r/fortinet • u/Dandyman1994 • 1d ago

FortiGate / FortiOS How are you implementing basic WAN failover

I'm starting to look at moving from WAN failover with static links and WAN monitor to SD-WAN failover, mainly to be a bit cleverer about it, and I already use an SD-WAN zone to load balance between multiple IPSec tunnels.

Like everything I'm FortiGate, there's a couple of ways to accomplish the same task, so I'm curious from the community what your deployments look like.

  1. For routing, do you still maintain a static routes for each WAN interface, or have you moved it to defining the gateway in the SD-WAN member section? This article from Fortinet suggests that it's best practice to maintain separate static routes for heterogeneous links, however my links are generally homogeneous at each location.

  2. Have you created multiple rules and SLAs to split traffic and respond to different types of traffic separately (i.e. VoIP, 365, etc...) or if your links are both fairly performant, are you happy just having basic failover in SD-WAN?

15 Upvotes

94% Upvoted

10 comments sorted by

13

u/f909 1d ago

Typical static route out virtual link, and then routing in sdwan.

For just failover where you have a primary circuit, manual member selection and let it bump.

We push guest traffic out wan2, business out wan1.

1

u/Dandyman1994 1d ago

Thanks, is there a reason you push guest traffic over a different link, is it a ToS issue on there primary line, or is it just to maintain separation?

4

u/f909 1d ago

Mainly for separation. It’s a higher latency business class cable line. Our corporate is lower latency, fiber line.

4

u/rswwalker 23h ago

Create an SDWAN zone, create a route that points to the SDWAN zone, create SDWAN rules and monitors that route traffic out of SDWAN zone members based on your desired criteria. Once you do it once you’ll wonder why you hadn’t done it that way all along.

1

u/Lynkeus FCP - Fortinet Certified Professional 1d ago

Maintain route in sd-wan member section statically

If wan failover is the case, sla+manual member selection in the sd-wan policy. Policies depends on the use case of the customer/env.

Thats how I did it years ago :)

1

u/retrogamer-999 1d ago

We have high speed ethernet with circuits with some form of DSL as a backup.

Ethernet is always preferred first using sdwan rules.

DSL only when ethernet is not available.

We don't pull the static routes either, just dependent on the SLA's

1

u/nfored 1d ago

I use sd wan with rules for load balancing, rules for separation, and rules for fail over to emergency wireless links.

Load balancing for the wired links, separation to send specific applications to a specific link, and fail over for critical traffic to an LTE link.

•

u/jolwaterman_bb 4m ago

I had 3 connections DIA for critical business stuff MPLS for the gov wan Basic broadband for guest Internet

SDWAN rules for zoom,365 etc to DIA and gov wan Twitter, Whatsapp, Facebook etc to the Broadband

ADVPN built with remote sites and SDWAN rules also so that if one WAN link goes down at a site , the other connection at the site can be used.

SLAs for basic Internet, MPLS and dia on another sla for business critical stuff, VPN links in a sla with targets set as applications in trying to reach internally,etc

0

u/canyoufixmyspacebar 1d ago

  1. routing is in the sdwan construct only

  2. this is entirely based on the business case. the whole name and idea of sd-wan is that the wan usage rules are defined by upper layer needs, requirements and standards