Hot!SD-Wan / Load Balancing

Author
rpozywak
New Member
  • Total Posts : 11
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/11/09 13:31:10
  • Status: offline
2019/01/24 04:38:16 (permalink) 6.0
0

SD-Wan / Load Balancing

I have a Fortinet 60D firewall running 6.0.4 firmware.    I just added a second ADSL line to the firewall on WAN 2.   I currently have a ADSL line on WAN 1.  Both ADSL lines have static ip's and the speed is equal on both links.   Currently I have get 25mbs down and 2mbs up.   I followed the white paper that Fortinet put out reference to SDWAN and configured my firewall the same.  In the criteria section I selected volume and gave wan 1 50 percent and wan 2 50 percent to total a 100 percent.  From there I configured the policies to use the SDWAN interface.
 
I have been monitoring both WAN interfaces in the Fortinet dashboard and what I have been noticing is that WAN 1 will have about 20mbs of usage and WAN 2 will be around 1.58kps and this will stay like this for an hour or so and then WAN 2 will have about 20mbs and WAN 1 will be around a couple kps.   I was looking at the logs and it doesn't seem that either of my WAN connections are dropping.   
 
I am trying to load balance between both of these WAN connections but it seems not to be working correctly.   Is there something I am missing or need to change in my configuration or does Fortinet firewalls don't load balance good.   
 
Thank you in advance
 
Sincerely,
 
Richard       
#1

9 Replies Related Threads

    Dave Hall
    Expert Member
    • Total Posts : 1360
    • Scores: 140
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/01/24 08:20:16 (permalink)
    0
    Load-balancing in later firmwares suppose to be a lot better than say 5.0.x and under.  But I understand load-balancing is still a session-based affair.  I don't think there is any way in predetermination as to how much traffic will be transferred over an established tcp (eg. port 80) connection, say downloading large iso files vs someone browsing a website.
     
    That said, I am going to assume that volume-based load-balancing should eventually even out over a longer stretch of time.  For better accuracy you will want to set the ingress/outgress values of both WAN interfaces so the fgt will know what the bandwidth limits to expect.   And I would check the routing distance on both WAN connections to confirm they are equal. 
     
     

    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #2
    rpozywak
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/09 13:31:10
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/01/25 02:59:59 (permalink)
    0
    Thanks Dave - I have set bandwidth ingress and outgress for WAN connections and the distance for each connection is set 1.   Yesterday I was monitoring that connection periodically and noticed that it would be maxed out at 25mbs and the other wan connection would be sitting at 100kps.  and they would flip back and forth which makes no sense at all.   I am thinking to change the settings to session base to see if that helps.    If it doesn't I might have to invest in an SDWAN product which I am trying to avoid.    
     
    Richard 
    #3
    baggins
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/07/12 06:06:20
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/01/25 03:47:57 (permalink)
    0
    Hi,
     
    I have it like this and no problem:
     
    config system virtual-wan-link
        set status enable
        set load-balance-mode measured-volume-based
        config members
            edit 3
                set interface "wan1"
                set gateway bla1
                set volume-ratio 50
            next
            edit 2
                set interface "wan2"
                set gateway bla2
                set volume-ratio 50
            next
        end
        config health-check
            edit "googleping"
                set server "8.8.8.8"
                set interval 3
                set members 3 2
                config sla
                    edit 1
                        set latency-threshold 15
                        set jitter-threshold 35
                        set packetloss-threshold 10
                    next
                end
            next
        end
    end

     
    So I'm using "volume" based LB..
    #4
    rpozywak
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/09 13:31:10
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/01/25 07:25:54 (permalink)
    0
    Thank you for the config..  I just ran mine and it's completely different.. I am going to give yours a try and see what happens.  
     
    What Ver are you running?
     
