FortiGate SD-WAN is more than a bundle of internet links. It is a policy-driven forwarding system that combines available WAN members, measured path health, application or destination matching, and steering strategy to decide which path should carry a session.<\/p>\n
For the NSE 4 FortiOS 7.6 Administrator<\/a>, the key is to separate three questions: which links are members of SD-WAN, whether those links are healthy enough for the traffic, and which rule and strategy select among the eligible links. Most troubleshooting mistakes come from collapsing those questions into one.<\/p>\n Physical or logical WAN interfaces become SD-WAN members. Members can be organized into zones so firewall policies can reference a logical group rather than individual links. This separation lets routing and steering choose a member while policy continues to represent the security boundary.<\/p>\n Zone design affects operational flexibility. If public internet and private MPLS links need different inspection or access policy, placing them in separate zones can make that distinction clearer. If several equivalent internet circuits share the same policy requirements, a common zone can reduce policy duplication.<\/p>\n Before debugging a rule, confirm that the interface is actually an SD-WAN member, is administratively up, has valid addressing and routing, and belongs to the expected zone.<\/p>\n FortiOS performance SLAs can actively probe a target or use passive session information to measure link health. Common measurements include latency, jitter, and packet loss. The health result is then available to SD-WAN rules so a path can be considered in or out of SLA.<\/p>\n Probe design matters. A public DNS server may prove general internet reachability but say little about the health of a specific SaaS application. A target placed too close to the FortiGate may show the local circuit is alive while a distant provider path is degraded.<\/p>\n Thresholds should reflect application needs. Voice may be sensitive to jitter and latency long before a bulk file transfer becomes unusable. One global threshold for every workload can therefore produce poor steering decisions.<\/p>\n Fortinet documents that when a link fails all relevant health checks, FortiOS can remove routes on that link from the SD-WAN load-balancing group and steer traffic through other members. When the link recovers and passes SLA, the routes can be reestablished.<\/p>\n This is why an interface can appear physically up while traffic no longer uses it. The physical circuit may have carrier, but the performance SLA has determined that the path is unusable for the configured health target.<\/p>\n When troubleshooting, read the SLA status directly. Do not assume \u201cwan2 is up\u201d means wan2 is eligible for the rule you are testing.<\/p>\n SD-WAN rules identify traffic and apply a steering strategy. Traffic can be matched by destination address, application, internet service, or other supported criteria depending on the configuration. More specific business rules normally belong above broad catch-all behavior.<\/p>\n If a session takes the wrong path, first identify the rule that matched. A correct performance SLA cannot help if the traffic matched a different rule whose member list or strategy points elsewhere.<\/p>\n Application-based rules introduce another dependency: FortiGate may need to identify the application after traffic begins. Initial packets can follow a different decision path until classification is known, so operators should understand how the chosen rule type interacts with session establishment.<\/p>\n FortiOS supports multiple steering approaches, including manual preference, best quality, lowest cost subject to SLA, load balancing, and other strategies. Each answers a different business question.<\/p>\n A best-quality rule may prefer the link with the strongest measured performance. A lowest-cost strategy can keep traffic on an economical path while it satisfies the SLA and move it only when quality falls below the requirement. Manual preference can express a strict primary\/backup design.<\/p>\n Choose the strategy from the application requirement. \u201cUse WAN1 unless it is down\u201d is not the same as \u201calways use the link with the lowest latency,\u201d and neither is the same as \u201cdistribute sessions to maximize aggregate bandwidth.\u201d<\/p>\n SD-WAN selection does not replace the firewall policy. Traffic still needs an allowed policy between the source zone and the SD-WAN zone, with the appropriate services, NAT, and security profiles.<\/p>\n If path selection looks correct but packets do not leave, verify the policy and session. Conversely, if a policy allows traffic but the wrong WAN is used, investigate the SD-WAN rule, SLA state, and routing rather than adding more firewall rules.<\/p>\n This separation is similar to the broader distinction between routing and security: one decides where traffic should go, the other decides whether it is allowed and how it is inspected.<\/p>\n SD-WAN makes forwarding decisions in the context of stateful sessions. A new SLA condition or rule change may affect new sessions differently from existing sessions. When validating a change, generate fresh connections or clear the relevant sessions if operationally safe.<\/p>\n Failover behavior also depends on the application. Some TCP sessions can recover after path changes; others reset because the source NAT address changes or the remote service treats the new path as a different connection. UDP applications may react differently again.<\/p>\n Measure user experience, not just the selected interface. A technically correct failover that interrupts a voice call for several seconds may still require different thresholds or application design.<\/p>\n Good SD-WAN design maps application requirements to network behavior. Real-time traffic can prefer low jitter, critical SaaS can use a path with strong loss characteristics, bulk traffic can use lower-cost bandwidth, and private application flows can stay on a private link when available.<\/p>\nMembers and zones define the available egress choices<\/h2>\n
Performance SLAs measure link quality<\/h2>\n
Failed health checks can remove routes from service<\/h2>\n
SD-WAN rules decide which traffic receives which strategy<\/h2>\n
Strategy changes what \u201cbest path\u201d means<\/h2>\n
Firewall policy still controls what SD-WAN traffic may do<\/h2>\n
Existing sessions may not move just because conditions changed<\/h2>\n
Use SD-WAN to express business intent, not random load sharing<\/h2>\n