# SD-WAN Configuration and Optimization

> Chapter 11 of the Courseiva FORTINET-NSE7 curriculum — https://courseiva.com/learn/fortinet-nse7/sd-wan-configuration-and-optimization

**Official objective:** 5.1 — Configure SD-WAN rules, load balancing, and performance SLA

## Introduction

SD-WAN (Software-Defined Wide Area Network) solves the problem of managing multiple internet connections across different office locations so that critical applications like video calls and databases always run smoothly, even when one connection gets slow or breaks. For the NSE7 exam, you must understand how to configure the rules that decide which traffic uses which link, how to balance load across links, and how to set performance thresholds that automatically switch traffic when a connection fails to meet its promised speed or reliability.

## The Food Truck Coordinator Analogy

A busy city food truck market with five food trucks and hundreds of hungry customers.

A coordinator, Alex, watches the crowd from a small booth with a whiteboard. The trucks have two main connections to the market: a paved road (MPLS) that is fast and reliable but costs money per trip, and a gravel alley (broadband internet) that is slower and sometimes blocked by deliveries but costs almost nothing.

Alex's job is to decide which truck each customer should visit. A customer who wants a custom burger that takes ten minutes gets sent to the paved-road truck, because the connection is stable for the long wait. A customer who just wants a pre-wrapped sandwich gets sent to the gravel-alley truck, because the order is quick and the cheaper connection handles it fine.

But Alex doesn't just guess. He checks the "health" of each route every few seconds. If the gravel alley is blocked by a garbage truck (packet loss), he moves all traffic to the paved road. If both routes are open but the paved road is getting too many customers (bandwidth saturation), he balances half the long-order customers to the gravel alley anyway, because a slightly slow sandwich is better than no sandwich.

Alex also writes rules on his whiteboard. "Any customer asking for a gluten-free wrap goes to the paved road, always. Any customer in a hurry always gets the fastest available route." That is SD-WAN: a smart coordinator constantly checking performance and applying business rules to choose the best path for every single application's traffic.

## Core explanation

SD-WAN stands for Software-Defined Wide Area Network. Let's break that down. A Wide Area Network (WAN) is a network that connects computers and devices over a large geographic area, like connecting an office in London to an office in New York. Traditionally, companies used a single type of connection, often MPLS (Multiprotocol Label Switching), which is a private, expensive, and very reliable leased line from a telecom provider.

The problem with traditional WANs is that they are rigid. If a company has two internet links (say, MPLS and a standard broadband fibre line), the network cannot intelligently choose which one to use for each type of data. It might send a large video conference call over the expensive MPLS even when the cheap fibre is perfectly fine. Or it might send a critical database backup over the cheap fibre, and when that fibre gets congested, the backup fails.

SD-WAN fixes this by adding a software "brain" (the controller) that sits on top of the physical connections. This brain can see all the links in real time and apply rules about which traffic goes where. The core components are:

- **SD-WAN edge device:** This is a router or firewall installed at each branch office. It connects to the controller and to the physical links (MPLS, broadband, 4G/5G).
- **SD-WAN controller:** This is the central management platform (often cloud-based or a virtual machine) that sends configuration and policy rules to all edge devices. The controller does not touch the data itself; it just tells the edges what to do.
- **Underlay network:** This is the actual physical infrastructure — the cables, fibre, and cellular towers that carry the data. It includes your MPLS links, broadband internet, and LTE connections.
- **Overlay network:** This is the virtual, software-defined network built on top of the underlay. The edge devices create encrypted tunnels (like secure VPNs) between each other over the underlay. The overlay is what sees the rules and makes smart decisions.

Now, how does SD-WAN actually decide where to send traffic? It uses three main tools: SD-WAN rules, load balancing, and performance SLAs.

**SD-WAN Rules**
These are if-then statements. The IT administrator writes a rule that says: "If the application is Microsoft Teams voice, then use the best-performing link available and never use the 4G backup." Or "If the application is large file backup, then use the cheapest link available, and if that link fails, don't switch to an expensive link." Rules can check things like the destination IP address, the port number (which indicates the type of service), or the application signature (Fortinet's FortiOS can recognise hundreds of applications by their traffic patterns).

