Fortinet · FortiOS 7.4 · Lesson 9 of 12

SD-WAN: SLA steers after the member is alive

Two WANs. You want Office 365 on the good link. A static policy-route to WAN1 does not measure packet loss. SD-WAN members + SLA health-check + an SD-WAN rule does. If you skip the health-check, you built a pretty policy route.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Add members under a virtual-wan-link / SD-WAN zone.
Build an SLA (latency/jitter/loss) against a probe.
Write an SD-WAN rule that uses that SLA.
Prove with diagnose sys sdwan service / health-check.

The ticket

WAN1 is 8% loss. Users still prefer it because the rule is “manual WAN1.” SLA was never attached.

Quick interview answer

FortiOS 7.4 SD-WAN: put WAN interfaces in the SD-WAN zone (virtual-wan-link). Create a Performance SLA (health-check) that pings/HTTP a target. Create an SD-WAN rule (service) that matches apps/dest and strategy (lowest cost, best quality, SLA target). Firewall policy destination interface becomes the SD-WAN zone, not a single WAN. Policy-route is static; SLA is measured.

Two WAN links with an SLA probe choosing the healthy path — If you do not probe, you are not doing SD-WAN.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

Members = the cables.
SLA = the thermometer.
Rule = who uses which thermometer.
Firewall policy = still first match, dest-intf = SD-WAN zone.

https://fgt-hq.techclick-lab.in

Training mock · not live

Admin

DashboardPolicyVPNNetwork

Network → SD-WAN → Performance SLAs

SLA-Internet

Protocol

Ping

Server

1.1.1.1

Participants

WAN1, WAN2

Targets

latency 100ms loss 2%

Used by

Rule 1 — default / SaaS

FortiOS 7.4 SD-WAN Performance SLA. Training mock.

How to choose

Need	Tool
Always this WAN, no measure	Policy route / manual strategy
Prefer cheapest if healthy	SLA + lowest cost
Voice on best quality	SLA + best quality / sla-target

Runbook

Side A — members
WAN1 203.0.113.10, WAN2 203.0.113.18 in SD-WAN zone.
Side B — SLA + rule
Ping 1.1.1.1 from both. Rule: dest all, strategy Lowest Cost (SLA), interface preference WAN2 then WAN1.
Side C — policy
LAN → SD-WAN zone ACCEPT + NAT. Not LAN→WAN1 only.

Is the SLA alive?

diagnose sys sdwan health-check
# SLA-Internet  1.1.1.1
#   WAN1: packet-loss=8%  latency=40  status: dead
#   WAN2: packet-loss=0%  latency=18  status: alive

diagnose sys sdwan service
# service 1  sla mode  members: WAN2

Four failures

1 · Policy still to WAN1

SD-WAN rules never see the packet.

2 · SLA with no probe reachability

Both members dead — traffic blackholes if you required SLA.

3 · Health-check via the wrong member

Probe must be sourced per member.

4 · Confusing SD-WAN rule with firewall policy

Both exist. Rule steers. Policy allows.

How to prove it

Close only when

1) Health-check shows WAN1 dead / WAN2 alive. 2) Session egress is WAN2. 3) Firewall policy dest-intf is the SD-WAN zone.

Traps

Looks like SD-WAN	Is actually
Two defaults, no SLA	ECMP / policy route
Green members, users on the bad link	Rule strategy = manual

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview

Sources

FortiOS 7.4 — SD-WAN (members, performance SLA, rules).