Troubleshooting SD-WAN link status, route selection, and performance SLA results

1. Add both WAN interfaces as members of the SD-WAN configuration.

2. Configure a performance SLA to measure link quality and identify the preferred link.

3. Create a default static route that points to SD-WAN.

4. Configure an SD-WAN rule containing both WAN interfaces and the PING performance SLA. This allows SLA measurements to determine the best ISP link for matching traffic.

5. Display all SD-WAN members, including their interface, gateway, priority, and weight:

diagnose sys sdwan member

Example output:

Member(1): interface: port2, gateway: 10.10.10.100, priority: 0, weight: 0
Member(2): interface: port3, gateway: 20.20.20.100, priority: 0, weight: 0

6. Review the policy-route information generated for the SD-WAN rule:

diagnose firewall proute list

Example output:

list route policy info(vf=root):
id=2130837505 vwl_service=1(SDWAN-RULE-TEST) vwl_mbr_seq=2 1 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0:65535 iif=0 dport=1-65535 oif=5 oif=4
source(1): 0.0.0.0-255.255.255.255
destination(1): 0.0.0.0-255.255.255.255

In this example, member sequence 2 represents WAN2 and sequence 1 represents WAN1. Their order indicates the preferred interfaces for the performance SLA.

7. Check SLA measurements for the health check named PING:

diagnose sys sdwan health-check PING

Example output:

Health Check(PING):
Seq(1): state(alive), packet-loss(0.000%) latency(60.223), jitter(9.280) sla_map=0x0
Seq(2): state(alive), packet-loss(0.000%) latency(60.155), jitter(9.318) sla_map=0x0

This output shows link state, packet loss, latency, jitter, and the SLA map. In the example, WAN1 has higher latency than WAN2, so WAN2 is the priority route shown by diagnose firewall proute list.

8. Display the preferred route and selected members for SD-WAN rule ID 1:

diagnose sys sdwan service 1

Example output:

Service(1): Address Mode(IPV4) flags=0x0
TOS(0x0/0x0), Protocol(0: 1->65535), Mode(priority), link-cost-factor(packet-l
Service role: standalone
Member sub interface:
Members:
    1: Seq_num(2), alive, packet loss: 0.000%, selected
    2: Seq_num(1), alive, packet loss: 0.000%, selected
Src address:
        0.0.0.0-255.255.255.255
Dst address:
        0.0.0.0-255.255.255.255

The service value 1 is the rule ID for SD WAN RULE TEST. The selected quality criterion is PACKET LOSS. Because neither WAN interface has packet loss in this example, both are selected as qualifying interfaces.

9. Display the 10-minute usage history for SD-WAN member wan1:

diagnose sys sdwan intf-sla-log wan1

10. List the available SD-WAN diagnostic command groups:

diagnose sys sdwan

The available groups shown are:

member
service
route-tag-list
route-tag-flush
health-check
neighbor
log
sla-log
intf-sla-log
internet-service-app-ctrl-list
internet-service-app-ctrl-flush
internet-service-app-ctrl-category-list
reset
zone
route
route6

11. On FortiOS 6.4 and earlier, replace the diagnose sys sdwan command prefix with:

diagnose sys virtual-wan-link

12. Starting with FortiOS 7.4.4, use separate service commands for IPv4 and IPv6:

diagnose sys sdwan service4

diagnose sys sdwan service6

13. Starting with FortiOS 7.4.4, diagnose sys sdwan service4 and diagnose sys sdwan service6 do not display the complete destination IP list when a rule uses a BGP route-tag firewall address as its destination. Verify all IP addresses associated with the route-tag value by running:

diagnose sys sdwan route-tag-list

Confirm that diagnose sys sdwan member lists both WAN interfaces with the expected gateways, priorities, and weights. Verify that diagnose sys sdwan health-check PING reports the intended link states and SLA metrics. Then compare diagnose firewall proute list with the applicable service output to confirm the preferred sequence and selected members. Use diagnose sys sdwan intf-sla-log wan1 to review the member's 10-minute usage history.