**Load Balancing**
This determines how traffic is distributed across multiple links when no specific rule overrides the choice. There are several strategies:

- **Volume-based (or sink-based):** The system divides traffic into flows (a flow is a single conversation between two devices, like one web page load). It sends each flow to a link based on a simple ratio. For example, if you have two links, you send 70% of the flows to Link A and 30% to Link B.
- **Session-based (or least load):** The system looks at the current utilisation of each link. It sends the next new flow to the link with the lowest current usage. This is more dynamic than volume-based.
- **Source-destination IP hash:** The system uses a mathematical formula based on the source and destination IP addresses. This ensures that all traffic from a particular office to a particular server always uses the same link, which can be important for stateful applications (like a database that remembers session state).

**Performance SLA (Service Level Agreement)**
This is a monitoring and enforcement tool. You, as the administrator, define a set of performance thresholds that a link must meet. Common metrics are:

- **Latency:** How long a packet takes to travel to a destination and back (measured in milliseconds).
- **Jitter:** The variation in latency over time. High jitter is terrible for voice and video calls.
- **Packet loss:** The percentage of packets that never arrive at the destination. Even 1% packet loss can ruin a video call.

The SD-WAN edge device constantly sends small probe packets to the destination (or to a defined target like a data centre) every few seconds. It measures the latency, jitter, and packet loss. If the values exceed the SLA thresholds you set (for example, latency above 150ms or packet loss above 0.5%), the SD-WAN system automatically marks that link as "out of SLA." It then moves all traffic that is sensitive to those metrics (like voice) to a different link that is still within SLA.

This mechanism is called **automatic failover**. It used to require manual intervention from a network engineer. With SD-WAN, the network heals itself within seconds.

Why does this matter for the NSE7 exam? The exam expects you to know exactly how to sequence these rules, which rule type takes priority (more specific rules beat general rules), and how to interpret the performance SLA statistics in the FortiGate GUI or CLI. You also need to understand that load balancing only applies when no specific SD-WAN rule matches the traffic — the rules always win first.

## Real-world context

Imagine you are the IT administrator for a retail company called "FreshGrocer" with 50 branch supermarkets across the UK. Each branch has one MPLS connection (primary, reliable, expensive) and one broadband fibre connection (cheaper, but can be slow during peak hours). The head office runs a critical inventory database and a VoIP (Voice over IP) phone system.

Here is what your day-to-day configuration looks like for SD-WAN:

**Step 1: Assess the links**
You log into the FortiGate at the head office. You see in the dashboard that each branch has two physical interfaces: "WAN1" (MPLS) and "WAN2" (Broadband). You name them clearly in the interface configuration so you don't confuse them later.

**Step 2: Define the performance SLAs**
You create a performance SLA object called "Voice-critical SLA." You set:
- Latency threshold: 100ms
- Jitter threshold: 20ms
- Packet loss threshold: 0.5%
- Probe target: the IP address of the main VoIP server at head office
- Probe interval: every 3 seconds

You also create a second SLA called "Best-effort SLA" with looser thresholds for non-critical traffic like software updates.

**Step 3: Create SD-WAN rules**
You create the following rules on the SD-WAN zone (which groups both WAN links):

- **Rule 1 (priority 1):** Application is "VoIP" or "Microsoft Teams" -> Use whichever link is currently within the "Voice-critical SLA." If both links are within SLA, use the MPLS link first.
- **Rule 2 (priority 2):** Application is "Inventory Database" -> Use the MPLS link only. This is because the database is too critical to risk the broadband link's occasional instability.
- **Rule 3 (priority 3):** Application is "Web Browsing" or "YouTube" -> Use the Broadband link only. This saves expensive MPLS bandwidth for important traffic.
- **Rule 4 (catch-all):** Everything else -> Load balance across both links using the least-load method.

**Step 4: Simulate a failure**
During a busy Friday afternoon, the broadband link at the Manchester branch starts dropping 2% of packets due to a local line issue. The FortiGate's SLA monitor detects this immediately. Because Rule 1 is set to use only links that are within the "Voice-critical SLA," and the broadband link is now out of SLA, all VoIP traffic from that branch automatically shifts to the MPLS link. The phone calls never drop. Without SD-WAN, you would have had to drive to the branch or remotely reboot the router, and every call would have been choppy for an hour.

