CloudLabBox
Try the free demo

FortiGate SD-WAN lab 2 of 14

Performance SLAs and link health

Break ISP-A behind a link that stays up and watch SD-WAN miss it, then add performance SLAs that probe both ISPs with ping and HTTP, set SLA targets, read sla_map, and prove that a dead member's route is withdrawn so traffic moves to ISP-B.

Run this lab

It needs Lite: its 5 nodes are set to 5 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then FortiGate SD-WAN guided labs, then 02 - Performance SLAs and link health

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
5 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Last Tuesday the Leeds depot lost the internet for forty minutes, yet BR1 never moved to ISP-B. ISP-A's router had hung, but the cable to it stayed up, so port1 stayed up and SD-WAN kept sending everything into a black hole. You'll reproduce the fault with the WAN emulator, then add performance SLAs so BR1 measures both ISPs all the time and stops using a link that fails.

DeviceInterfaceAddressNotes
BR1port1 (ISP-A, member 1)203.0.113.2/24gateway 203.0.113.254, through WAN
BR1port2 (ISP-B, member 2)192.0.2.2/24gateway 192.0.2.254, route priority 10 (standby)
BR1port3 (LAN)10.2.10.1/24PC1 10.2.10.10, H1 10.2.10.50
WANeth0 to eth1bridge, no addressISP-A's circuit, where you add delay and loss
INETlo198.51.100.53, .10public DNS server and www.example.com, the probe targets

SLA targets for the depot: target 1 (interactive) latency 100 ms, jitter 50 ms, loss 5%; target 2 (bulk) latency 250 ms, jitter 100 ms, loss 10%.

What you’ll practise

  • Explain why link state alone misses most WAN failures
  • Configure a performance SLA (health check) with ping and HTTP probes, interval, failtime and recoverytime
  • Define SLA targets for latency, jitter and loss and decode sla_map
  • Use a WAN emulator to add delay and loss and read the measurements
  • Prove that update-static-route withdraws a dead member's route

The tasks

  1. Start the lab
  2. A failure SD-WAN can't see
  3. A performance SLA with ping probes
  4. SLA targets and sla_map
  5. An HTTP probe
  6. Leave ISP-A failed for the checks
  7. Repair ISP-A (optional)

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Performance SLAs and link health5 nodes and 1 network, 6 links. Every link is listed as text below the diagram.BR1WANINETPC1H1LANport3eth0eth0port1eth0eth1eth0port2eth1
5 nodes and 1 network, with the interface names each link uses.
Every link, as text
  • BR1 port1 to WAN eth0
  • WAN eth1 to INET eth0
  • BR1 port2 to INET eth1
  • BR1 port3 to LAN (network)
  • PC1 eth0 to LAN (network)
  • H1 eth0 to LAN (network)
Nodes in Performance SLAs and link health, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
BR1Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
WANAlpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB
INETEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 2,048 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate SD-WAN guided labs.

  3. Open 02 - Performance SLAs and link health and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More FortiGate SD-WAN labs

All FortiGate SD-WAN labs

Related labs in other courses

CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.