    Here is a copy of mine.
     
    baggins
    status : enable
    load-balance-mode : weight-based
    fail-detect : disable
    members:
    == [ 1 ]
    seq-num: 1 interface: wan1
    == [ 2 ]
    seq-num: 2 interface: wan2
    == [ 3 ]
    seq-num: 3 interface: internal5
    health-check:
    == [ Google ]
    name: Google
    service:



    #5
    Dave Hall
    Expert Member
    • Total Posts : 1360
    • Scores: 140
    • Reward points: 0
    • Joined: 2012/05/11 07:55:58
    • Location: Canada
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/01/25 10:27:58 (permalink)
    0
    I think you may also want to find out what is "hogging" all the bandwidth.  From personal experience, it take little (like 2-3) individuals to bring down the Internet for everyone in a LAN environment just by bittorrenting or similar activities.  So unless you drill down to the individual sessions, you may not get a true picture of bandwidth usage. 
     
    Also, you may want to check/confirm the second WAN connection is getting the expected max bandwidth.  It may be more common then you think that newly install ISP lines require a hard reboot and/or a "configuration" file hasn't been pushed down to the gateway device.  On top of this, you may want perform a diag hardware deviceinfo nic wan2 from the CLI to see if there are any duplex/speed issues. 
     
    rpozywak
    Yesterday I was monitoring that connection periodically and noticed that it would be maxed out at 25mbs and the other wan connection would be sitting at 100kps.  and they would flip back and forth which makes no sense at all.   I am thinking to change the settings to session base to see if that helps.




    NSE4/FMG-VM64/FortiAnalyzer-VM/5.2/5.4 (FWF40C/FW92D/FGT200B/FGT200D/FGT101E)/ FAP220B/221C
    #6
    baggins
    New Member
    • Total Posts : 10
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/07/12 06:06:20
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/01/28 01:22:49 (permalink)
    0
    rpozywak
    Thank you for the config..  I just ran mine and it's completely different.. I am going to give yours a try and see what happens.  
     
    What Ver are you running?
     



    I'm on 6.0.3 at the moment.
    #7
    rpozywak
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/09 13:31:10
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/01/31 17:10:21 (permalink)
    0
    Thank you all for your post.  I am running 6.0.4 and looking at the configure that was posted and compared it to my and it appears that I needed to set enable under the config system virtual-wan-link and the system started to work like it should.  
     
    Thank you for all of your help.
     
    Richard 
    #8
    alex_buric
    New Member
    • Total Posts : 5
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/04/26 23:23:53
    • Location: Dnipro
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/02/04 02:05:42 (permalink)
    0
    I have issue with SD-WAN on FGT-140D-POE (FortiOS 6.0.4).
    There are two WAN interface (WAN1 - static IP, WAN2 - PPPoE) on virtual-interface.
     
    Part of config:
     
    config system virtual-wan-link
        set status enable
        set load-balance-mode weight-based
        set fail-detect enable
        config members
            edit 1
                set interface "wan1"
                set gateway XX.XX.XX.XX
                set source XX.XX.XX.XX
                set weight 5
            next
            edit 2
                set interface "wan2"
                set gateway XX.XX.XX.XX
                set source XX.XX.XX.XX
                set weight 95
            next
        end
     
    config health-check
            edit "Ping DotOne"
                set server "1.1.1.1"
                set interval 2
                set failtime 2
                set recoverytime 2
                set members 1 2
                config sla
                    edit 1
                        set latency-threshold 10
                        set jitter-threshold 0
                    next
                end
        end
    end
     
    The are numerous pppoe daemon freezing every 5-10 minutes on WAN2. Link is up, but due to health-checking failing is not forwarding traffic. When I shut it down and up - all fine for some time.
    When I delete SD-WAN and set two separate WAN interface with different distance and priorities - all works fine without problems.
    post edited by alex_buric - 2019/02/04 02:06:47
    #9
    rpozywak
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/11/09 13:31:10
    • Status: offline
    Re: SD-Wan / Load Balancing 2019/02/17 06:12:57 (permalink)
    0
    Were are you seeing in the system where the PPPOE daemon freezing.  I am still having problems with the system load balancing it's goes over one or the other.  
    #10
    Jump to:
    © 2019 APG vNext Commercial Version 5.5