**Step 5: Monitor and tune**
You regularly check the "SD-WAN Monitor" screen in the FortiGate GUI. You see that the MPLS link is often above 80% utilisation during the day. You add a fourth rule that says "Video streaming" should also go to Broadband only, further protecting the MPLS for the database. You also adjust the SLA thresholds for the best-effort SLA to be looser, because you noticed unnecessary failovers to MPLS for email syncs that didn't need perfect latency.

What the NSE7 exam wants you to know is the exact CLI syntax to show the SLA status (`diagnose sys sdwan sla-check`), how to order rules in the policy list (the top rule wins), and that when no specific rule matches, the system uses the load-balancing algorithm you configured under the SD-WAN zone settings.

## Exam focus

The Fortinet NSE7 exam focuses heavily on the mechanics of SD-WAN configuration and optimisation. You will not be asked theory questions about "what is SD-WAN?" — you will be given a scenario and asked to choose the correct configuration command, the correct rule order, or the correct interpretation of a performance graph.

**Key exam topics you must master:**

- **SD-WAN rule structure:** The exam loves to give you a set of three or four rules and ask which one will match a particular type of traffic first. Remember: rules are evaluated top-down. The first rule that matches the traffic is applied. A more specific rule (e.g., application = Zoom) beats a less specific rule (e.g., all UDP traffic), but only if it appears higher in the list.
- **Performance SLA configuration:** You must memorise the three core SLA metrics: latency, jitter, and packet loss. Questions will ask: "Which metric is most important for VoIP traffic?" (Jitter and packet loss are the most critical.) They will also ask which SLA threshold, when exceeded, triggers a failover.
- **Load balancing methods:** You need to know how source-destination IP hash differs from least-load. The exam often tests that source-destination IP hash keeps a session pinned to one link, which is necessary for some old applications that do not handle mid-session IP changes.
- **SD-WAN zones and members:** Understand that an SD-WAN zone is a logical group of physical interfaces. You configure rules for the zone, not for each interface individually.
- **Troubleshooting commands:** Expect at least one question like: "A customer's voice calls are dropping. Which command shows the current SLA status for each link?" The answer is `diagnose sys sdwan sla-check` or `get router info sdwan`.

**Traps the exam sets:**

- **The "implicit rule" trap:** The exam may describe a scenario where no SD-WAN rule matches the traffic. Many candidates wrongly assume the traffic will be dropped. In reality, if no rule matches, the traffic is load-balanced using the default algorithm. Know that.
- **The "SLA threshold unit" trap:** They will give you SLA values in different units (e.g., 150 ms vs 0.150 s). Always check you convert correctly.
- **The "rule priority versus rule order" trap:** FortiGate SD-WAN rules do not have a numeric priority field; they rely on the order in the list. The exam may try to confuse you by using the term "priority" in the question, but the correct answer will describe the sequential order.
- **The "load balancing applies to all traffic" trap:** Experienced network professionals sometimes forget that load balancing only applies to traffic that is not matched by an explicit SD-WAN rule. The exam will present a scenario where traffic is matched by a rule with a specific link, and a candidate might mistakenly suggest it is load-balanced.

**Key definitions to memorise:**

- **Underlay:** The physical links.
- **Overlay:** The logical VPN tunnels between SD-WAN devices.
- **SLA action:** The action taken when a link fails its SLA (usually marking it as "dead" or moving traffic away).
- **Probe target:** The destination of the performance probe packets. Usually a server or a peer router.
- **ADVPN (Auto-Discovery VPN):** A feature that creates direct tunnels between branches when needed, bypassing the hub. The exam sometimes asks whether this is part of SD-WAN optimisation (it is).

## Step by step

1. **Identify and name your physical interfaces** — On the FortiGate, you first assign each internet connection (MPLS, broadband, LTE) to a physical port and give it a clear name like 'WAN1_MPLS' and 'WAN2_Broadband'. This makes later rule configuration unambiguous.
2. **Create the SD-WAN zone and add members** — You create a logical zone under System > SD-WAN and add both interfaces as members. This zone will be referenced in SD-WAN rules and firewall policies. Without this step, the interfaces cannot participate in SD-WAN.
3. **Define performance SLA targets** — You specify a server or destination IP address to probe (the 'probe target'), set the interval (e.g., every 3 seconds), and define thresholds for latency, jitter, and packet loss. This tells the FortiGate what 'good performance' means for each link.
4. **Configure SD-WAN rules (in the correct order)** — You create rules in the SD-WAN zone policy list, placing the most specific and critical rules (like 'VoIP must use MPLS') at the top. Each rule matches an application or destination and specifies a strategy (use specific link, use best SLA link, or load balance).
5. **Set the load-balancing algorithm for unmatched traffic** — Under the SD-WAN zone settings, you choose a default load-balancing method (volume-based, session-based, or source-destination IP hash) for traffic that does not match any explicit rule. This ensures no traffic is left unhandled.
6. **Verify and test the configuration** — Use the FortiGate GUI's SD-WAN monitor or CLI commands like 'diagnose sys sdwan sla-check' and 'diagnose sys sdwan route' to confirm that traffic is flowing as expected. Simulate a link failure to ensure failover works.

