# SD-WAN: SLA steers after the member is alive

Source: https://ai.techclick.in/blog_fortigate_sdwan_sla_not_policy_route
Markdown: https://ai.techclick.in/blog_fortigate_sdwan_sla_not_policy_route.md
Publisher: Techclick Infosec Pvt Ltd

SD-WAN members, SLA health-check, then a rule. Dummy WAN1 203.0.113.10 WAN2 203.0.113.18.

## The ticket

 WAN1 is 8% loss. Users still prefer it because the rule is “manual WAN1.” SLA was never attached.

  Quick interview answer

 FortiOS 7.4 SD-WAN: put WAN interfaces in the  SD-WAN zone  (virtual-wan-link). Create a  Performance SLA  (health-check) that pings/HTTP a target. Create an  SD-WAN rule  (service) that matches apps/dest and strategy (lowest cost, best quality, SLA target). Firewall policy destination interface becomes the SD-WAN zone, not a single WAN. Policy-route is static; SLA is measured.

  Hero · two WANs

 If you do not probe, you are not doing SD-WAN.
  Lab data · dummy only
 FortiGate  fgt-hq  mgmt  10.10.10.1  · WAN  203.0.113.10  · LAN  10.20.30.0/24  · FortiManager  10.10.10.5  · FortiAnalyzer  10.10.10.6  · Priya  10.20.30.80  · branch peer WAN  198.51.100.10  · Azure VPN GW public  203.0.113.50  · AWS VGW public  203.0.113.60 . RFC 5737. Not a customer.

## Mental model

- Members = the cables.

- SLA = the thermometer.

- Rule = who uses which thermometer.

- Firewall policy = still first match, dest-intf = SD-WAN zone.

     https://fgt-hq.techclick-lab.in

     Training mock · not live

       Admin

       Dashboard  Policy  VPN  Network

       Network → SD-WAN → Performance SLAs

### SLA-Internet

        Protocol  Ping

  Server  1.1.1.1

  Participants  WAN1, WAN2

  Targets  latency 100ms  loss 2%

  Used by  Rule 1 — default / SaaS

        Cancel  Save

   FortiOS 7.4 SD-WAN Performance SLA. Training mock.

## How to choose

   Need  Tool

  Always this WAN, no measure  Policy route / manual strategy
  Prefer cheapest if healthy  SLA + lowest cost
  Voice on best quality  SLA + best quality / sla-target

## Runbook

- #### Side A — members WAN1 203.0.113.10, WAN2 203.0.113.18 in SD-WAN zone.

- #### Side B — SLA + rule Ping 1.1.1.1 from both. Rule: dest all, strategy Lowest Cost (SLA), interface preference WAN2 then WAN1.

- #### Side C — policy LAN → SD-WAN zone ACCEPT + NAT. Not LAN→WAN1 only.

  Is the SLA alive?  diagnose sys sdwan health-check
# SLA-Internet  1.1.1.1
#   WAN1: packet-loss=8%  latency=40  status: dead
#   WAN2: packet-loss=0%  latency=18  status: alive

diagnose sys sdwan service
# service 1  sla mode  members: WAN2

## Four failures

### 1 · Policy still to WAN1

 SD-WAN rules never see the packet.

### 2 · SLA with no probe reachability

 Both members dead — traffic blackholes if you required SLA.

### 3 · Health-check via the wrong member

 Probe must be sourced per member.

### 4 · Confusing SD-WAN rule with firewall policy

 Both exist. Rule steers. Policy allows.

## How to prove it

  Close only when

 1) Health-check shows WAN1 dead / WAN2 alive. 2) Session egress is WAN2. 3) Firewall policy dest-intf is the SD-WAN zone.

## Traps

   Looks like SD-WAN  Is actually

  Two defaults, no SLA  ECMP / policy route
  Green members, users on the bad link  Rule strategy = manual

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       SD-WAN SLA is…

           A measured health-check
           A VIP
           A VDOM
           Implicit deny

       Correct:  a . Concept.

       Q2
       Firewall policy for SD-WAN users should dest-intf…

           A single WAN you hope is up
           The SD-WAN zone
           ssl.root
           FAZ

       Correct:  b . Failure 1.

       Q3
       Both SLAs dead and strategy requires SLA. Risk?

           Blackhole
           Automatic VIP
           FMG install
           Faster Facebook

       Correct:  a . Failure 2.

       Q4
       Policy route vs SD-WAN SLA?

           Policy route is static; SLA measures and can move
           They are identical
           SLA replaces firewall policy
           Policy route is IPsec only

       Correct:  a . Interview.

       Q5
       Proof WAN1 is unused because of loss?

           diagnose sys sdwan health-check + session egress WAN2
           get system status
           A new any-any
           Reboot FMG

       Correct:  a . Runbook.

       Q6
       SD-WAN rule vs firewall policy?

           Rule steers members; policy still allows/denies
           Rule deletes implicit deny
           Policy is unused
           They share one table

       Correct:  a . Failure 4.

       Check answers
       Reset

  FortiGate class series:   FGT / FMG / FAZ  ·  First day  ·  Policy first match  ·  SNAT vs VIP  ·  Profiles + SSL  ·  debug flow  ·  IPsec S2S  ·  SSL-VPN vs RA  ·  SD-WAN SLA  ·  VDOM  ·  FGCP HA  ·  Interview

## Sources

- FortiOS 7.4 — SD-WAN (members, performance SLA, rules) .

 Related:  FortiGate session factory  ·  VPN series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt