<\/p>\n\"Data Center\" (DC)
config system interface
config vpn ipsec phase1-interface
config vpn ipsec phase2-interface
config router static
config router bgp
config network
config system interface
config vpn ipsec phase1-interface
config vpn ipsec phase2-interface
config router static
config router bgp
config network
<\/code><\/p>\n
I am providing the configuration in text format because I believe it is more convenient to configure the VPN this way. Almost all settings are the same on both sides, and they can be copied and pasted in this format. If you do the same in the web interface, it's easy to make mistakes \u2014 to forget checkboxes or enter the wrong values. <\/p>\n
After we have added interfaces to the bundle<\/p>\n
Traffic can be distinguished from the general flow based on L3-L4 information, recognized applications, internet services (URL and IP), as well as recognized users of workstations and laptops. After that, one of the following load balancing algorithms can be assigned to the distinguished traffic:<\/p>\n
On Load Balancing Algorithms \nRegarding how Fortigate (the firewall from Fortinet) can split traffic between channels, there are two interesting options that are not very common in the market:<\/p>\n
Lowest Cost (SLA)<\/b> \u2013 from all the interfaces currently satisfying SLA, the one with the lowest cost value as set manually by the administrator is chosen; this mode is suitable for 'bulk' traffic, such as backups and file transfers. <\/p>\n
Best Quality (SLA)<\/b> \u2013 this algorithm, in addition to the usual latency, jitter, and packet loss, allows Fortigate to also consider the current load on the channel; this mode is suitable for 'sensitive' traffic, such as VoIP and video conferencing.<\/p>\n
For these algorithms, a performance measurement for the communication channel \u2013 Performance SLA \u2013 needs to be configured. This measurement periodically checks (check interval) the information on SLA compliance: losses (packet loss), latency (latency), and jitter (jitter) in the communication channel, and can 'discard' channels that currently do not meet threshold quality values \u2013 losing too many packets or exhibiting excessively high latency. Additionally, the measurement monitors the channel's status and may temporarily remove it from the bundle in case of repeated loss of responses (failures before inactive). Upon recovery, after several consecutive responses (restore link after), the measurement will automatically return the channel to the bundle, and data will once again begin to be transmitted over it.<\/p>\n
This is how the 'meter' setup looks: <\/p>\n
Troubleshooting<\/h3>\n \nIf you created a rule but things aren't working as expected, you should check the Hit Count value in the SD-WAN Rules list. It will show whether the traffic is hitting this rule at all:<\/p>\n
For example, the following command set<\/p>\n
diagnose debug flow filter saddr 10.200.64.15Will allow you to trace two packets with the source address 10.200.64.15 and the destination address 10.1.7.2.
First packet:<\/p>\n
id=20085 trace_id=475 func=print_pkt_detail line=5605 msg=\"vd-Internet:0 received a packet(proto=1, 10.200.64.15:42->10.1.7.2:2048) from DMZ-Office. type=8, code=0, id=42, seq=0.\"DMZ-Office \u2013 name of the L3 interface. <\/b>Type=8 \u2013 Echo.<\/code><\/p>\n A new session was created for it:msg=\"allocate a new session-0006a627\"<\/code><\/p>\nA match was found in the routing policy settings.msg=\"Match policy routing id=2136539137: to 10.1.7.2 via ifindex-110\"<\/code><\/p>\nIt turns out that the packet needs to be sent through one of the VPN tunnels:\"find a route: flag=04000000 gw-192.168.254.1 via DC-Ph1-1\"<\/code><\/p>\nA permissive rule is found in the firewall policies:msg=\"Allowed by Policy-3:\"<\/code><\/p>\nThe packet is encrypted and sent into the VPN tunnel:func=ipsecdev_hard_start_xmit line=789 msg=\"enter IPsec interface-DC-Ph1-1\"The encrypted packet is sent to the gateway address for this WAN interface:msg=\"send to 2.2.2.2 via intf-WAN1\"<\/code><\/p>\nFor the second packet, everything happens similarly, but it is sent through a different VPN tunnel and exits through a different firewall port:func=ipsecdev_hard_start_xmit line=789 msg=\"enter IPsec interface-DC-Ph1-2\"Benefits of the solution \nReliable functionality and user-friendly interface. <\/b>The feature set that existed in FortiOS before SD-WAN was fully retained. This means we have not a newly developed software, but a mature system from a trusted firewall vendor, with a traditional set of network functions and an easy-to-learn web interface. How many SD-WAN vendors offer Remote-Access VPN functionality on their end devices, for example?<\/p>\n
Level 80 security. <\/b>FortiGate is among the top solutions for firewalling. There are many resources available online for configuring and administering firewalls, and there are plenty of security professionals in the job market who are already familiar with the vendor's solutions.<\/p>\n
Zero cost for SD-WAN functionality. <\/b>Building an SD-WAN network on FortiGate costs as much as building a regular WAN network on it, since no additional licenses are needed to implement SD-WAN functionality. <\/p>\n
Low entry price. <\/b>Fortigate has a good range of devices for various performance levels. The smallest and most affordable models are quite suitable for setting up an office or point of sale for, say, 3-5 employees. Many vendors simply do not have such low-performance and affordable models. <\/p>\n
High performance. <\/b>Narrowing the SD-WAN functionality to traffic balancing allowed the company to release a specialized SD-WAN ASIC, which ensures that SD-WAN operations do not degrade the overall performance of the firewall. <\/p>\n
The ability to implement an entire office on Fortinet equipment. <\/b>This includes a pair of firewalls, switches, and Wi-Fi access points. Such an office is easy and convenient to manage \u2013 switches and access points are registered on the firewalls and managed from there. For example, this is what a switch port may look like from the firewall interface that manages this switch:<\/p>\n
No controllers as a single point of failure. <\/b>The vendor emphasizes this, but it can only be partly seen as a plus because for vendors that do have controllers, ensuring their redundancy is inexpensive, most often in the price of a small amount of computing resources in a virtualized environment.<\/p>\nThings to pay attention to
\nAbsence of separation between Control Plane and Data Plane<\/b>This means that the network needs to be configured either manually or using traditional management tools\u2014FortiManager. For vendors that have implemented such a division, the network assembles itself. The administrator may only need to adjust its topology, perhaps prohibit something here and there, nothing more. However, the advantage of FortiManager is that it can manage not only firewalls but also switches and Wi-Fi access points, essentially managing the entire network. <\/p>\n
Conditional growth of manageability. <\/b>Due to the fact that traditional tools are used for automating network configuration, the manageability of the network with the implementation of SD-WAN increases only slightly. On the other hand, new functionalities become available more quickly, as the vendor first releases them only for the firewall operating system (which immediately allows them to be used), and only later supplements the management system with the necessary interfaces.<\/p>\n
Some functionalities may be available from the command line but not from the web interface. <\/b>It's not that daunting to occasionally access the command line to configure something, but it's concerning when you can't see in the web interface that something has already been configured via the command line. However, this usually pertains to the newest features, and gradually, with updates to FortiOS, the web interface capabilities are enhanced.<\/p>\nWho it's suitable for<\/h3>\n
\nThose with not too many branches.<\/b> Implementing an SD-WAN solution with complex central components for a network of 8-10 branches might not be worth it\u2014you will have to spend money on licenses for SD-WAN devices and system virtualization resources to host central components. Small companies generally have limited computational resources. In Fortinet's case, it's simply enough to purchase firewalls. <\/p>\n
Those with a lot of small branches. <\/b>For many vendors, the minimum price of the solution per branch is quite high and may not be attractive from the end client's business perspective. Fortinet offers small devices at a very appealing price. <\/p>\n
Those who are not yet ready to step too far. <\/b>Implementing SD-WAN with controllers, proprietary routing, and a new approach to network planning and management can be a significant step for some clients. Yes, this implementation will ultimately help optimize the use of communication channels and the work of administrators, but first, a lot of new knowledge will need to be acquired. For those not yet ready to change paradigms but who want to get more out of their communication channels, the solution from Fortinet is exactly what they need.habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"\u0421\u0443\u0434\u044f \u043f\u043e \u0447\u0438\u0441\u043b\u0443 \u0432\u043e\u043f\u0440\u043e\u0441\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0430\u043c \u0441\u0442\u0430\u043b\u0438 \u043f\u0440\u0438\u043b\u0435\u0442\u0430\u0442\u044c \u043f\u043e SD-WAN, \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0432 \u0420\u043e\u0441\u0441\u0438\u0438. \u0412\u0435\u043d\u0434\u043e\u0440\u044b, \u0435\u0441\u0442\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e, \u043d\u0435 \u0434\u0440\u0435\u043c\u043b\u044e\u0442 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0442 \u0441\u0432\u043e\u0438 \u043a\u043e\u043d\u0446\u0435\u043f\u0446\u0438\u0438, \u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043c\u0435\u043b\u044c\u0447\u0430\u043a\u0438 \u043f\u0435\u0440\u0432\u043e\u043f\u0440\u043e\u0445\u043e\u0434\u0446\u044b \u0443\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442 \u0438\u0445 \u0443 \u0441\u0435\u0431\u044f \u043d\u0430 \u0441\u0435\u0442\u0438. \u041c\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u043c \u043f\u043e\u0447\u0442\u0438 \u0441\u043e \u0432\u0441\u0435\u043c\u0438 \u0432\u0435\u043d\u0434\u043e\u0440\u0430\u043c\u0438, \u0438 \u0437\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043b\u0435\u0442 \u0432 \u043d\u0430\u0448\u0435\u0439 \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u044f \u0443\u0441\u043f\u0435\u043b \u043f\u043e\u043a\u043e\u043f\u0430\u0442\u044c\u0441\u044f \u0432 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u0440\u0443\u043f\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":95433,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-95432","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t