## Comparisons

### SD-WAN Rule (Explicit Match) vs Load Balancing (Default)

**SD-WAN Rule (Explicit Match):**
- Only applies when traffic matches a defined application, destination, or port.
- Evaluated first in the rule order; highest-priority match wins.
- Can specify 'use best quality link' or 'pin to specific interface'.

**Load Balancing (Default):**
- Applies only when no explicit SD-WAN rule matches the traffic.
- Relies on the global algorithm set in the SD-WAN zone settings.
- Distributes new flows across all interfaces without application awareness.

### Performance SLA (Threshold) vs Link Health (Static Status)

**Performance SLA (Threshold):**
- Dynamic and measured in real time (every few seconds).
- Based on latency, jitter, and packet loss thresholds you define.
- Triggers automatic failover when thresholds are breached.

**Link Health (Static Status):**
- A simple up/down status based on whether the physical link has connectivity.
- Does not consider performance metrics like jitter.
- Only triggers failover if the link goes completely offline.

### MPLS (Private WAN) vs Broadband Internet (Public WAN)

**MPLS (Private WAN):**
- Typically more expensive with bandwidth committed in a SLA.
- Low latency and jitter, often with no packet loss.
- Ideal for real-time applications like VoIP and video conferencing.

**Broadband Internet (Public WAN):**
- Cheaper and widely available, but no performance guarantee.
- Subject to congestion, packet loss, and variable latency during peak hours.
- Suitable for best-effort traffic like web browsing and email.

### Volume-Based Load Balancing vs Session-Based Load Balancing (Least Load)

**Volume-Based Load Balancing:**
- Divides flows based on a fixed percentage ratio (e.g., 70/30).
- Does not adapt to current utilisation on each link.
- Simple to configure but can overload one link if traffic patterns change.

**Session-Based Load Balancing (Least Load):**
- Sends the next new flow to the link with the lowest current utilisation.
- Dynamically adapts as load fluctuates on each link.
- More efficient for variable traffic patterns but may cause more frequent session moves.

## Diagram

_How a branch office FortiGate uses SD-WAN to select between MPLS, broadband, and 4G links based on SLA probes sent to the head office VoIP server._

```mermaid
flowchart TD
    A[Branch Office] --> B[FortiGate Edge]
    B --> C[MPLS Link]
    B --> D[Broadband Link]
    B --> E[4G Backup Link]
    C --> F[Head Office Router]
    D --> F
    E --> F
    F --> G[VoIP Server]
    F --> H[Database Server]
    I[SD-WAN Controller] -.-> B
    I -.-> F
    B --> J[SLA Probe to VoIP Server]
    J --> K{Is SLA Met?}
    K -->|Yes| L[Use MPLS for VoIP]
    K -->|No| M[Fallback to Broadband]
```

