As a engineer I would like to know in details what is happening behind the scene. Even, in my job it is mandatory, to have capability to troubleshoot some issues, during almost every implementation I’m facing some issue, this is real world, at the slides everything is perfect always 🙂
Fortinet SD-WAN configuration is quite easy from single device perspective. Generally Performance SLA monitors links quality, than using SD-WAN rules traffic can be steered based on link quality or manually. What is the logic behind this? How to find core issue when traffic is not hitting desired route?
In my simple scenario I’m monitoring IP 172.30.248.253 for link quality (Packet Loss, Latency and Jitter).
SD-WAN strategy is Best Quality and quality criteria is Latency. SD-WAN will use one of available IPsec connections, based on Latency, the best link at the moment will be used.
How it looks like from CLI perspective, to check SLA Performance metrics there is a command diagnose sys sdwan health-check, we can see link metrics details and SD-WAN member state (dead or alive).
Every SD-WAN member (interface) has its sequence number, it can be checked via command diagnose sys sdwan member
To check SD-WAN rules issue a command diagnose sys sdwan service. In my example, members 5 and 8 meets SLA (marked selected), first in the list is used to send traffic. My strategy is Best Quality, so when member 5 latency will decrease 10% below latency of member 8, than member 8 will be used to send traffic.
Actually, based on Performance SLA and SD-WAN rules, firewall adds Policy Based Routing entries, to check it out – diagnose firewall proute list
vwl_mbr_seq – here we can see list of interfaces used to steer traffic, member 5 and 8 is listed, the same interfaces like from command diagnose sys sdwan service. To find out which SD-WAN interface is used for specific traffic, we have to check it under sessions. First, create filter to see only intersting traffic diag sys session filter and to see sessions, issue a command diag sys session list
In example above, SD-WAN member 5 was used (sdwan_mbr_seq=5) and traffic was matched to second SD-WAN rule (sdwan_service_id=2). We have to bare in mind to make PBR working, below conditions have to be meet:
- routing – my SD-WAN rule 1 is used to steer traffic to destination 10.2.0.0/16. To make PBR working, still relevant routes are necesseary in FIB, in my case I use BGP, get router info routing table bgp
- specific flag (fw_flag) 10000000 need to be added to interface during firewall boot process, I faced a bug where randomly firewall assigned wrong flags and interface cannot be used as SD-WAN member, it can be check via diag netlink interface list
