Site-to-Site SD-WAN for slow network

[HT_JDC]

Hello Experts,

I have an issue about site-to-site SD-WAN. Here is the situation.
There are 2 ipsec tunnels between 2 Fortigates.

One tunnel (called as X) is a simple ipsec tunnel.
The other (called as Y) is a ipsec aggregation tunnel which has 3 ipsec tunnels (Y1, Y2, Y3)

FG1 -- X ------- Network_A ------- X -- FG2
    -- Y - Y1 -- Network_B -- Y1 - Y --
         - Y2 -- Network_C -- Y2 -
         = Y3 -- Network_D -- Y3 -
(I hope you understand the above configuration.)

When all Network_A,B,C,D belong to normal network, everything is ok.
(Both X and Y are seen as green in SD-WAN performance SLA).

However, when Network_B,C,D belongs to slow network such as satellite,
Only X is OK (alive). Y is not alive as SD-WAN, although all ipsec tunnels (Y1, Y2, Y3)
and aggregated Y are established as vpn tunnel.
(Y is seen as red  in SD-WAN performance SLA, however all are seen as green in VPN page.)

In this case of slow network, ping response time is about 600ms.
At normal network here, the response time is less than 150ms.

What and how should I do so that both X and Y are active at slow network?

Thanks in advance,

[pukalmu3]

The symptoms sound like MTU changes across the WAN not being handled correctly. Try clamping MSS on an edge device that you control at one of the problematic sites. If that fixes the issue, you now know what to start troubleshooting.

[HT_JDC]

Dear pukalmu3,

Thanks for your comments. MTUs in all cases are 1500.

Only difference would be latency (delay) between normal case and slow case, I think.

I am now looking for some related parameters.

Still waiting experts comments.

Thanks in advance.

[Atul_S · Accepted solution]

Hi,

You can make a few adjustments to make this work. First, you can consider increasing the probe timeout setting in the sla configuration to accommodate the higher latency for the slow network. Second, adjust the SLA thresholds for latency, jitter, and packet loss for the slow tunnel connections. Once you make these changes, monitor the SD-WAN perf status to verify if the agg tunnel becomes active.

Thanks,

[HT_JDC]

Dear Atul,

Thanks for your key comments.

I will try. After I get something, I will get back here.

Best regards,

[Atul_S]

Hi HT_JDC, 

Sure, no problem.

Thanks,

[HT_JDC]

Dear Experts,

I increased the value of probe-timeout (from 500 to 1000ms) at health-check. It worked. (Y is seen as green.)

My next question is:

Can we have the separate probe-configuration for each tunnel?

For example, 500ms interval and 500ms probe-timeout for tunnel X

and 1000ms interval and 1000 ms probe-timeout for tunnel Y.

Both X and Y belong to the same SD-WAN zone.

Thanks in advance,

[Atul_S]

Hi,

Great to hear that increasing the probe-timeout resolved the issue, and the aggregated tunnel is now showing as healthy. Pls consider marking the earlier reply as a solution!

Unfortunately, it’s not possible to assign different probe intervals or probe-timeout values per member within the same zone. If you want a different probe request, you may need to consider a separate SD-WAN zone. Each member of a given SD-WAN zone shares the same probe configuration.

Thanks,

[fred]

Hi,

It would help if you let us know what FG device you are working on, as well as pasting in your configuration, even with a show full:

config system sdwan

show full

If you have worked just a bit with sdwan and fortinet over vsat, you should have already found out (or will soon find out :) that probe timeout by default is set to 500ms.. chosen by Fortinet.. and as a hidden default parameter.. so that is a bit below VSAT latency, and VSAT will "never come up" due to this silly value.. it may cause issues if you do not correct it. Hope that helps.

PS: any success with ipsec aggregation?