CloudLabBox
Try the free demo

FortiGate SD-WAN lab 10 of 14

Direct internet access and local breakout

Move a branch from backhauling all internet traffic through HQ to direct internet access: a local default route and NAT policy on the underlay, rules that keep corporate traffic on the overlay, send a SaaS service over the best link and the rest over the cheap one, and a third internet link that gets its address and gateway by DHCP from the platform's real internet.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 10 - Direct internet access and local breakout

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 80 minutes
Nodes need
5 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Leeds sends all of its internet traffic to HQ over the overlay, and HQ breaks it out to the internet. That made sense when HQ held the only firewall policy and the only good line. Today the depot has two ISPs of its own, its SaaS file service is slow through HQ, and HQ's lines are full of branch traffic. You'll switch Leeds to direct internet access (DIA), keep corporate traffic on the overlay, and add a third line: CloudLabBox's real internet link on port4, which hands out an address by DHCP.

DeviceInterfaceAddress
HUBport1 / port2203.0.113.1 / 192.0.2.1; loopback 10.200.0.1 (HQ services)
BR1port1 (ISP-A, member 1)203.0.113.2/24, through WAN
BR1port2 (ISP-B, member 2)192.0.2.2/24
BR1port3 (LAN)10.2.10.1/24, H2 10.2.10.50
BR1port4 (Internet, member 7)DHCP from 172.29.129.0/24, gateway 172.29.129.254
BR1overlays (members 3, 4)HUB_A 172.16.1.2, HUB_B 172.16.2.2

Internet link: the Internet cloud is CloudLabBox's own internet access. It gives DHCP addresses in 172.29.129.0/24 (gateway .254) and reaches approved destinations only, such as public DNS resolvers and vendor sites; the lab's test sites (198.51.100.0/24) are not on it.

Evaluation licence. IPsec on these FortiGates offers DES only, so the overlays use des-sha256 with DH group 14. Production uses AES-256-GCM with DH group 19, 20 or 21.

What you’ll practise

  • Compare backhaul (remote internet access) with direct internet access (DIA)
  • Build DIA with a zone default route, a NAT policy and rules that separate corporate and internet traffic
  • Steer a SaaS service by quality and general internet traffic by cost
  • Add a DHCP-addressed internet link as a member and steer chosen destinations to it
  • Explain how a more specific or lower-distance route overrides a BGP default route

The tasks

  1. Start the lab
  2. Backhaul today
  3. Turn on direct internet access
  4. Rules for internet traffic
  5. A DHCP internet link

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Direct internet access and local breakout5 nodes and 3 networks, 9 links. Every link is listed as text below the diagram.HUBBR1INETWANH2ISP-AISP-BInterneteth0port2port1eth0port4port3eth0eth1eth1port1port2
5 nodes and 3 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HUB port1 to ISP-A (network)
  • HUB port2 to ISP-B (network)
  • BR1 port1 to WAN eth0
  • WAN eth1 to ISP-A (network)
  • BR1 port2 to ISP-B (network)
  • BR1 port3 to H2 eth0
  • BR1 port4 to Internet (network)
  • INET eth0 to ISP-A (network)
  • INET eth1 to ISP-B (network)
Nodes in Direct internet access and local breakout, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HUBFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 10 - Direct internet access and local breakout and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.