Fortinet Sdwan

---
name: fortinet-sdwan
description: "Expert coverage of Fortinet SD-WAN across all FortiOS versions: FortiGate SD-WAN edge architecture, health checks, SD-WAN rules and steering strategies, ADVPN/ADVPN 2.0, ISDB application steering, FortiManager orchestration, FortiSASE integration, and ZTNA. Use for \"Fortinet SD-WAN\", \"FortiGate SD-WAN\", \"ADVPN\", \"FortiOS SD-WAN\", \"FortiManager SD-WAN\", \"SD-WAN health check\", \"SD-WAN rules\", \"FortiSASE\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `sd-wan` skill."
license: MIT
---

# Fortinet SD-WAN

This skill covers Fortinet SD-WAN built natively into FortiOS across all supported versions (7.2 through 7.6). Areas of expertise include:

- FortiGate as converged SD-WAN edge and NGFW (no separate SD-WAN appliance)
- SD-WAN zones, members, health checks (performance SLAs)
- SD-WAN rules with five steering strategies (manual, best-quality, lowest-cost, maximize-bandwidth, minimum-SLA)
- ADVPN (classic) and ADVPN 2.0 dynamic mesh architecture
- ISDB (Internet Service Database) and FortiGuard application steering
- IPsec overlay creation (hub-spoke, per-transport overlays)
- FortiManager centralized orchestration and template management
- FortiAnalyzer SD-WAN analytics and SLA reporting
- FortiSASE integration for cloud-delivered security
- ZTNA proxy with SD-WAN traffic steering
- FortiClient unified agent integration

When a question is version-specific, consult the matching `references/versions/` file. When the version is unknown, provide general guidance and note where behavior differs.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Use diagnostics commands below; identify health check, rule, or overlay issues
   - **Rule design** -- Load `references/best-practices.md` for steering strategy selection and rule ordering
   - **Architecture** -- Load `references/architecture.md` for overlay design, ADVPN, health check mechanics
   - **Administration** -- Follow FortiManager orchestration guidance below
   - **Integration** -- FortiSASE, ZTNA, FortiClient guidance

2. **Identify version** -- Determine FortiOS version. If unclear, ask. Version matters significantly for ADVPN 2.0 (7.4+), passive health checks (7.4.1+), and ADVPN 2.0 enhancements (7.6).

3. **Load context** -- Read the relevant reference file for deep knowledge.

4. **Analyze** -- Apply Fortinet SD-WAN-specific reasoning, not generic SD-WAN advice.

5. **Recommend** -- Provide actionable guidance with FortiOS CLI examples.

6. **Verify** -- Suggest validation commands (`diagnose sys sdwan`, `get router info sdwan`).

## Core Architecture

### Converged Design
Fortinet SD-WAN is built natively into FortiOS. There is no separate SD-WAN controller appliance:
- **FortiGate** IS the SD-WAN edge, security device, and router -- single appliance
- **FortiManager** provides centralized orchestration for multi-site deployments
- **FortiAnalyzer** provides log aggregation, SD-WAN analytics, and SLA reporting
- **FortiSASE** provides cloud-delivered security integrated with SD-WAN

### Deployment Patterns
- **Hub-and-Spoke**: Branch FortiGates (spokes) connect via IPsec overlays to hub FortiGate(s)
- **Full-Mesh**: Direct branch-to-branch tunnels (ADVPN enables dynamic mesh from hub-spoke base)
- **Dual-Hub**: Two hub sites for redundancy; traffic selects best hub per SD-WAN rules
- **Multi-Region**: Regional hubs per geographic zone; spokes connect to regional hub

## SD-WAN Configuration Model

### SD-WAN Zones
Zones group SD-WAN members logically. Firewall policies reference zones, not individual interfaces:
```
config system sdwan
  config zone
    edit "UNDERLAY"
    next
    edit "OVERLAY"
    next
  end
end
```

**Key principle**: Adding or removing WAN interfaces from a zone does not require firewall policy changes. Design zones around transport type (underlay, overlay) or security domain.

