Image by: Brett Sayles

Table of contents

SD-WAN revolution in modern networking

Did you know 74% of enterprises now prioritize cloud connectivity as their primary WAN objective? Traditional router-centric approaches simply can’t deliver the agility modern businesses require. FortiOS-powered Software-Defined Wide Area Networking (SD-WAN) transforms legacy infrastructure into an intelligent, application-aware fabric. This technical walkthrough guides network administrators through implementing Fortinet’s latest FortiOS SD-WAN capabilities – from initial interface configuration to advanced traffic engineering for SaaS applications. You’ll master the sequence for defining health checks, building performance-based routing rules, and implementing real-time monitoring – all critical for maintaining business continuity as organizations adopt software-defined architectures.

Pre-deployment checklist and topology planning

Before touching the CLI, document your current WAN characteristics. Inventory all physical interfaces (ISP links, MPLS circuits), VPN tunnels, and bandwidth allocations. Determine critical applications needing prioritization – Microsoft 365, Salesforce, or custom SaaS platforms. FortiOS requires:

• Minimum FortiOS 7.0.5 (7.4 recommended for full feature set)
• Dedicated interfaces for each WAN connection
• Public IPs for health-check destinations
• Baseline traffic metrics (peak utilization, latency thresholds)

“Document asymmetric routing paths before implementation to avoid blackhole scenarios during cutover,” advises network architect Jane Ellis of Forrester.

Create a rollout plan with maintenance windows. Test failover behavior using non-production interfaces first. Remember: SD-WAN implementation impacts firewall policies and NAT rules – update them to reference SD-WAN zones instead of physical interfaces.

Configuring interface members and SD-WAN zones

Begin by defining SD-WAN members under Network > SD-WAN > Interface Members. Add each physical or virtual interface participating in your SD-WAN fabric. For dual-WAN FortiGate 100F models:

1. Enable “Software Switch” on port1 and port2
2. Assign both interfaces to a new SD-WAN zone (e.g., “WAN_Zone”)
3. Set cost metrics based on bandwidth (e.g., 50Mbps link = cost 10, 100Mbps = cost 5)

Zones group links with similar properties. Create separate zones for MPLS circuits, broadband links, and LTE failover. Critical note: Interface members must have gateway monitoring enabled for health checks to function. Use this template for zone properties:

Establishing performance SLAs and health monitoring

Performance SLAs drive intelligent path selection. Navigate to SD-WAN > Performance SLAs to create probes measuring:

• Latency (critical for VoIP)
• Jitter (threshold: 30ms max)
• Packet loss (target: <0.5%)
• MOS scores for voice quality

Best practice: Configure at least three geographically dispersed ITU-compliant servers per SLA. For Microsoft 365 prioritization, use Microsoft’s recommended endpoints:

1. Create “O365_SLA” with protocol HTTP
2. Target URL: outlook.office365.com
3. Set sensitivity to “High” (measurements every 500ms)

Critical parameters include timeout (2000ms), diffserv code (CS6 for priority), and threshold violations required before link demotion (default: 3). Testing methodology matters – ICMP probes suffice for basic health, but HTTP/S mimics actual application behavior.

Advanced traffic shaping for SaaS optimization

With cloud adoption accelerating, shaping SaaS traffic prevents bandwidth starvation. Implement application-aware policies in three stages:

“FortiOS 7.4 introduces AI-driven SaaS identification – use it to auto-classify 8000+ applications without manual signatures,” notes Fortinet Technical Account Manager David Reed.

1. Create traffic shaping policy under Policy & Objects > Traffic Shaping
2. Set guaranteed bandwidth for critical apps (e.g., Salesforce=15Mbps minimum)
3. Apply application control signatures for granular identification
4. Enable “Priority Queuing” with DSCP tagging for Teams/Zoom

Leverage per-IP shaping for high-density branches. Combine with SD-WAN rules to route shaped traffic through preferred links. For VoIP, implement LLQ (Low Latency Queuing) to guarantee:

• Voice: 256Kbps guaranteed
• Video conferencing: 1.5Mbps
• Best-effort data: Burstable remainder

Building intelligent SD-WAN rules

SD-WAN rules enforce business intent. Go to SD-WAN > Rules and build policies sequentially:

1. High-priority rules first: VoIP and critical SaaS
2. Application-based rules: O365, SAP, custom TCP ports
3. Default catch-all rule: Balance across all links

For Microsoft 365 traffic:

Source:            LAN_Subnets
Destination:       O365_Microsoft
SLA:               O365_SLA (require MOS > 4.0)
Strategy:          Lowest cost + SLA compliance
DSCP Tag:          CS3

Prioritize active-active topologies for critical apps while using cost-effective links for backups. Test rules using the “diag sys sdwan service” command to verify path selection logic. Remember: Rules higher in the list override lower ones – order matters exponentially.

Operational monitoring and troubleshooting

FortiOS delivers comprehensive analytics via SD-WAN > Performance Monitor. Key metrics to track:

• Per-link SLA compliance rates (target: 99.9%)
• Application-specific latency distribution
• Automatic failover history
• QoE (Quality of Experience) heatmaps

Diagnose issues with command-line tools:

1. diag sys sdwan health-check: Verify SLA probe results
2. get system performance sla: View real-time path metrics
3. diagnose debug application fnbamd -1: Deep-dive session distribution

Integrate with FortiAnalyzer for historical trend analysis. According to Gartner’s latest report, organizations using integrated SD-WAN analytics resolve outages 67% faster. Set SNMP traps for SLA threshold breaches and automate alerts for sustained packet loss >2%.

Frequently asked questions

Conclusion

This technical walkthrough demonstrates how FortiOS transforms disparate WAN connections into an intelligent SD-WAN fabric. By methodically implementing interface zones, performance SLAs, traffic shaping, and application-steering rules, network administrators achieve unprecedented control over business-critical traffic. Remember: Continuous monitoring via FortiOS dashboards ensures sustained optimization. To explore advanced SD-WAN capabilities, see our implementation case studies. Begin with non-critical traffic, validate SLA behaviors, and progressively migrate applications – your optimized cloud-ready network awaits.