Fortinet FCSS_SDW_AR-7.4 - FCSS - SD-WAN 7.4 Architect

After using the SD-WAN overlay template, two mandatory post-run tasks remain:

"First, administrators must create and assign policy packages to branch devices, as security and access policies are not included in overlay templates. Second, SD-WAN rules must be configured so that traffic can be matched and steered appropriately through the established overlays. Neglecting either task results in ungoverned traffic or inefficient routing, undermining the benefits of SD-WAN."

Templates automate topology, but policy and rule definition are critical for operational effectiveness.

This configuration demonstrates a typical IPsec setup for SD-WAN overlays where the hub side requires a manually defined tunnel IP address, and the spoke can be flexibly configured, including interoperability with third-party IPsec devices. As described in the Fortinet SD-WAN Architect Guide: “For some overlays, the tunnel interface IP is configured statically on the hub side, which allows more control over overlay subnetting and facilitates the use of user-defined overlay IP addresses. This approach is also a requirement for compatibility with non-FortiGate endpoints, such as third-party IPsec devices that may not support dynamic address assignment via IKE or proprietary mechanisms.” This enables hybrid SD-WAN environments and advanced designs involving external partners or cloud services. Overlay IP flexibility is critical for route control and segmentation.

MSSPs typically keep SD-WAN hubs in their infrastructure for cost and management efficiency. However:

"If the customer requires Secure Internet Access (SIA) with centralized breakout—meaning all internet-bound traffic must pass through the customer’s premises for compliance or inspection—the hub must be installed locally. Similarly, if there is a large volume of traffic between the customer’s branches that would overwhelm a cloud-based hub or require low-latency, local hub placement is necessary."

This ensures policy enforcement and optimal performance for specific customer needs.

Traffic steering decisions in SD-WAN are based on both SD-WAN member priorities and route metrics. The guide states:

"If HUB1-VPN3 has a higher member configuration priority (lower numerical value) or a route with a lower priority value (which actually represents higher precedence in routing), it will be chosen over HUB1-VPN1, even if an SD-WAN rule would otherwise match HUB1-VPN1. These dual factors—member configuration and route table priority—govern traffic egress decisions."

Administrators should carefully align route and SD-WAN member priorities for predictable path selection.

In FortiOS SD-WAN configurations, when setting up Direct Internet Access (DIA) using the GUI, you cannot select applications as thedestinationin SD-WAN rules. The destination field in these rules is designed for IP subnets or address objects only, due to how DIA policies are structured within FortiOS. This is a platform limitation: while application steering is supported forsourceor for application-aware routing, the destination field in DIA scenarios does not accept applications. Therefore, the GUI does not present the option, and administrators must instead define DIA SD-WAN rules by specifying IP addresses or address objects for destinations. This restriction helps maintain rule clarity and performance efficiency in large deployments.

SD-WAN rules often rely on application detection. As the guide notes:

"If the initial session tuple does not match any existing entry in the ISDB (Internet Service Database) application cache, FortiGate may not immediately recognize the application. Furthermore, if routing information cannot be refreshed after application detection, the session will continue to be handled by the implicit SD-WAN rule rather than a specific application-based rule. This commonly happens with encrypted traffic or late application identification."

This underscores the importance of precise application detection and session refresh for policy enforcement.

The FortiManager SD-WAN overlay template preview, as described in the document, indicates:

"When the device is acting as a hub, the configuration enables the sending of ADVPN shortcut offers to spokes. This means the hub can facilitate on-demand dynamic shortcut tunnel creation between spokes, improving performance for branch-to-branch communication by bypassing the hub for inter-branch traffic after initial discovery."

Such a role is critical in scalable ADVPN topologies, enabling hub devices to optimize overlays dynamically.

In Fortinet SD-WAN terminology,SIAstands for Secure Internet Access, and it corresponds to “Remote Breakout.” The SD-WAN 7.4 documentation states:

"Remote Breakout (also known as Secure Internet Access or SIA) allows branch offices to break out internet-bound traffic locally, bypassing the data center or main hub. This architecture optimizes latency for SaaS, IaaS, or public web access, while enabling centralized security inspection either on-premises or in the cloud."

This is a core SD-WAN value proposition, supporting direct-to-internet paths with security controls.

To implement ADVPN 2.0 in an already configured SD-WAN topology, the update must occur on the branches.

"When enabling ADVPN 2.0 features (such as enhanced shortcut capabilities), it is required to update the SD-WAN configuration on all branch FortiGates. This allows the branches to support and negotiate the new shortcut and performance optimization features, while the hub configuration typically does not require modification unless introducing entirely new capabilities."

This approach ensures backward compatibility and staged rollout of advanced ADVPN features.