### SD-WAN Members
Members are the WAN interfaces and tunnel interfaces participating in SD-WAN:
```
config system sdwan
  config members
    edit 1
      set interface "wan1"
      set zone "UNDERLAY"
      set gateway 203.0.113.1
      set cost 10
      set priority 1
    next
    edit 2
      set interface "HUB1_OVERLAY"
      set zone "OVERLAY"
      set cost 5
    next
  end
end
```

Member attributes:
- **cost**: Relative cost for lowest-cost steering strategy
- **priority**: Lower number = higher priority for manual/failover steering
- **weight**: Used by maximize-bandwidth strategy for proportional distribution
- **status**: enable/disable member without removing it

### Health Checks (Performance SLAs)
Health checks probe remote targets and measure path quality:
```
config system sdwan
  config health-check
    edit "INTERNET-SLA"
      set server "8.8.8.8" "1.1.1.1"
      set protocol ping
      set interval 500
      set failtime 5
      set recoverytime 5
      set members 1 2
    next
  end
end
```

**Probe protocols**: ICMP (ping), TCP-echo, UDP-echo, HTTP, HTTPS, DNS, TWAMP
**Metrics collected**: latency, jitter, packet loss, MOS (for VoIP quality)

**Passive health checks** (7.4.1+): Derive SLA metrics from actual application traffic without active probing. Reduces probe overhead; useful for applications with known SLA profiles.

## SD-WAN Rules (Traffic Steering)

Rules are processed top-down; first matching rule governs path selection.

### Steering Strategies

| Strategy | Behavior | Best For |
|---|---|---|
| **Manual** | Explicitly specify preferred interface; no dynamic selection | Static traffic paths, simple failover |
| **Best Quality** | Select interface with best metric (lowest latency/jitter/loss); re-evaluates continuously | Voice, video, real-time applications |
| **Lowest Cost** | Prefer lowest-cost interface meeting quality thresholds | Cost-sensitive general traffic |
| **Maximize Bandwidth** | Distribute sessions across interfaces for aggregate throughput | Bulk transfers, high-bandwidth applications |
| **Minimum SLA** | Stay on current link unless SLA violated; minimize reroutes | Stability-first, avoid flapping |

### Rule Configuration
```
config system sdwan
  config service
    edit 1
      set name "VOICE-STEERING"
      set mode best-quality
      set link-cost-factor latency
      set health-check "VOICE-SLA"
      set dst "VOICE-SERVERS"
      set priority-members 3 1
    next
    edit 2
      set name "SAAS-TRAFFIC"
      set mode lowest-cost
      set health-check "INTERNET-SLA"
      set internet-service enable
      set internet-service-name "Microsoft-Office365" "Salesforce"
    next
  end
end
```

## Application Steering

### ISDB (Internet Service Database)
FortiGuard-maintained database of SaaS applications identified by IP prefix/port/protocol:
- Includes O365, Salesforce, AWS, Azure, GCP, Zoom, Webex, YouTube, and thousands more
- SD-WAN rules reference ISDB entries by name -- no manual IP prefix maintenance
- Automatic updates from FortiGuard cloud
```
set internet-service enable
set internet-service-name "Microsoft-Office365" "Microsoft-Teams"
```

### FortiGuard Application Signatures
DPI engine classifies applications using L7 signatures, TLS SNI, behavioral analysis:
```
set application 1234 5678   # application ID references
```

## ADVPN (Auto Discovery VPN)

### ADVPN Classic (7.2 and earlier)
Hub-spoke IPsec overlay with automatic shortcut tunnels:
- Hub receives spoke-to-spoke traffic and sends "shortcut advice" to both spokes
- Spokes negotiate direct IPsec tunnel bypassing the hub
- Shortcut maintained while traffic active; torn down after idle timeout
- **Limitation**: Single shortcut per spoke-pair; no SD-WAN awareness for shortcut selection

### ADVPN 2.0 (7.4+ / Enhanced in 7.6)
Ground-up redesign natively integrated with SD-WAN:

**Three control-plane mechanisms**:
1. **Discovery**: Spoke discovers remote spoke topology (available WAN interfaces, overlay colors, health)
2. **Path Selection**: Spoke locally selects optimal shortcut based on SD-WAN SLA metrics -- no hub involvement
3. **Health Updates**: Periodic health updates over active shortcuts; continuous re-evaluation

**FortiOS 7.6 Enhancements**:
- Multiple shortcuts per spoke-pair for load balancing
- Traffic distributed across shortcuts using SD-WAN maximize-bandwidth strategy
- Dynamic shortcut lifecycle aligned with health check state

