CloudLabBox
Try the free demo

FortiGate SD-WAN lab 14 of 14

Capstone - a three-site SD-WAN rollout

Build a complete SD-WAN for HQ and two depots from addressed but empty FortiGates: underlay members with health checks and direct internet access, dial-up overlays on both ISPs, iBGP with the hub as route reflector, ADVPN shortcuts, and rules for corporate and web traffic. Then cut Leeds' main ISP and prove that everything keeps working.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 9,216 MB in total.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 14 - Capstone - a three-site SD-WAN rollout

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 9,216 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 150 minutes
Nodes need
8 vCPU, 9,216 MB
Smallest plan
Standard

The scenario

Kestrel Logistics has bought new FortiGates for HQ and the Leeds and Bristol depots. They arrive addressed (interfaces, DHCP for the LAN hosts and the address objects LAN-NET and CORP-NETS) and nothing else: no SD-WAN, no routes, no policies, no tunnels. You are the engineer for the go-live. Build the network to the design below, then prove it survives losing Leeds' main ISP.

Addressing

DeviceISP-A (port1)ISP-B (port2)LAN (port3)Tunnel addresses A / BRouter ID
HUB203.0.113.1192.0.2.110.1.10.1/24, H1 .50172.16.1.254 / 172.16.2.25410.200.0.1 (loopback Lo)
BR1203.0.113.2 (through WAN)192.0.2.210.2.10.1/24, H2 .50172.16.1.2 / 172.16.2.210.200.0.2
BR2203.0.113.3192.0.2.310.3.10.1/24, H3 .50172.16.1.3 / 172.16.2.310.200.0.3

Design

AreaRequirement
Underlayevery site: members 1 (port1, gateway 203.0.113.254) and 2 (port2, gateway 192.0.2.254) in zone underlay; health check INET_SLA (ping 198.51.100.53, 500 ms, failtime 3, recoverytime 3, target 1: 100 ms, 50 ms, 5%); default route to underlay; policy LAN-to-Internet with NAT
Overlayshub dial-up OL_A (port1) and OL_B (port2), net-device disable, exchange-interface-ip enable, ADVPN sender; spokes HUB_A and HUB_B with ADVPN receiver; IKEv2, PSK LabVpnKey1!, des-sha256, DH 14, DPD on idle every 5 s
Spoke SD-WANmembers 3 (HUB_A) and 4 (HUB_B) in zone overlay; health check HUB_HC to 10.200.0.1 (same timers and target as INET_SLA); summary route 10.0.0.0/8 to zone overlay (distance 250) above a blackhole for 10.0.0.0/8 (distance 254)
RoutingiBGP AS 65000; HUB is route reflector with neighbor ranges for both overlays and advertises 10.1.10.0/24 and 10.200.0.1/32; spokes peer with both hub addresses, use ibgp-multipath and advertise their LAN; the hub sends additional paths (additional-path send, adv-additional-path 2) and the spokes receive them (additional-path receive); keepalive 5 s and hold time 15 s on every overlay session
Rules (spokes)1 Corporate: lowest cost, CORP-NETS, HUB_HC target 1, members 3, 4. 2 Web-Best-Quality: best quality on latency with INET_SLA, TCP 80, members 1, 2
Policiesspokes: LAN to overlay and back for CORP-NETS, no NAT; hub: spokes to HQ, HQ to spokes, spoke to spoke, and PING from the tunnels to Lo

Evaluation licence. IPsec on these FortiGates offers DES only, so this design uses des-sha256 with DH group 14. A production design would use AES-256-GCM with DH group 19, 20 or 21.

What you’ll practise

  • Plan and build underlay SD-WAN with health checks and direct internet access on three sites
  • Build dial-up overlays on two ISPs with ADVPN
  • Run iBGP over the overlays with the hub as route reflector
  • Write rules for corporate and internet traffic
  • Prove failover of internet, corporate and spoke-to-spoke traffic when an ISP fails

The tasks

  1. Start the lab
  2. Underlay and direct internet access
  3. Overlays with ADVPN
  4. BGP
  5. Rules
  6. Go-live test: lose Leeds' ISP-A

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Capstone - a three-site SD-WAN rollout8 nodes and 2 networks, 12 links. Every link is listed as text below the diagram.HUBBR1BR2INETWANH1H2H3ISP-AISP-Bport1eth0port3eth0eth1port3eth0port3eth0eth0eth1port1port2port2port1port2
8 nodes and 2 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB port1 to ISP-A (network)
  • HUB port2 to ISP-B (network)
  • HUB port3 to H1 eth0
  • BR1 port1 to WAN eth0
  • WAN eth1 to ISP-A (network)
  • BR1 port2 to ISP-B (network)
  • BR1 port3 to H2 eth0
  • BR2 port1 to ISP-A (network)
  • BR2 port2 to ISP-B (network)
  • BR2 port3 to H3 eth0
  • INET eth0 to ISP-A (network)
  • INET eth1 to ISP-B (network)
Nodes in Capstone - a three-site SD-WAN rollout, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR2Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 14 - Capstone - a three-site SD-WAN rollout and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.