My FortiGate SDWAN Configuration and Some Use Cases

SD-WAN is finally getting to where it needs to be thanks to FortiOS 6.4.1
I do not recommend running 6.4 on production yet but so far it has worked fairly flawlessly on my home unit.

In this video I discuss why SD-WAN is useful and the various cases where you can use it to better your organization. I also go into an overview of my relatively simple setup to help folks grasp the functionality and idea of it all.

My Other Projects:

###### SOCIAL LINKS ######
######################

[FortinetGuru]

How do you utilize SD-WAN? Tell us below!

[ciscco]

SD-something traditionally means control plane and data plane separation, one of the main pillars of SDN. In Fortinet solution, control plane and data plane are not separated. This means that Fortinet solution is just a mechanism of automated policy-based traffic distribution between WAN links. All the features of SDWAN (ZTP, ABR, visibility and automation, etc) existed before SDWAN. But this doesn't mean that we should call them SDWAN now.

[richcarroll]

the cable modem had ping variation of 2ms why you talking crap about it.

[mohammedmustafaali]

really cool video, would love to see IPsec implementation on top of SDWAN that would be a very cool topic, , thanks

[chrism]

OK, so external interface names replaced with SDWAN names, easy enough for routing traffic out.

With incoming traffic just replace the external interface name with SDWAN too ?

[Nsadheo]

@ 7:07 - "If the fibre link had to fail it wouldn't use that policy it would use the link that's still existing."
So if it wouldn't make use of the SD-WAN rule 1 then what would hosts on the PRUETT_LAN make use of then?

[Phillipscocina]

Question, if I want to set up a fortigate firewall and switch for my home network do I need to get enterprise grade internet to get the gateway IP, WAN IP etc?

[LucSVK]

Hey, if you don't recommend 6.4 for production environment (is it true even now with 6.4.3?) and you hate 6.2, what version do you use for client installations? Btw, very good video. Thanks a lot.

[JoeyGarcia]

Hey Mike! So...it's been months since video and 6.4 is up to 6.4.4 now, would you consider it stable for production now?

[drawingtest-zo]

is it possible that i can use the other WAN for usage of specific windows server?

[ibrahimsobhy]

why u do not do a full explanation to FortiGate as a full series ??

[jong]

Good video! We use SD-WAN simply as a fail-over between two WAN connections on 6.0.9. SSLVPN and site-to-site tunnels are tied to the IPs, and it doesn't seem to let you tie them to the virtual SD-WAN interface instead, so when primary goes down, so do the tunnels, but internet for the office stays up! Maybe you know a better way around this?
Do you have any guides on how to implement split-tunneling for SSLVPN traffic? I found the cookbook to be kind of lacking.

[Schumdog]

Nice video, I just implemented SD wan with three WAN links, it works very well and much neater than policy routes to specify where the traffic goes, another amazing benefit is the redundancy that is completely worry-free and automated now.

[BobbyBike]

From 6.4.x series, beware of 6.4.5 Fortigate Issue 672925, titled: "Traffic cannot pass through IPsec tunnel after being offload to NPU." Causes some issues mainly with ESP packets inside such IPSec (tunnel in tunnel.. I know)
6.4.4 is stated to be free of this defect, the fix is supposed to be in 7.0

I still see 6.4.x series being verry buggy.

[Alkfan]

Hey Mike! Fantastic video! I had no idea what SD WAN meant before watching this video. Can you expand on how this eliminates the needs for a private line or MPLS network? You mentioned a business can purchase a consumer grade link instead. Thanks for the info!

[TheBomb]

So, if the preferred link goes down the implicit rule catches the traffic and routes said traffic out the other link?

[DannyMaas]

So, changed your mind about SD-WAN? it's pretty easy on a Fortigate. ;-)

[nathaniellagos]

How can I setup the priority of my SD-WAN members if I only wanted my Wan1 (Fiber) to be active and my Wan2 (Coax) to be failover. I swear the functionality was on my FG GUI during version 6.2 or 6.0 I believe.

[derasnan]

Hey Mike. Bit of a blast from the past, but, great vid!
Just set this up on my home network with 7.2, which looks and works very similarly. Have you played with 7.2 much yet?

[eltonribeiro]

Thanks for the video. what fortigate model with an affordable price tag, would you advise to someone (just trying to learn firewall for the 1st time) for a home network with up to 3-4 people with access to the network?