## FortiManager Orchestration

FortiManager provides centralized SD-WAN management at scale:
- **SD-WAN templates**: Push consistent SD-WAN zone, member, health check, and rule configuration to all managed FortiGates
- **ADOM-based management**: Administrative domains isolate management of different customer/site groups
- **Central SD-WAN policy**: Define and push SD-WAN rules centrally
- **Software management**: Centralized firmware upgrade scheduling
- **Compliance checking**: Verify configuration consistency across all managed devices

## FortiSASE Integration

FortiSASE provides cloud-delivered security integrated with on-premises SD-WAN:
- FortiGate branches establish IPsec tunnels to nearest FortiSASE PoP
- SD-WAN rules steer internet-bound traffic to FortiSASE for cloud inspection
- FortiSASE services: SWG, CASB, FWaaS, ZTNA, DNS Security
- FortiManager provides single-pane management for FortiGate + FortiSASE policy

## ZTNA Integration

FortiGate ZTNA access proxy verifies device and user trust before granting application access:
- Client posture checks via FortiClient EMS
- User identity via LDAP/SAML/RADIUS
- Works with SD-WAN for optimal traffic path selection
- Replaces traditional VPN for application-specific access

## Troubleshooting

### SD-WAN Diagnostic Commands
```
# Show SD-WAN member status and health check results
diagnose sys sdwan health-check

# Show all SD-WAN member states
diagnose sys sdwan member

# Show SD-WAN routing/path selection
diagnose sys sdwan service

# Show active sessions with SD-WAN interface
diagnose sys sdwan session-id

# Detailed health check metrics
diagnose sys sdwan health-check status "INTERNET-SLA"

# Performance SLA member status for specific rule
get router info sdwan service 1
```

### Overlay Diagnostics
```
# ADVPN shortcut status
diagnose vpn ike gateway list
diagnose vpn tunnel list

# Real-time packet sniffer
diagnose sniffer packet wan1 "host 8.8.8.8" 4 0 l
```

### Common Issue Resolution

| Symptom | First Check |
|---|---|
| Interface not selected for traffic | `diag sys sdwan service` -- check rule match and health check pass |
| Health check failing | `diag sys sdwan health-check status` -- check probe responses; verify firewall policy allows probes |
| ADVPN shortcut not forming | `diag vpn ike gateway list` -- check IKE negotiation; verify ADVPN settings on hub |
| Asymmetric routing | Check SD-WAN zone/member order; review implicit rules |
| High latency on overlay | `diag sys sdwan health-check` -- check underlay quality; ADVPN shortcut vs hub path? |

## Common Pitfalls

1. **Health check interval too aggressive** -- 100ms intervals on dozens of members generate significant probe traffic. Use 500ms for most health checks; reserve 100ms for critical voice SLAs only.

2. **SD-WAN rule order matters** -- Rules are top-down first-match. A broad rule above a specific rule shadows it. Place most specific rules at the top.

3. **ISDB vs manual prefixes** -- Always prefer ISDB for SaaS application steering. Manual IP prefix lists become stale as SaaS providers change IP ranges.

4. **Confusing priority-members with member priority** -- `priority-members` in an SD-WAN rule specifies the preferred member order for that rule. `priority` on the member object is a global attribute used for failover ordering.

5. **Not enabling SD-WAN logging** -- SD-WAN performance SLA logs are disabled by default. Enable them for FortiAnalyzer ingestion: `config log setting` > `set sdwan-log enable`.

6. **ADVPN classic limitations on 7.2** -- Classic ADVPN does not integrate with SD-WAN path selection for shortcut tunnels. Upgrade to 7.4+ for ADVPN 2.0.

7. **Forgetting to reference health check in SD-WAN rule** -- An SD-WAN rule without a health check reference cannot perform quality-based steering. Always associate a health check with non-manual rules.

8. **FortiManager template ordering** -- SD-WAN zone configuration must be pushed before SD-WAN member configuration. Verify template dependencies in FortiManager.

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 7.6 | `references/versions/7.6.md` | FortiOS 7.6, ADVPN 2.0 enhancements, multiple shortcuts per spoke-pair, SD-WAN maximize-bandwidth across shortcuts |

## Reference Files

Load these when you need deep knowledge:

- `references/architecture.md` -- FortiGate edge architecture, health check mechanics, ADVPN/ADVPN 2.0 internals, overlay creation, link quality monitoring. Read for "how does X work" questions.
- `references/best-practices.md` -- SD-WAN rule design, ADVPN 2.0 deployment, FortiSASE integration, ZTNA patterns, operational monitoring. Read for design and operations questions.