AnsweredHot!SD-WAN and multi-WAN links design

Author
BensonLEI
New Member
  • Total Posts : 19
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/06/01 21:08:14
  • Status: offline
2020/07/28 10:12:50 (permalink)
0

SD-WAN and multi-WAN links design

Hi, guys,
I am new to Fortinet products.
We have two sites, I just installed Fortigate 400e HA pair at each site, and multi WAN links at each site, like SiteA has two internet lines for web surfing and then two IPLC lines connect to SiteB ( also has two internet lines )
 
I would like to get recommendation from your experts, how to design/configure the 400e HA pair at each site:
1. Internet lines for web surfing at each site
2. IPLC lines for two site communication ( with private IP subnets) 
 
 
 
Many thx in advance.
 
 
post edited by BensonLEI - 2020/07/28 10:14:36
#1
PerthNSE
New Member
  • Total Posts : 1
  • Scores: -2
  • Reward points: 0
  • Joined: 2020/07/28 21:05:21
  • Status: offline
Re: SD-WAN and multi-WAN links design 2020/07/29 22:03:06 (permalink) ☼ Best Answerby BensonLEI 2020/07/29 23:44:06
1 (1)
Hi,
I'm not too sure what exactly you are after here - so I'll take a stab at connectivity.
I'm going to assume you have a pair of core Fortiswitches running in MCLAG for this.
 
The key with HA is to ensure that you maintain connectivity in the event of an HA primary change over, so the incoming links need to go through VLANs on the core switches before connecting to the HA pair. The links from the switches can be physical cables to the WAN ports on the Fortigates, but I usually use VLANs on the FortiLink interface.
 
Then you should add the interfaces to SDWAN and setup PLA and SDWAN Rules to handle traffic.
 
For a dual WAN setup I would normally connect it up similar to this diagram (just add more for IPLC links) - 
 
 
 
If you haven't seen it, this cookbook article is a good starting point fo HA setup - https://cookbook.fortinet.com/high-availability-two-fortigates/index.html

Attached Image(s)

#2
BensonLEI
New Member
  • Total Posts : 19
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/06/01 21:08:14
  • Status: offline
Re: SD-WAN and multi-WAN links design 2020/07/30 04:08:20 (permalink)
0
Hi, PerthNSE,
 
May thanks for your reply and information, I set up the HA structure and SD-WAN zones for the internet and IPLC lines, at the attached.
 
But strangely, I can not configure static route to individual SD-WAN zone separately, only this object "SD-WAN"
 
=====
config system sdwan
  set status enable
     config zone
       edit "virtual-wan-link"
     next
       edit "Access_to_Internet"
     next
       edit "LL_link-to-16HK"
    next
  end
  config members
.....
.....
config router static
    edit 1
      set distance 1
      set sdwan enable
  next
  edit 2
     set dst 10.16.7.0 255.255.255.0
     set gateway 10.10.32.22
     set device "port7"
next
===========
 
 
Änything I need to modify the "config router static", please advice
 
 

Attached Image(s)

#3
Jump to:
© 2020 APG vNext Commercial Version 5.5