAN and also ipsec tunnel to other non sd-wan locations ?

2. Can the same sdwan interface support inbound internet traffic to DMZ ?

 

TQ

sw2090

1. yes as we have that running here

2. don't know as we don't use that

 

To the Thread-Starter:

 

the problem is not the traffic - the problem is the routing.

if you run ipsec the rouing over ipsec uses the tunnel interface.

 

But if you want to route internet traffic besides sd-wan that would require an additional default route. 

Unfortunately sd-wan is a stupid monarch and doesn't allow this at all. Also you won't be able to use Interfaces in policies that are members of sd-wan...

 

 

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
bfakhriddi

"Unfortunately sd-wan is a stupid monarch and doesn't allow this at all. Also you won't be able to use Interfaces in policies that are members of sd-wan..."   Do u mean so even if  I create second default route trough regular WAN to send some traffic Fortigate  will anyway send traffic via SDWAN ? 

sw2090

it won't even let you create a second default route if you use sd-wan...

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
bfakhriddi

Thank you 

rodriguin
New Contributor

Yes!! you can add IPSec interfaces as SDWAN interfaces and create sdwan rules to do that. Or just (but more complicated to manage) add static routes to destinations for other wans and IPSec to reach internet.

ekrishnan
Staff
Staff

Hi,

 

 @bfakhriddi. Consider using policy routes, 

Policy routes takes precedence over SDWAN rules, in way you can configure a policy route to route traffic of certain destination to the interfaces  which you prefer, please try it.

EK
Presleydiana
New Contributor

Am currently running FortiGate with firmware version 6.4.3 and FortiClient version 7.2.2. The challenge arises when attempting to establish SSL VPN connections on macOS devices. While the connection initiation seems smooth, users are reporting intermittent disconnections, and in some cases, the VPN drops altogether with a error message stating "SSLVPN connection terminated (Error -12)".

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors