# SD-WAN SLA measure then steer Source: https://ai.techclick.in/blog_fortinet_fortigate_sdwan_sla_steering Markdown: https://ai.techclick.in/blog_fortinet_fortigate_sdwan_sla_steering.md Publisher: Techclick Infosec Pvt Ltd FortiGate SD-WAN measures first: members, Performance SLA (latency / jitter / loss), then explicit application rules above the implicit catch-all. Lab wan1 203.0.113.1 / wan2 198.51.100.1. Lessons · SD-WAN SLA + strategies · SLA then steer This page vs the strategy workbook This lesson is measure the member, then put the app on an explicit rule . Manual / Best Quality / Lowest Cost / Maximize Bandwidth as a full choose-when table lives on the sibling page. Do not skip the implicit catch-all and then debug jitter on a path the rule never matched. SD-WAN SLA + five strategies · Policy lookup + NAT · FortiGate interview Hero · two members, one app, SLA decides who carries it Mood, not a wiring diagram. Exact path is in the SVG: LAN → zone virtual-wan-link → members wan1 / wan2 → Performance SLA scores each → explicit Office365 rule steers. A green interface is not an in-SLA path. Quick answer A member is one enrolled WAN or overlay inside the SD-WAN zone . A Performance SLA ( config health-check ) probes those members and marks each in-SLA or out-of-SLA against latency, jitter and packet-loss targets. It does not pick a path. An SD-WAN rule is first-match: identify the app (Internet Service / ISDB for first packet), then apply a strategy. Unmatched traffic hits the implicit rule . Lowest Cost (SLA) stays on the cheapest in-SLA member. Lab: wan1 203.0.113.1 cost 10, wan2 198.51.100.1 cost 5, health-check Office365 , SLA 100 ms / 30 ms / 1% — not the shipped 5 / 5 / 0. ## Why the ISP is up and Teams is still bad Link-up is not path quality. wan1 can ARP its gateway and still carry 40 ms of jitter on the Teams media path. FortiOS only steers on the measurements you configured — protocol, server, participants, failtime, and the SLA target. A Performance SLA with no rule consuming it is a dashboard tile. The classic ticket is first-match, not a bad circuit: - No explicit Office 365 / Teams rule — the implicit catch-all load-balances the session onto whichever member its hash picked, including the degraded one. - A dest- all explicit rule sits above the application rule. First match wins. The app rule never fires. - The health-check probes 8.8.8.8 while the app path is the Microsoft front door. In-SLA on Google is not in-SLA on Outlook. A health-check is not a steer When a Performance SLA is inactive or out-of-SLA, FortiOS will not send that health-check’s steered traffic through the failing member. Traffic that never matched an SLA-aware rule still uses the implicit algorithm. Measure, then bind the app to a rule that reads those bits. ## Members, SLA, then the rule Pre-train these four words before you open Network > SD-WAN . #### Zone Logical bundle. Firewall policies and the default static route point here (default name virtual-wan-link ). One policy, not one per ISP. #### Member One enrolled interface: wan1 , wan2 , or an IPsec overlay. Owns gateway, cost (0 = most preferred), and the sequence number used in priority-members . #### Performance SLA Active (or passive) probe per participant. Outputs latency, jitter, packet-loss, alive/dead, and bitmask sla_map . It does not steer by itself. #### SD-WAN rule First-match service: match source / dest / ISDB / app, then apply a strategy to eligible members. Miss every rule → implicit . Flow 1 · members measured, rule steers the app Zone holds members; Performance SLA scores latency jitter loss; explicit Office365 rule steers; implicit is the leftover - Branch FortiGate zone · virtual-wan-link Member 1 · wan1 cost 10 · 203.0.113.1 Member 2 · wan2 cost 5 · 198.51.100.1 SD-WAN rules first-match → strategy Implicit rule leftover · no app identity Health-check Office365 ping / http · members 1 2 latency · jitter · loss SLA target (tune) 100 ms / 30 ms / 1% shipped default 5 / 5 / 0 — too tight wan2 in-SLA cost 5 · selected for Office365 sla_map=0x1 wan1 out-of-SLA jitter above 30 ms sla_map=0x0 · skip Rule Office365 · Lowest Cost (SLA) · ISDB Microsoft-Office365 Reads sla_map. Cheapest in-SLA member = wan2. Session-sticky for the life of the flow. No match? Implicit load-balances. The SLA bits are ignored. Read left → right. The zone is the container. Probes write in-SLA / out-of-SLA. The explicit rule consumes that bitmask. Implicit never looks at the Office365 health-check. Say this out loud The health-check measures. The rule steers. The implicit rule is the leftover bucket. A member that is alive but out-of-SLA is still a valid implicit hash target unless you bound that traffic to an SLA-aware rule. Object Lab value If missing Zone virtual-wan-link Policy and static route have nowhere to point. You write one policy per WAN — that is not SD-WAN. Member 1 wan1 · gw 203.0.113.1 · cost 10 No underlay A. Cost 10 loses Lowest Cost (SLA) to wan2 when both are in-SLA. Member 2 wan2 · gw 198.51.100.1 · cost 5 No cheaper DIA. Cost 0 is “most preferred,” not “free.” Health-check Office365 · members 1 2 · server on the app path No sla_map . Lowest Cost (SLA) / Maximize Bandwidth cannot run. SLA target latency 100 ms · jitter 30 ms · loss 1% Shipped defaults 5 / 5 / 0 mark internet DIA out-of-SLA all day. Explicit rule Office365 · ISDB Microsoft-Office365 · mode sla App hits implicit. SLA is a graph, not a path. Firewall policy lan → virtual-wan-link · NAT on DIA Steering has no permit. SD-WAN is not a security policy. ## Measure then steer Order is the whole job. Skip the SLA and Lowest Cost (SLA) has nothing to read. Skip the explicit rule and the SLA has nobody to talk to. Path · SLA diamond, then steer or skip Feel of the branch: measure first, then pick the member. Exact gates — first-match, then strategy, then in-SLA — are in the next SVG. Artwork labels are not FortiOS field names. Flow 2 · one Office 365 session through path select Match explicit rule, read SLA map, Lowest Cost picks cheapest in-SLA member, else implicit LAN session 10.20.20.40 → O365 Rule match? ISDB / app first Implicit hash · ignore SLA In-SLA? sla_map on members Skip wan1 out-of-SLA · not used Lowest cost? among in-SLA wan2 cost 5 · selected Safe go-live: members → health-check → tune SLA → explicit ISDB rule above implicit → prove selected Lowest Cost (SLA) and Maximize Bandwidth (SLA) require an SLA target. Manual and Best Quality do not — they can ignore the probe you just built. ISDB (Internet Service) steers on the first packet. Application Control signatures classify late — first packets may already be on implicit. A dest-all rule above Office365 is a silent steal. Treat the SD-WAN rule list like a firewall policy. Three ANDs for Office 365 on wan2: explicit rule matched, wan2 in-SLA, wan2 cheapest among in-SLA members. Miss the first AND and implicit owns the session. ## Rules vs implicit · how to steer the app SD-WAN rules are first-match, top down, same mental model as a firewall policy. The last row is not a rule you created — it is the implicit catch-all FortiOS always has. Control What it does What it does not do Explicit rule Matches source / dest / Internet Service / application, then runs a strategy on the listed members. Does not permit traffic. The firewall policy lan → zone still has to allow it. Implicit rule Everything that matched nothing. Load-balances with the algorithm on the implicit rule (source-IP, sessions, spillover, …). Does not read your Office365 SLA. Does not know Teams from bulk download. Internet Service (ISDB) First-packet identity from FortiGuard IP/port database. This is the reliable application-steering match. Not the same as Application Control signatures, which need bytes — and SSL inspection for HTTPS. Lowest Cost (SLA) Among members that meet the required SLA target, pick the lowest cost . Session-sticky. Voice-safe. Does not re-rank a live call when jitter improves on the other WAN. That is Best Quality, and it will move the call. Best Quality Re-ranks by a quality factor (latency / jitter / loss / …). SLA target optional. Unsafe for long-lived media. A “better” member mid-call is a glitch, not a win. Maximize Bandwidth (SLA) Load-shares across all in-SLA members. Will split related flows. Do not use for a single Teams meeting. ISDB first, signatures later Fortinet’s application-steering examples bind business apps (Office 365, SIP) with Lowest Cost (SLA) and recreational apps with Best Quality. For first-packet steer, set Destination to the Internet Service ( Microsoft-Office365 , Microsoft-Teams ). Application Control IDs on HTTPS without inspection classify after the session already egressed. Source: FortiOS Administration Guide — Dynamic application steering with lowest cost and best quality strategies. Shipped SLA defaults are a lab accident on DIA FortiOS SLA-target defaults are latency 5 ms , jitter 5 ms , packet-loss 0% . That is a metro Ethernet number, not an internet underlay. Lowest Cost (SLA) then sees both members out-of-SLA and you debug “SD-WAN is broken.” Tune per app — lab uses 100 / 30 / 1 for Office 365. Voice-like 80 / 30 / 1 is a design choice, not a shipped default. ## Runbook Side A / B / C Lab: LAN 10.20.20.0/24 , zone virtual-wan-link , wan1 gw 203.0.113.1 cost 10, wan2 gw 198.51.100.1 cost 5, health-check Office365 . HTTP/HTTPS DIA. Do not invent a third overlay on this page. ### Side A — underlay, zone, policy #### Enroll the members Network > SD-WAN > SD-WAN Zones — enable SD-WAN, keep zone virtual-wan-link , add wan1 and wan2 with gateways and costs. CLI: config system sdwan → config members . A member that is not in the zone is invisible to every rule. - #### Default route + firewall policy Static default whose outgoing interface is the zone , not a single WAN. Policy: srcintf=lan → dstintf=virtual-wan-link , NAT on, log all sessions. If clients still have a more-specific route out wan1 , SD-WAN never sees the packet. Source: FortiOS “Configuring the SD-WAN interface.” ### Side B — measure, then write the app rule - #### Performance SLA on the members Network > SD-WAN > Performance SLAs — create Office365 . Protocol ping or HTTP toward a server on the app path. Participants: Specify wan1 + wan2 (not every overlay you never use). Enable SLA Target. Set latency 100, jitter 30, packet-loss 1. Lowest Cost (SLA) and Maximize Bandwidth require this target; Manual / Best Quality do not. Source: Link health monitor / Performance SLA overview. - #### Explicit application rule above implicit Network > SD-WAN > SD-WAN Rules — Create New. Name Office365 . Destination: Internet Service Microsoft-Office365 (add Microsoft-Teams if that is the ticket). Strategy: Lowest Cost (SLA) . Interface preference: wan1, wan2. Required SLA target: Office365#1 . Save. Confirm it sits above any dest-all rule and above implicit. - #### Leave implicit for leftover bulk Do not “fix” implicit by pinning it to wan1. Implicit is the bucket for traffic you have not identified. Source-IP or session load-balance is fine for generic HTTPS. It is not fine for the meeting. https://192.0.2.10/ · Network › SD-WAN › Performance SLAs › Office365 Training mock · not live Network › SD-WAN › Performance SLAs › Create New ### Office365 — link health monitor Name Office365 Protocol / Server Ping · outlook.office365.com Participants Specify · wan1, wan2 Enable probe packets Enabled SLA Target 1 · Latency 100 ms Jitter / Packet loss 30 ms · 1% Cancel OK Source: FortiOS Administration Guide — Link health monitor. SLA Target is required when a rule uses Lowest Cost (SLA) or Maximize Bandwidth (SLA). Latency is calculated over the last 30 probes (default GUI hint 5 ms — overwrite it). Do not leave Update static route enabled on a SaaS-only probe unless you intend every flow to leave that member. https://192.0.2.10/ · Network › SD-WAN › SD-WAN Rules › Office365 Training mock · not live Network › SD-WAN › SD-WAN Rules › Create New ### Office365 — priority rule Name Office365 Source address all Internet Service Microsoft-Office365 Strategy Lowest Cost (SLA) Interface preference wan1, wan2 Required SLA target Office365#1 Cancel OK Source: FortiOS — SD-WAN rules lowest cost (SLA); Dynamic application steering. After OK, drag this rule above any dest-all row. Implicit stays last and unnamed. CLI mode is set mode sla with config sla pointing at the health-check. CLI — members, SLA, then the app rule config system sdwan set status enable config members edit 1 set interface "wan1" set gateway 203.0.113.1 set cost 10 next edit 2 set interface "wan2" set gateway 198.51.100.1 set cost 5 next end config health-check edit "Office365" set server "outlook.office365.com" set members 1 2 config sla edit 1 set latency-threshold 100 set jitter-threshold 30 set packetloss-threshold 1 next end next end config service edit 1 set name "Office365" set mode sla set internet-service enable set internet-service-name "Microsoft-Office365" set health-check "Office365" set priority-members 1 2 next end end ### Side C — proof - #### SLA bits diagnose sys sdwan health-check Office365 — each seq shows state(alive) , latency / jitter / packet-loss, and sla_map . In-SLA is 0x1 for target 1. Out-of-SLA is 0x0 . Dead is not the same as out-of-SLA: dead failed failtime; out-of-SLA is alive but above threshold. - #### Selected member diagnose sys sdwan service — Service(1) Mode(sla), Members listed with selected on the cheapest in-SLA seq. If Office 365 sessions still egress wan1, the rule did not match (ISDB miss, or a dest-all above it). Source: FortiOS diagnose examples on Performance SLA / service. - #### Forward traffic log Generate one Outlook session from 10.20.20.40 . Log & Report > Forward Traffic: dstintf should be wan2 while wan2 is in-SLA. If dstintf is wan1 and sla_map on wan1 is 0x0, you matched implicit or the wrong rule. Green success - diagnose sys sdwan member lists seq 1 wan1 cost 10, seq 2 wan2 cost 5. - health-check Office365 → wan2 sla_map=0x1 ; wan1 either 0x1 or 0x0 matching the live numbers. - diagnose sys sdwan service → Service Office365 Mode(sla), cheapest in-SLA member selected . - Forward log for Microsoft-Office365 shows dstintf = that selected member — not a hash onto the other WAN. ## One session after commit After the rule is saved, an Outlook session from the LAN does this: - Packet hits the firewall policy lan → virtual-wan-link . Permit is not a path yet. - SD-WAN walks explicit rules top-down. ISDB Microsoft-Office365 matches rule 1 on the first packet. - Strategy Lowest Cost (SLA) reads health-check Office365 . Members with sla_map=0x0 are skipped. Among remaining, lowest cost wins — lab: wan2 cost 5 over wan1 cost 10. - Session is sticky on that member. A later jitter spike that takes wan2 out-of-SLA can fail the member for new sessions; existing stickiness depends on SLA fail/recovery timers — do not assume mid-flow teleport. - Unmatched bulk HTTPS never entered step 2. Implicit hashed it. The Office365 SLA did not vote. Multiple health-checks on one member When a member has more than one health-check, FortiOS removes that member’s routes from the SD-WAN group only when all of those checks fail. One green probe to 8.8.8.8 will keep the member eligible even if the Office365 probe is dead. Participants should be the members you actually steer — not “All SD-WAN Members” out of habit. ## Traps + proof Proof · selected member in diagnose, not a green WAN icon Artwork. Real proof is CLI: diagnose sys sdwan health-check then diagnose sys sdwan service . A green physical interface does not mean in-SLA, and in-SLA does not mean the app matched the rule. Symptom Likely cause Proof / fix SLA graphs look healthy; Teams still on the bad ISP No explicit app rule, or dest-all above it. Implicit hashed the session. diagnose sys sdwan service — if Service(1) never lists the session’s members as selected for that ISDB, move the app rule to the top. Both members out-of-SLA on day one Left SLA target at 5 ms / 5 ms / 0%. Tune to realistic DIA numbers. Lab 100 / 30 / 1. Re-read Measure then steer. Health-check dead on one WAN only Probe server blocked on that ISP, or wrong participants. Two servers if you must distinguish “path down” from “server down.” Specify members; do not probe overlays you do not steer. HTTPS app still takes implicit for the first seconds Matched Application Control, not ISDB. Classification is late. Use Internet Service for first-packet steer. Signatures are a second identity, not a replacement. Voice glitches every few minutes on “the better circuit” Strategy is Best Quality. It re-ranks live sessions. Lowest Cost (SLA) for media. Best Quality for bulk that can move. All traffic left wan1 when Office365 SLA failed update-static-route enabled on that health-check. Out-of-SLA withdrew the member for every flow. Leave update-static-route for true underlay death. A SaaS probe should not black-hole the default route. Policy to wan1 still works in the browser Bypass. Clients never hit the zone. One policy to virtual-wan-link . Kill per-WAN policies and leftover statics. Member “selected” but sessions black-hole No route / gateway on that member. Steering picked a next-hop the RIB does not have. get router info routing-table all . SD-WAN is not a substitute for a usable default via the zone. Pilot checklist - Zone virtual-wan-link has wan1 cost 10 and wan2 cost 5. Default route and lan policy point at the zone. - Health-check Office365 participants are those two members. SLA target is tuned, not 5 / 5 / 0. - Explicit ISDB rule Office365, Lowest Cost (SLA), required target Office365#1, above dest-all, above implicit. - diagnose sys sdwan health-check Office365 shows sla_map bits that match the live latency/jitter/loss. - diagnose sys sdwan service shows the cheapest in-SLA member selected. Forward