Rise Company
16-07-2019, 23:57
فايروول فورتي جيت FortiGate Firewall قواعد دمح خطوط النت SD-WAN rules
SD-WAN rules - maximize bandwidth (SLA) vs lowest cost (SLA) vs best quality
https://youtu.be/_EgOzLoOKnA
https://www.youtube.com/watch?v=NmXEYI3bBU0
SD-WAN rules - maximize bandwidth (SLA)
SD-WAN rules are used to control how sessions are distributed to SD-WAN members. Rules can be configured in one of five modes:
auto: Interfaces are assigned a priority based on quality.
Manual (manual): Interfaces are manually assigned a priority.
Best Quality (priority): Interface are assigned a priority based on the link-cost-factor of the interface. See SD-WAN rules - best quality (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/022371/sd-wan-rules-best-quality).
Lowest Cost (SLA) (sla): Interfaces are assigned a priority based on selected SLA settings. See SD-WAN rules - lowest cost (SLA) (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/342836/sd-wan-rules-lowest-cost-sla).
Maximize Bandwidth (SLA) (load-balance): Traffic is distributed among all available links based on the selected load balancing algorithm.
When using Maximize Bandwidth mode (load-balance in the CLI), SD-WAN will all of the links that satisfies SLA to forward traffic based on a round‑robin load balancing algorithm.
https://www.rise.company/forum/images/imported/2019/07/7.png
In this example, your wan1 and wan2 SD-WAN interfaces connect to two ISPs that both go to the public internet. You want to configure Gmail services to use both of the interface, but the link quality must meet a standard of latency: 10ms, and jitter: 5ms. This can maximize the bandwidth usage.
To configure an SD-WAN rule to use Maximize Bandwidth (SLA):
On the FortiGate, enable SD-WAN and add wan1 and wan2 as SD-WAN members, then add a policy and static route. See Creating the SD-WAN interface (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/218559/creating-the-sd-wan-interface) for details.
Create a new Performance SLA named google that includes an SLA Target 1 with Latency threshold = 10ms and Jitter threshold = 5ms. See Performace SLA - link monitoring (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/478384/performace-sla-link-monitoring).
Go to Network > SD-WAN Rules.
Click Create New. The Priority Rule page opens.
Enter a name for the rule, such as gmail.
Configure the following settings:https://www.rise.company/forum/images/imported/2019/07/8.png
Field
Setting
Internet Service
Google-Gmail
Strategy
Maximize Bandwidth (SLA)
Interface preference
wan1 and wan2
Required SLA target
google#1 (created in step 2).
Click OK to create the rule.
To configure an SD-WAN rule to use SLA:
config system virtual-wan-link
config health-check
edit "google"
set server "google.com"
set members 1 2
config sla
edit 1
set latency-threshold 10
set jitter-threshold 5
next
end
next
end
config service
edit 1
set name "gmail"
set mode load-balance
set internet-service enable
set internet-service-id 65646
config sla
edit "google"
set id 1
next
end
set priority-members 1 2
next
end
end
To diagnose the performance SLA status:
FGT # diagnose sys virtual-wan-link health-check google
Health Check(google):
Seq(1): state(alive), packet-loss(0.000%) latency(14.563), jitter(4.334) sla_map=0x0
Seq(2): state(alive), packet-loss(0.000%) latency(12.633), jitter(6.265) sla_map=0x0
FGT # diagnose sys virtual-wan-link service 1
Service(1): Address Mode(IPV4) flags=0x0
TOS(0x0/0x0), Protocol(0: 1->65535), Mode(load-balance)
Members:<<BR>>
1: Seq_num(1), alive, sla(0x1), num of pass(1), selected
2: Seq_num(2), alive, sla(0x1), num of pass(1), selected
Internet Service: Google.Gmail(65646) When both wan1 and wan2 meet the SLA requirements, Gmail traffic will use both wan1 and wan2. If only one of the interfaces meets the SLA requirements, Gmail traffic will only use that interface.
If neither interface meets the requirements but health-check is still alive, then wan1 and wan2 tie. The traffic will try to balance between wan1 and wan2, using both interfaces to forward traffic.
