SDWAN rule

[HS08]

If i have 2 internet link how we can configure sdwan policy to fullfill my below requirement

- group 1 use link1 and will be switch to link2 if link1 have high latency or packet loss.

- group 2 use link2 and will be switch to link1 if link2 have high latency or packet loss.

in shortway i want to use best quality but also load balance. If we use only best quality for all users there will be bottleneck for one link and no traffic for another link.

[kaman]

Hi HS08,

In this scenario, best practice is to use 'Best Quality". When using Best Quality mode, SD-WAN will choose the best link to forward traffic by comparing the link-cost-factor. A link-cost factor is a specific metric of participating link(s) (such as, latency, packet loss, and so on) evaluated against a target that you define (such as a health-check server).

Please refer to the document below for more information.

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/22371/best-quality-strategy

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SD-WAN-Best-Quality-SLA-Customized-Profile...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SD-WAN-Best-Quality-Rules-link-cost-thresh...

Regards,
Aman

[HS08]

But if we use best quality and two have good performance then only one link used for passing the traffic and other link only standby.

What i want is when both of link have good performance then we can use both link simulatneous with some prefered.

The prefered i mean is example for IT prefer using link1 and accounting use link2.

[Markus_M]

You need an identifying factor to tell FortiGate "this traffic is from group2".

If the groups are in certain subnets, design your rules for these subnets.

Otherwise, you may have to implement some sort of authentication and refer to users in the user group (also a possible source of a group).

[HS08]

Of course i already make 2 group based on the department.

If i have 3 sdwan rule below

Rule-1

set name "Internet1"

set mode priority

 set dst "all"

 set src "IT Subnet"

 set health-check "microsoft"

set priority-members 1

Rule-2

set name "Internet2"

set mode priority

set dst "all"

set src "Accounting Subnet"

set health-check "microsoft"

set priority-members 2

Rule-3

set name "Internet-LB"

set mode priority

set dst "all"

set src "All Subnet"

set health-check "microsoft"

set priority-members 1 2

Will:

IT goes to rule-3 if Internet1 have bad performance and user Internet2?

Accounting goes to rule-3 if Internet2 have bad performance and user Internet1?

IT always use Internet1 and Accounting always use Internet2 if both internet in good condition?