log dstintf agrees. - A synthetic dest-all browse still uses implicit — that is leftover, not a bug. The meeting must not. ## Knowledge check Six judgment calls on measure-then-steer — not menu trivia. Q1 Both WAN icons are green. Teams media still egresses the jittery wan1 . Performance SLA Office365 exists. First check? Raise the SLA latency target — green icons mean the probe never ran. Whether an explicit Teams/Office365 rule sits above the implicit catch-all, and whether that rule’s sla_map actually selected a member. Disable NAT so SD-WAN can see the real client. Set both member costs to 0 so Lowest Cost has nothing to compare. Correct: b . A health-check does not steer. Implicit ignores SLA. Re-read Why the ISP is up and Members, SLA, then the rule. Q2 Members are enrolled. Health-check is in-SLA on both. The only SD-WAN rule is implicit. What happens to Outlook? Implicit load-balances with no app identity. The SLA bits are not consulted. FortiOS auto-builds a Lowest Cost (SLA) rule from any health-check named after a vendor. In-SLA members are pinned; implicit becomes Lowest Cost automatically. Outlook is dropped until you add an explicit rule. Correct: a . Implicit is the leftover bucket. Measure, then write the app rule. Re-read Rules vs implicit. Q3 You create a Lowest Cost (SLA) rule and leave the SLA target at FortiOS shipped defaults on two internet DIA members. Likely result? Defaults are 100 ms / 30 ms / 1% — internet-ready, no change needed. Defaults are 0 ms / 0 ms / 0% — every probe is in-SLA. Defaults are 5 ms / 5 ms / 0%. Both members often go out-of-SLA on real DIA; tune before you blame the circuit. Lowest Cost (SLA) ignores the target unless Best Quality is also on. Correct: c . Official SLA-target defaults are 5 / 5 / 0. Lowest Cost (SLA) requires that target. Re-read Measure then steer and the defaults callout. Q4 wan1 cost 10, wan2 cost 5, both in-SLA. Teams must stay on one path for the life of the meeting. Strategy? Best Quality — it will hop to whoever is slightly better every probe. Lowest Cost (SLA) — cheapest in-SLA member, session-sticky. Lab result: wan2. Maximize Bandwidth (SLA) — split the call across both ISPs for quality. Implicit source-IP hash — that is the documented voice strategy. Correct: b . Lowest Cost (SLA) is the voice-safe explicit strategy. Best Quality re-ranks; Maximize Bandwidth splits. Re-read Rules vs implicit and Flow 2. Q5 A junior matches Office 365 with Application Control signatures only, no Internet Service. The first packets already left on wan1. Why? Signatures classify late (and HTTPS needs inspection). ISDB steers on the first packet; use Internet Service for the rule match. Application Control always matches before implicit — the first packet cannot miss. You must set member cost to 0 for signatures to fire. Performance SLAs replace ISDB when the server FQDN contains “office.” Correct: a . First-packet application steering is ISDB. Re-read Flow 2 and the ISDB callout. Q6 What is green proof that Office 365 is steered, not merely measured? Both physical WAN LEDs are lit. The Performance SLA widget shows a latency graph. get sys status includes sdwan. diagnose sys sdwan health-check shows sla_map, and diagnose sys sdwan service shows the cheapest in-SLA member selected — matching the forward-log dstintf. Correct: d . Graphs and LEDs are not path select. Re-read Side C and Traps + proof. Check answers Reset ## Sources - FortiOS Administration Guide — Link health monitor (latency / jitter / loss; SLA target required for Lowest Cost and Maximize Bandwidth; last-30-probe latency/jitter; last-100-probe loss) - FortiOS Administration Guide — Performance SLA overview (participants must be members; active vs passive; SLA target defaults 5 ms / 5 ms / 0%) - FortiOS Administration Guide — Implicit rule (unmatched traffic; load-balance algorithms; default route via the SD-WAN zone) - FortiOS Administration Guide — Dynamic application steering with lowest cost and best quality strategies - FortiOS Administration Guide — SD-WAN rules — lowest cost (SLA) ( set mode sla ; cost 0 = most preferred) - FortiOS CLI — config system sdwan / config health-check / config sla / config service ; diagnose sys sdwan health-check · diagnose sys sdwan service Related: SD-WAN SLA + five strategies · SD-WAN + ZTNA · Policy lookup + NAT · FortiGate interview · Troubleshooting command center --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt