CloudLabBox
Try the free demo

FortiGate SD-WAN practice labs

14 guided labs on FortiGate VMs that take you from SD-WAN members and zones on one branch to a three-site network with IPsec overlays, BGP, ADVPN shortcuts, dual hubs and direct internet access. A WAN emulator adds real latency, jitter and loss to the ISP links, so you can watch performance SLAs and rules react.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 8 of the 14 labs also run in the free demo.

Guided labs
14
Follows
Fortinet NSE 5 – SD-WAN 7.6 Core Administrator and NSE 6 – SD-WAN 7.6 Enterprise Administrator
Runs every lab
Standard
Devices
FortiGate, Alpine Linux, EVE-NG GUI server and Alpine WAN emulator

Who these labs are for

For FortiGate administrators who know the basics of FortiOS, such as policies, NAT, routing and IPsec, and want hands-on SD-WAN practice for Fortinet’s SD-WAN Core Administrator and Enterprise Administrator exams, or for running SD-WAN at work.

The labs run FortiOS 7.0 under its evaluation licence, and each has a note on where FortiOS 7.6 differs. There’s no FortiGuard, and no FortiManager image, so the centralised-management topics are concept notes.

The 14 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

FortiGate SD-WAN course 14 labs

Shared folderFortiGate SD-WAN guided labs

One SD-WAN topic per lab on a single branch, then hub-and-spoke overlays, two troubleshooting labs with planted faults and a three-site capstone.

  1. 01Members and zones on a two-ISP branch

    Move a branch from a single static route on ISP-A to SD-WAN over two ISPs: clear the old references, put both links into an underlay zone as members, point one route and one policy at the zone, and use member priority to make ISP-B a hot standby.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× FortiGate, 2× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  2. 02Performance SLAs and link health

    Break ISP-A behind a link that stays up and watch SD-WAN miss it, then add performance SLAs that probe both ISPs with ping and HTTP, set SLA targets, read sla_map, and prove that a dead member's route is withdrawn so traffic moves to ISP-B.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× FortiGate, 2× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  3. 03SD-WAN rules and steering strategies

    Write four SD-WAN rules, one per strategy: manual for the admin PC, best quality for web traffic, lowest cost (SLA) for DNS and maximise bandwidth for file transfers. Then slow ISP-A down with the WAN emulator and prove which link each rule chooses, and why.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× FortiGate, 2× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  4. 04Internet service and application steering

    Steer traffic by what it is rather than by port: see why the evaluation unit's internet service database has names but no addresses, build a custom internet service and an FQDN destination instead, then steer web browsers with an application group and watch FortiGate learn the application before the rule takes over.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× FortiGate, 2× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  5. 05SD-WAN routing and sessions

    Follow a session through BR1's decisions: policy routes, then SD-WAN rules, then the routing table. Prove that a policy route beats a rule, watch a session stay on its old link after the routing changes, clear it or let snat-route-change move it, and make the FortiGate's own DNS traffic follow SD-WAN.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× FortiGate, 2× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  6. 06Hub-and-spoke IPsec overlays with BGP

    Build the classic SD-WAN overlay: a dial-up hub with one IPsec overlay per ISP, two branches with a tunnel over each of their ISPs, iBGP with the hub as route reflector, an overlay zone measured by a health check to the hub's loopback, and a lowest-cost rule that moves corporate traffic to the other overlay when one degrades.

    3× Alpine Linux, 3× FortiGate, 1× Alpine WAN emulator, 1× EVE-NG GUI server

    8 vCPU, 9,216 MBFits Standard

  7. 07BGP route tags and SLA-aware routing

    Fix the overlay's blind spot from lab 06: make each branch tell the hub, through BGP communities, which overlay currently meets its SLA so HQ's return traffic follows the healthy path, and let the hub mark its data-centre routes with a community that branches turn into a route tag for an SD-WAN rule.

    3× Alpine Linux, 3× FortiGate, 1× Alpine WAN emulator, 1× EVE-NG GUI server

    8 vCPU, 9,216 MBFits Standard

  8. 08ADVPN shortcuts between spokes

    Stop branch-to-branch traffic hairpinning through HQ: enable ADVPN so the hub offers shortcuts and the spokes build direct IPsec tunnels on demand, then prove the shortcut with the tunnel list, the routing table and a traceroute, and see how SD-WAN treats a shortcut.

