SD-WAN Fundamentals on FortiGate

Combine multiple WAN links into one intelligent interface with health checks and rules.

What SD-WAN solves

Most sites have more than one internet link (e.g. fiber + LTE). FortiGate SD-WAN aggregates them into a single logical interface and steers traffic intelligently based on link quality and business policy — instead of static, failover-only routing.

Building blocks

SD-WAN members — the physical/VLAN interfaces (your WAN links).

Performance SLA (health checks) — probes (ping, HTTP, DNS) that measure latency, jitter, and packet loss per link.

SD-WAN rules — steer specific traffic to the best link by SLA, lowest cost, or manual preference.

config system sdwan
    set status enable
    config health-check
        edit "ping-google"
            set server "8.8.8.8"
            set members 1 2
        next
    end
end

Steering strategies

Lowest cost (SLA) — use any link meeting the SLA, preferring cheaper ones.

Best quality — always pick the link with the best measured metric for sensitive apps like VoIP.

Manual — pin an application to a specific link.

What it means for you

SD-WAN turns "backup link that sits idle" into active, measured capacity with automatic failover in under a second when a link degrades. It is a core infrastructure skill and a growing part of the NSE 4 blueprint.