CloudLabBox
Try the free demo

FortiGate SD-WAN lab 7 of 14

BGP route tags and SLA-aware routing

Fix the overlay's blind spot from lab 06: make each branch tell the hub, through BGP communities, which overlay currently meets its SLA so HQ's return traffic follows the healthy path, and let the hub mark its data-centre routes with a community that branches turn into a route tag for an SD-WAN rule.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 9,216 MB in total.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 07 - BGP route tags and SLA-aware routing

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 9,216 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
8 vCPU, 9,216 MB
Smallest plan
Standard

The scenario

Since lab 06, Leeds (BR1) moves its corporate traffic to overlay B whenever ISP-A is slow, yet the warehouse team still complains about lag. A capture shows why: HQ answers over overlay A, the slow one, because HQ's BGP has no idea which overlay Leeds considers healthy. You'll make each branch advertise its LAN with a community that says whether that overlay meets the SLA, and have HQ prefer the healthy path. While you're in the BGP configuration, the architects also want HQ to mark its data-centre networks so that branches steer them with their own SD-WAN rule, without keeping address lists in step.

ItemValue
Overlaysas in lab 06: A 172.16.1.0/24, B 172.16.2.0/24; hub .254, BR1 .2, BR2 .3
BGPiBGP AS 65000, HUB route reflector; branches peer with 172.16.1.254 and 172.16.2.254
Communities65000:1 overlay in SLA, 65000:2 overlay out of SLA, 65000:100 data-centre network
Hub policypaths tagged 65000:2 get local preference 50 (default 100)
Route tagbranches tag 65000:100 routes with route tag 100

Evaluation licence. IPsec on these FortiGates offers DES only, so the overlays use des-sha256 with DH group 14. Production overlays use AES-256-GCM with DH group 19, 20 or 21.

What you’ll practise

  • Explain why BGP alone sends return traffic over a degraded overlay
  • Link BGP neighbors to SD-WAN members and SLA targets with SD-WAN neighbors
  • Advertise different communities in and out of SLA with route-map-out-preferable
  • Turn communities into local preference on the hub and route tags on the branches
  • Steer traffic with an SD-WAN rule that matches a route tag

The tasks

  1. Start the lab
  2. See the asymmetry
  3. Branches advertise their SLA state
  4. The hub prefers healthy paths
  5. A route tag for data-centre routes

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of BGP route tags and SLA-aware routing8 nodes and 2 networks, 12 links. Every link is listed as text below the diagram.HUBBR1BR2INETWANH1H2H3ISP-AISP-Bport1eth0port3eth0eth1port3eth0port3eth0eth0eth1port1port2port2port1port2
8 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB port1 to ISP-A (network)
  • HUB port2 to ISP-B (network)
  • HUB port3 to H1 eth0
  • BR1 port1 to WAN eth0
  • WAN eth1 to ISP-A (network)
  • BR1 port2 to ISP-B (network)
  • BR1 port3 to H2 eth0
  • BR2 port1 to ISP-A (network)
  • BR2 port2 to ISP-B (network)
  • BR2 port3 to H3 eth0
  • INET eth0 to ISP-A (network)
  • INET eth1 to ISP-B (network)
Nodes in BGP route tags and SLA-aware routing, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 07 - BGP route tags and SLA-aware routing and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.