IT Toolbox
Guide

How to diagnose an SD-WAN rule

This BAOI guide provides a structured method for diagnosing a sd-wan rule without multiplying unnecessary changes.

TopicStorage / NAS / SAN →
⌚ About 2 min read
View my favorites
& WAN Network Intermediate. 15-30 min

This BAOI guide provides a structured method for diagnosing a sd-wan rule without multiplying unnecessary changes.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Set perimeter

    Identify the equipment, service, affected users and start time.

  2. 2

    Collect Elements

    Record the exact messages, logs and useful settings.

  3. 3

    Test methodically

    Start with the basic dependencies before the application components.

  4. 4

    Apply correction

    Change only the identified parameter or component.

  5. 5

    Validate

    Rewrite the full scenario and document the result.

À retenir

  • Keep the initial values for a backwards.
  • Avoid multiple simultaneous changes.
  • Compare with a functional configuration when possible.
← All les guides
Technical deep dive

FortiGate SD-WAN: rule, SLA and session explain path selection

Technical checkpoints

  • An SD-WAN rule selects among eligible members according to strategy/priority/SLA; an existing route alone is not enough to predict the final member.
  • Health checks have their own source, target and latency/jitter/loss thresholds and can mark a link degraded while it remains up.
  • An existing session may remain on the previous member; test a new flow after changes.

SD-WAN reading

Compare matched rule, SLA state and sessions for the real flow.

diagnose sys sdwan service
diagnose sys sdwan health-check
diagnose sys session filter ...

Topic-specific pitfalls

  • Changing priority without checking match criteria may do nothing for the tested flow.
  • A health check to an unrepresentative target can unnecessarily fail over a healthy link.

How to validate

  • The new flow matches the intended rule and uses the expected member.
  • SLA metrics remain within thresholds during a representative test.

Operational diagnosis

An SD-WAN rule can fail even when every WAN link is technically up. Diagnose rule matching, SLA health, route reachability and policy/NAT behavior as separate layers.

Step-by-step checks

  1. Confirm the traffic actually matches the intended SD-WAN rule: source, destination, protocol, user/application and rule order.
  2. Check health-check/SLA state and the exact thresholds that make a member eligible or ineligible.
  3. Verify route lookup, policy and NAT decisions for the selected member.
  4. Compare session tables and member counters during a controlled test rather than relying only on dashboard status.

How to validate the fix

A controlled flow should match the expected rule, select an eligible member, establish a session and fail over according to the configured SLA behavior.

Evidence to keep

Record rule ID, matched criteria, selected member, SLA metrics, route/policy decision and session result.

Related BAOI resources: IT tools · procedures · IT dictionary.

♡ 0