## Common misconceptions

- **Misconception:** SD-WAN replaces the need for any physical routers or firewalls. **Reality:** SD-WAN is a software overlay that still requires physical or virtual edge devices (like FortiGate appliances) at each site to connect to the underlay links. (Beginners see 'software-defined' and assume it's all virtual, forgetting that traffic must physically enter and exit a device.)
- **Misconception:** If I set a performance SLA with a 50ms latency threshold, all traffic will automatically use the link with the lowest latency. **Reality:** The SLA threshold only determines when a link is considered 'out of SLA'. Traffic is only redirected to an in-SLA link if the SD-WAN rule explicitly says to use that link, and load balancing still distributes traffic based on the configured algorithm. (People oversimplify SLA as a 'choose the best link always' feature, but it is a passive boundary condition, not a real-time routing decision engine.)
- **Misconception:** Load balancing in SD-WAN works exactly like a home router's load balancing — it splits every single packet across links. **Reality:** SD-WAN load balancing operates per-flow (not per-packet). A flow (e.g., one web page load) is sent down one link entirely. Only different flows can use different links. (Home routers often use per-packet balancing (round-robin), which can be seen in the home broadband context, but enterprise SD-WAN must avoid packet reordering that breaks TCP connections.)
- **Misconception:** Once I configure SD-WAN rules, I can ignore the firewall policies because SD-WAN overrides them. **Reality:** SD-WAN rules and firewall policies are separate layers. Traffic must pass both checks: first, the firewall policy must allow the traffic; second, the SD-WAN rule determines which link to use. A mismatch can block traffic entirely. (Newcomers think SD-WAN is a standalone system, but FortiGate interweaves it with firewall policies, which adds complexity.)

## Key takeaways

- SD-WAN rules are evaluated top-down; the first rule that matches the traffic determines which link or strategy is used.
- A performance SLA defines latency, jitter, and packet loss thresholds that a link must meet to be considered healthy for sensitive traffic.
- Load balancing in SD-WAN is per-flow, not per-packet, meaning each complete conversation stays on one link.
- When no SD-WAN rule matches traffic, the default load-balancing algorithm in the SD-WAN zone is used.
- The FortiGate command 'diagnose sys sdwan sla-check' shows real-time SLA status for all monitored links.
- SD-WAN does not replace firewall policies; traffic must be allowed by a firewall policy before SD-WAN rules can be applied.

## FAQ

**Do I need to buy separate SD-WAN hardware, or can my existing FortiGate do it?**

Most modern FortiGate models, including the ones commonly found in NSE7 labs, have built-in SD-WAN capabilities. You do not need separate hardware; you just enable the SD-WAN feature in the FortiGate's GUI or CLI.

**What happens if all my SD-WAN links are out of SLA?**

The FortiGate will still forward traffic out of the best available link (even if all are out of SLA) rather than dropping traffic. It will mark links as out of SLA but will not block traffic entirely unless you explicitly configure it to do so.

**Can SD-WAN work with only one internet link?**

Yes, but you lose the main benefits of load balancing and failover. SD-WAN still adds application-aware routing and centralised management, but it is most valuable when you have two or more links.

**How does SD-WAN handle voice calls that are already in progress?**

SD-WAN uses 'session assist' and active monitoring. If a voice call's link starts to degrade, the FortiGate can redirect only new calls to a better link. Established calls may continue on the degraded link unless the application handles mid-call handoff (which VoIP standards like SIP re-invite support).

**Is SD-WAN the same as a VPN?**

No. SD-WAN creates encrypted overlay tunnels (which are similar to VPNs) between sites, but it is much more than a VPN. It adds intelligent routing, load balancing, and performance monitoring that a standard VPN does not provide.

**What is the difference between 'best quality' and 'load balancing' in SD-WAN rules?**

'Best quality' means the rule will dynamically select the link with the best current SLA metrics (lowest latency, jitter, and packet loss). 'Load balancing' means the rule distributes traffic across links based on a configured algorithm. You can combine both by making a rule that first checks SLA and then load-balances among links that meet the SLA.

## Check your understanding

1. **Which FortiGate command shows the current SLA status of all SD-WAN links?**

   Answer: 'diagnose sys sdwan sla-check' shows the real-time latency, jitter, and packet loss for each monitored link.

2. **What is the default action for traffic that does not match any explicit SD-WAN rule?**

   Answer: The traffic is distributed across all available links using the load-balancing algorithm configured in the SD-WAN zone settings.

3. **Name the three metrics that a performance SLA can use to determine link health.**

   Answer: Latency, jitter, and packet loss.

4. **If you have five SD-WAN rules and traffic matches both rule 2 and rule 4, which rule will be applied?**

   Answer: Rule 2, because SD-WAN rules are evaluated in order from top to bottom, and the first matching rule wins.

5. **Can SD-WAN rules use application names (like 'Microsoft Teams') instead of IP addresses?**

   Answer: Yes, FortiGate supports application control and can recognise hundreds of applications by their traffic signatures, allowing you to create rules based on application names.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse7/sd-wan-configuration-and-optimization