FortiGate SD-WAN lab 12 of 14
Troubleshoot SLA targets and rule order
A weekend change left the Glasgow depot's SD-WAN broken in four ways. Work from symptoms to causes with the SD-WAN diagnostics: a health check that probes nothing, a member with the wrong gateway, a catch-all rule above the specific ones and a rule that never matches its PC. Fix each and prove the intended behaviour.
Run this lab
It needs Lite: its 5 nodes are set to 5 vCPU and 6,144 MB in total. That fits the free demo too.
In your workspace: Shared, then FortiGate SD-WAN guided labs, then 12 - Troubleshoot SLA targets and rule order
- Level
- Advanced
- Time
- About 60 minutes
- Nodes need
- 5 vCPU, 6,144 MB
- Smallest plan
- Lite
The scenario
The Glasgow depot's FortiGate (BR1) was "tidied up" over the weekend from a printout of the Leeds configuration. On Monday: nobody can browse, the admin PC's provider portal rejects it, and when the internet comes back everything seems to use the expensive ISP-B. The intended design is the one from lab 03, and your job is to find every difference that matters, fix it, and prove the depot works as designed.
Intended design
| Item | Intended |
|---|---|
| Members | 1 = port1, gateway 203.0.113.254, cost 10; 2 = port2, gateway 192.0.2.254, cost 50; zone underlay |
INET_SLA | ping 198.51.100.53 (INET's DNS server) every 500 ms through members 1 and 2; target 1: 100 ms, 50 ms, 5% |
| Rules, top-down | 1 Admin-PC-via-ISP-A (source PC1 10.2.10.10, member 1); 2 DNS-Lowest-Cost (UDP 53, target 1, members 1, 2); 3 Web-Best-Quality (TCP 80, latency); 4 Bulk-via-ISP-B (everything else, member 2) last |
| Addresses | BR1 port1 203.0.113.2, port2 192.0.2.2, LAN 10.2.10.0/24; PC1 10.2.10.10; H1 10.2.10.50 |
There are four faults. The routing, the policy and the WAN emulator are fine.
What you’ll practise
- Troubleshoot SD-WAN systematically: members, health checks, rules, then sessions
- Find a wrong health-check server and a wrong member gateway from member states
- Find a rule-order fault and a rule whose source never matches
- Prove each fix with diagnose output and a client test
The tasks
- Start the lab
- Start from the members
- Then the rules
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- BR1
port1to WANeth0 - WAN
eth1to INETeth0 - BR1
port2to INETeth1 - BR1
port3to LAN (network) - PC1
eth0to LAN (network) - H1
eth0to LAN (network)
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| BR1 | Fortinet FortiGate | fortinet-FGT-v7.0.17.M-build0682 | 1 vCPU, 2,048 MB |
| WAN | Alpine WAN emulator | clbalpinewanem-alpine-wanem-3-20-3 | 1 vCPU, 512 MB |
| INET | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
| PC1 | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 2,048 MB |
| H1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
FortiGate SD-WAN guided labs.Open
12 - Troubleshoot SLA targets and rule orderand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More FortiGate SD-WAN labs
Related labs in other courses
CloudLabBox is independent of Fortinet. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.