Question about SD-WAN design
we are preparing a project to change 13 branches to SD-WAN architecture.
The following scenario is planned:
- the HQ FortiGate will have one primary line (it is located in DC, so the backup is solved technologically)
- each branch will have 2 independent lines with public IP (1x optics, 1x VDSL)
- two IPsec tunnels will be built from the branch to the HQ and added to the SD-WAN
- the default route will be via SD-WAN (IPsec) to HQ
- all other operations (NAT, UTM, etc.) will be performed in HQ
Does it make sense to build an SD-WAN in HQ even if it has only one line? Most traffic and sessions will start at branches, ie. there it makes sense to me. But there are applications (surveillance systems, push antivirus updates, etc.) that start the connection towards HQ-> branch. How will it behave in this case? If I don't use SD-WAN in HQ do I have to have two routes to the LAN branch in HQ with a different priority + BH? How will I define which traffic should go on which line (from HQ to the branch)? Using policy routing?
We normally use SD-WAN but in a configuration where HQ has two lines and branch has only one lines (and SD-WAN is also set here).
Thanks for explaining.
post edited by Jirka - 2020/10/17 17:03:09