Technical Tip: SD-WAN rule with settings as ‘set mode load-balance’

[sagha]

Description
This article describes the traffic behavior when a SD-WAN rule is configured as ‘set mode load-balance’ from CLI or set as 'Maximize Bandwidth' (SLA) from GUI.

Solution
SD-WAN config.

# config system virtual-wan-link
    set status enable
    set load-balance-mode source-dest-ip-based
    # config members
        edit 1
            set interface "wan1"
            set gateway 10.191.47.254
        next
        edit 2
            set interface "wan2"
            set gateway 10.191.31.254
        next
    end
    # config health-check                         
        edit "test_hc"
            set server "8.8.4.4"
            set interval 1000
            set failtime 15
            set recoverytime 120
            set members 1 2
            # config sla
                edit 1
                    set latency-threshold 250
                    set jitter-threshold 20
                    set packetloss-threshold 5
                next
            end
        next
    end
    # config service                                 
        edit 1
            set name "test_rule_load_balance"
            set mode load-balance                   <----- Configured here.
            set dst "all"
            set src "all"
            # config sla
                edit " test_hc"
                    set id 1
                next
            end
            set priority-members 1 2
        next
    end
end

As per the above config, all the traffic is matching the SD-WAN rule configured with method as load-balance.

With rule configured as 'mode load-balance', rules selects a set of links and distribute the sessions among them (basic round robin).

# diagnose firewall proute list
list route policy info(vf=root):
 
id=2131820545 vwl_service=1(test_rule_load_balance) vwl_mbr_seq=1 2 dscp_tag=0xff 0xff flags=0x10 load-balance tos=0x00 tos_mask=0x00 protocol=0 sport=0:65535 iif=0 dport=1-65535 oif=17 num_pass=1 oif=18 num_pass=1
source(1): 0.0.0.0-255.255.255.255
destination(1): 0.0.0.0-255.255.255.255
hit_count=17 last_used=2020-06-24 02:52:39

The debug flows clearly show that once the session is established on a specific interface, the traffic matches against the same session.

Debug Flow.

FortiGate# diagnose debug flow filter daddr 8.8.8.8
FortiGate# diagnose debug flow filter proto 1
FortiGate# diagnose debug flow trace start 10000
FortiGate# diagnose debug enable

id=20085 trace_id=1057 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=1, 192.168.131.89:1->8.8.8.8:2048) from port1. type=8, code=0, id=1, seq=601."
id=20085 trace_id=1057 func=init_ip_session_common line=5666 msg="allocate a new session-000ae438"
id=20085 trace_id=1057 func=vf_ip_route_input_common line=2581 msg="Match policy routing id=2131820545: to 8.8.8.8 via ifindex-17"
id=20085 trace_id=1057 func=vf_ip_route_input_common line=2596 msg="find a route: flag=04000000 gw-10.191.47.254 via wan1"
id=20085 trace_id=1057 func=fw_forward_handler line=771 msg="Allowed by Policy-1: SNAT"
id=20085 trace_id=1057 func=__ip_session_run_tuple line=3286 msg="SNAT 192.168.131.89->10.191.32.10:60417"

id=20085 trace_id=1058 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=1, 192.168.131.89:1->8.8.8.8:2048) from port1. type=8, code=0, id=1, seq=602."
id=20085 trace_id=1058 func=resolve_ip_tuple_fast line=5581 msg="Find an existing session, id-000ae438, original direction"
id=20085 trace_id=1058 func=npu_handle_session44 line=1139 msg="Trying to offloading session from port1 to wan1, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x00000001"
id=20085 trace_id=1058 func=fw_forward_dirty_handler line=449 msg="state=00000204, state2=00000001, npu_state=00000001"
id=20085 trace_id=1058 func=__ip_session_run_tuple line=3286 msg="SNAT 192.168.131.89->10.191.32.10:60417"

id=20085 trace_id=1059 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=1, 192.168.131.89:1->8.8.8.8:2048) from port1. type=8, code=0, id=1, seq=603."
id=20085 trace_id=1059 func=resolve_ip_tuple_fast line=5581 msg="Find an existing session, id-000ae438, original direction"
id=20085 trace_id=1059 func=npu_handle_session44 line=1139 msg="Trying to offloading session from port1 to wan1, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x00000001"
id=20085 trace_id=1059 func=fw_forward_dirty_handler line=449 msg="state=00000204, state2=00000001, npu_state=00000001"
id=20085 trace_id=1059 func=__ip_session_run_tuple line=3286 msg="SNAT 192.168.131.89->10.191.32.10:60417"

id=20085 trace_id=1060 func=print_pkt_detail line=5501 msg="vd-root:0 received a packet(proto=1, 192.168.131.89:1->8.8.8.8:2048) from port1. type=8, code=0, id=1, seq=604."
id=20085 trace_id=1060 func=resolve_ip_tuple_fast line=5581 msg="Find an existing session, id-000ae438, original direction"
id=20085 trace_id=1060 func=npu_handle_session44 line=1139 msg="Trying to offloading session from port1 to wan1, skb.npu_flag=00000400 ses.state=00000204 ses.npu_state=0x00000001"
id=20085 trace_id=1060 func=fw_forward_dirty_handler line=449 msg="state=00000204, state2=00000001, npu_state=00000001"
id=20085 trace_id=1060 func=__ip_session_run_tuple line=3286 msg="SNAT 192.168.131.89->10.191.32.10:60417"

Related link.
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/708464/sd-wan-rules-maximize-bandwidth-s...