SD-WAN technologies are nowadays quite common solutions. Almost every distributed enterprise has a reasons to have it.
Really good example are retails companies, one of the main reasons to deploy SD-WAN is to have stable card payments. As example retailers in Poland, most have it already or planning to deploy.
I have deployed Fortinet SD-WAN and SD-Branch (switches and APs) for one of the biggest retailers in Poland, infrastructure is growing constantly, now there are more than 2000 locations connected via SD-WAN.
During last years Fortinet did massive improvment of their SD-WAN capabilities. I started my yourney with SD-WAN from FortiOS 6.2 (I guess it was 2019). They called it SD-WAN but at this time it was rather marketing than technical capabilities. For example, every firewall has something called RPF:
https://community.fortinet.com/t5/FortiGate/Technical-Note-Reverse-Path-Forwarding-RPF-implementation-and/ta-p/194382
In nutshell, inbound and outbout traffic should flow through the same interface. But with SD-WAN traffic can be distributed across different interfaces. So with 6.2, SD-WAN could distribute traffic across different interfaces/connections but reverse traffic if balanced throught different interface, was blocked by RPF, to make it work, I had to disable RPF which is not so nice from security perspective. Fortinet added proper intelligence to SD-WAN which is working correctly from 6.4 actually, basically you can configure how return traffice will behave, below details:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Auxiliary-session-amp-Asymmetric-routing-behavior/ta-p/252177
Currently I’m running PoC for next major retail player in Poland. Current FortiOS version is 7.4, so huge improvements compared to early days, couple examples:
- SLA Probe modes:
- Passive – Latency, Jitter, Packet Loss calculated from sessions (live traffic)
- Prefer Passive – if there is no live traffice, FortiGate will start to generate active probes like ping
New modes adds capability to steer traffic based on application performance and for LTE connections it can save data limits
2. FortiManager provisioning capabilities:
- SD-WAN Overlay Template – simple click-through process to create SD-WAN and everything what is needed for it (IPsec Tunnels, BGP).
Before SD-WAN Overlay Templates the only one choice to achieve similar things were scripts, huge simplifications. Overlay Templates aren’t ideal, there are still limitations (for example IPsec via MPLS lines), but still significant improvement.
b. Device Blueprint – something like device settings for pre-provisioning (Device Model), using CSV bulk device configuration can be done
3. Adaptive Forward Error Correction – FEC is used to correct errors in data transmission by sending duplicated data. Before, there was only option to duplicate data based on percenatge, now FEC can duplicate data in conjuction with Performance SLA. As packet loss increases, the number of redundant packets sent can rise accordingly
And other more enhancements:
https://docs.fortinet.com/index.php/document/fortimanager/7.4.0/new-features/470081/7-4-0
To summarize, now to deploy Fortinet SD-WAN is much easier and convenient compared to early days, of course like always, even when there is some kind of automation/simplification, deep knowledge what is happening “behind the scene” is crucial, issue always can occur…