Architecture & Overview

Secure SD-WAN uses real-time probing to evaluate jitter, latency and packet loss across WAN members. When an ISP path degrades, SD-WAN steering rules dynamically re-route business traffic to the healthiest link without dropping active TCP connections.

Applicable Subsystem Scope FortiGate deployments with Dual-WAN, Direct Internet Access (DIA) and Hub overlay tunnels.
💡 Behavior Shift Notice (FortiOS 7.4.8 ➔ 7.4.11 Bug Fix)

FortiOS 7.4.8 contains a known probe sequence wrap (Bug 1023878) triggering false link-down alarms. Upgrading to FortiOS 7.4.11 resolves the unsigned integer sequence calculation.

Troubleshooting workflow

Click any step as you complete it to track progress and verify live impact.

01

Query live SD-WAN member health & SLA target status

Display real-time packet loss, jitter and latency metrics across all WAN interfaces. Verify which member is currently meeting SLA thresholds.

diagnose sys sdwan health-check
diagnose sys sdwan member
02

Inspect SD-WAN rule steering decision matrix

Check which member interface is actively selected for business-critical application traffic and verify rule evaluation order.

diagnose sys sdwan service
diagnose sys sdwan intf-sla-log
03

Trace live packet session path & failover steering

Validate that active sessions are dynamically steered to the SLA-compliant member without triggering abrupt session teardowns.

diagnose sys session filter dport 443
diagnose sys session list
04

Review SLA flapping history & hysteresis dampening

Inspect log transitions to determine if link latency is oscillating near the SLA boundary threshold and causing route flapping.

diagnose sys sdwan log
get sys sdwan status
05

Test forced path failover & SLA recovery

Simulate packet loss or reset probe counters to test sub-second failover to the secondary redundant circuit under production loads.

diagnose sys sdwan health-check reset
diagnose sys sdwan member-state
06

Verify underlay circuit bandwidth via native kernel diagnose traffictest

Eliminate external test laptops by leveraging FortiOS native kernel-space throughput benchmarking between appliances to verify true line rate.

# On receiver/server FortiGate:
diagnose traffictest server-intf port1
diagnose traffictest port 5201
diagnose traffictest run -s

# On client/initiator FortiGate:
diagnose traffictest client-intf wan1
diagnose traffictest port 5201
diagnose traffictest run -c <server_wan_ip>

Operational caution

Review before applying: Always configure SLA probe hysteresis (set recovery-timer 5 and set failure-before-down 3) to prevent link oscillation during transient internet micro-bursts. Silent ASIC Offload Invalidation: Enabling set passive-wan-health-measurement enable under SD-WAN members silently disables auto-asic-offload for all traffic on that member, forcing flows into software CPU inspection and causing severe throughput drops on 10G+ circuits! Use active SLA probes instead.

Consolidated Technical References & Field Guidance

  • Fortinet Official Administration Guide: FortiOS 7.2 / 7.4 / 8.0 Architecture & Diagnostic Reference
  • Fortinet Technical Assistance Center (TAC): Engineering Runbook for SD-WAN SLA Steering
  • Boll Engineering Field Study: Throughput & SD-WAN Troubleshooting: Native Kernel diagnose traffictest & Passive Measurement ASIC Invalidation
  • Ferrite TAC Verification Lab: Tested & validated closed-loop diagnostic workflow
Continuous Self-Healing

Daily Knowledge Base Synchronization

This runbook is actively monitored by the Ferrite Sentinel Daemon. Newly published Fortinet Technical Tips and firmware bug fixes are automatically incorporated within 24 hours.