    3× Alpine Linux, 3× FortiGate, 1× Alpine WAN emulator, 1× EVE-NG GUI server

    8 vCPU, 9,216 MBFits Standard

  9. 09Dual hubs and data-centre failover

    Add a second data centre: build HUB2's overlays, dual-home the Leeds branch to both hubs with BGP to each, join the hubs with a data-centre interconnect and floating routes, write rules that prefer each data centre's own hub, then take HUB1's internet edge down and prove that Leeds still reaches both data centres.

    3× Alpine Linux, 3× FortiGate, 1× EVE-NG GUI server

    7 vCPU, 8,704 MBFits Standard

  10. 10Direct internet access and local breakout

    Move a branch from backhauling all internet traffic through HQ to direct internet access: a local default route and NAT policy on the underlay, rules that keep corporate traffic on the overlay, send a SaaS service over the best link and the rest over the cheap one, and a third internet link that gets its address and gateway by DHCP from the platform's real internet.

    2× FortiGate, 1× Alpine Linux, 1× Alpine WAN emulator, 1× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  11. 11Monitoring and diagnostics

    Investigate a complaint the way an SD-WAN operator does: turn on SLA logging and warning thresholds, reproduce a lossy, jittery ISP with the WAN emulator, then read the health-check history, SD-WAN event logs, interface SLA logs, a packet capture of the probes and a debug-flow trace of a user's session.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× FortiGate, 2× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  12. 12Troubleshoot SLA targets and rule order

    A weekend change left the Glasgow depot's SD-WAN broken in four ways. Work from symptoms to causes with the SD-WAN diagnostics: a health check that probes nothing, a member with the wrong gateway, a catch-all rule above the specific ones and a rule that never matches its PC. Fix each and prove the intended behaviour.

    1× Alpine Linux, 1× Alpine WAN emulator, 1× FortiGate, 2× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  13. 13Troubleshoot overlay routing and ADVPN

    Four faults break the Kestrel overlay after a hub replacement: a tunnel that never comes up, BGP sessions that never start on one overlay, depots that can't reach each other, and spoke-to-spoke traffic that never takes a shortcut. Trace each from IKE to BGP to policy to ADVPN and fix it.

    3× Alpine Linux, 3× FortiGate, 1× Alpine WAN emulator, 1× EVE-NG GUI server

    8 vCPU, 9,216 MBFits Standard

  14. 14Capstone - a three-site SD-WAN rollout

    Build a complete SD-WAN for HQ and two depots from addressed but empty FortiGates: underlay members with health checks and direct internet access, dial-up overlays on both ISPs, iBGP with the hub as route reflector, ADVPN shortcuts, and rules for corporate and web traffic. Then cut Leeds' main ISP and prove that everything keeps working.

    3× Alpine Linux, 3× FortiGate, 1× Alpine WAN emulator, 1× EVE-NG GUI server

    8 vCPU, 9,216 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the FortiGate SD-WAN practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB1427
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB1426
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB; 1 vCPU, 2,048 MB1421
Alpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB1313

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the FortiGate SD-WAN labs

Are these FortiGate SD-WAN labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 8 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 8 of the 14. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Hub-and-spoke IPsec overlays with BGP”, needs 8 vCPU and 9,216 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Fortinet?

No. CloudLabBox wrote them to follow the topics of Fortinet’s NSE 5 – SD-WAN 7.6 Core Administrator and NSE 6 – SD-WAN 7.6 Enterprise Administrator exams. They aren’t training material from Fortinet, and CloudLabBox is independent of Fortinet.

Do I need a Fortinet licence for these labs?

No. The FortiGates run FortiOS 7.0 under its evaluation licence, which starts when a node first boots and lasts 15 days; wiping the node starts a new one. CloudLabBox doesn’t provide Fortinet licences or subscriptions, so features that need FortiGuard are explained rather than run.

Do the SD-WAN labs cover FortiManager?

Only in concept notes. There’s no FortiManager image, so the exams’ centralised-management topics are explained rather than configured.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 8 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Fortinet. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.