المرجع :
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/708464/sd-wan-rules-maximize-bandwidth-sla
SD-WAN rules - maximize bandwidth (SLA) vs lowest cost (SLA) vs best quality
https://youtu.be/_EgOzLoOKnA
https://www.youtube.com/watch?v=NmXEYI3bBU0
SD-WAN rules - maximize bandwidth (SLA)
SD-WAN rules are used to control how sessions are distributed to SD-WAN members. Rules can be configured in one of five modes:
auto: Interfaces are assigned a priority based on quality.
Manual (manual): Interfaces are manually assigned a priority.
Best Quality (priority): Interface are assigned a priority based on the link-cost-factor of the interface. See SD-WAN rules - best quality (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/022371/sd-wan-rules-best-quality).
Lowest Cost (SLA) (sla): Interfaces are assigned a priority based on selected SLA settings. See SD-WAN rules - lowest cost (SLA) (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/342836/sd-wan-rules-lowest-cost-sla).
Maximize Bandwidth (SLA) (load-balance): Traffic is distributed among all available links based on the selected load balancing algorithm.
When using Maximize Bandwidth mode (load-balance in the CLI), SD-WAN will all of the links that satisfies SLA to forward traffic based on a round‑robin load balancing algorithm.
https://www.rise.company/forum/images/imported/2019/07/7.png
In this example, your wan1 and wan2 SD-WAN interfaces connect to two ISPs that both go to the public internet. You want to configure Gmail services to use both of the interface, but the link quality must meet a standard of latency: 10ms, and jitter: 5ms. This can maximize the bandwidth usage.
To configure an SD-WAN rule to use Maximize Bandwidth (SLA):
On the FortiGate, enable SD-WAN and add wan1 and wan2 as SD-WAN members, then add a policy and static route. See Creating the SD-WAN interface (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/218559/creating-the-sd-wan-interface) for details.
Create a new Performance SLA named google that includes an SLA Target 1 with Latency threshold = 10ms and Jitter threshold = 5ms. See Performace SLA - link monitoring (https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/478384/performace-sla-link-monitoring).
Go to Network > SD-WAN Rules.
Click Create New. The Priority Rule page opens.
Enter a name for the rule, such as gmail.
Configure the following settings:https://www.rise.company/forum/images/imported/2019/07/8.png
Field
Setting
Internet Service
Google-Gmail
Strategy
Maximize Bandwidth (SLA)
Interface preference
wan1 and wan2
Required SLA target
google#1 (created in step 2).
Click OK to create the rule.
To configure an SD-WAN rule to use SLA:
config system virtual-wan-link
config health-check
edit "google"
set server "google.com"
set members 1 2
config sla
edit 1
set latency-threshold 10
set jitter-threshold 5
next
end
next
end
config service
edit 1
set name "gmail"
set mode load-balance
set internet-service enable
set internet-service-id 65646
config sla
edit "google"
set id 1
next
end
set priority-members 1 2
next
end
end
To diagnose the performance SLA status:
FGT # diagnose sys virtual-wan-link health-check google
Health Check(google):
Seq(1): state(alive), packet-loss(0.000%) latency(14.563), jitter(4.334) sla_map=0x0
Seq(2): state(alive), packet-loss(0.000%) latency(12.633), jitter(6.265) sla_map=0x0
FGT # diagnose sys virtual-wan-link service 1
Service(1): Address Mode(IPV4) flags=0x0
TOS(0x0/0x0), Protocol(0: 1->65535), Mode(load-balance)
Members:<<BR>>
1: Seq_num(1), alive, sla(0x1), num of pass(1), selected
2: Seq_num(2), alive, sla(0x1), num of pass(1), selected
Internet Service: Google.Gmail(65646) When both wan1 and wan2 meet the SLA requirements, Gmail traffic will use both wan1 and wan2. If only one of the interfaces meets the SLA requirements, Gmail traffic will only use that interface.
If neither interface meets the requirements but health-check is still alive, then wan1 and wan2 tie. The traffic will try to balance between wan1 and wan2, using both interfaces to forward traffic.
المرجع :
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/708464/sd-wan-rules-maximize-bandwidth-sla