SD-WAN cu FortiGate — abordare enterprise multi-site

Companiile cu 5+ locatii abandoneaza MPLS scump in favoarea SD-WAN pe internet broadband. FortiGate domina segmentul cu integrare nativa in security stack.

Ce inseamna SD-WAN cu adevarat

Nu doar load balancing pe doua link-uri. SD-WAN modern e: aplicatii routate inteligent pe link-ul potrivit (Office 365 pe direct internet, ERP pe MPLS), failover sub 1 secunda fara intrerupere, vizibilitate completa pe aplicatii (nu doar IP/port), securizare inline.

Componente FortiGate SD-WAN

• SD-WAN rules — definitii per aplicatie: latency < 50ms, jitter < 10ms, packet loss < 1%
• Performance SLA — masurare continua pe fiecare link, switching automat
• Application control — recunoastere >5000 aplicatii (Office365, Salesforce, Zoom, Teams)
• ADVPN — full mesh dynamic intre toate site-urile fara configurare manuala
• Centralized management — FortiManager pentru push politici la 50+ branches
• ZTNA — Zero Trust Network Access integrat (replacement VPN clasic)

Provocari tipice in deployment

Migrarea graduala fara downtime (overlay parallel cu MPLS existent), tuning regulilor SD-WAN (initial multe false-routing pana ajusti SLA-uri), integrare cu DDI existent (DNS, DHCP central vs local), monitoring per branch fara overhead operational.

Decizii de design

Topologie hub-and-spoke vs full mesh vs hybrid? Numar de link-uri WAN per branch (1, 2, 3+)? Tip backup (4G LTE, Starlink, ISDN legacy)? In ce zone se face SSL inspection (latency vs visibility tradeoff)?

Cost vs MPLS clasic

Pentru o companie cu 20 branches, MPLS €5000/luna devine SD-WAN cu broadband + 4G failover la €1200/luna. ROI tipic in 6-9 luni. Plus crestere bandwidth 5-10x la acelasi cost.

Ce livram

Design retea multi-site, deploy 20-100 branch-uri etapizat, training echipa interna, runbook operational, integrare cu FortiAnalyzer pentru logging centralizat, documentatie completa.

Exemplu: regula SD-WAN (FortiGate CLI)

O zona SD-WAN cu doua link-uri, health-check si SLA per aplicatie:

# FortiGate SD-WAN — 2 link-uri + health-check + SLA per aplicatie
config system sdwan
    set status enable
    config members
        edit 1
            set interface "wan1"
        next
        edit 2
            set interface "wan2"
        next
    end
    config health-check
        edit "office365"
            set server "www.office.com"
            set members 1 2
            config sla
                edit 1
                    set latency-threshold 50
                    set packetloss-threshold 1
                next
            end
        next
    end
end

Regula SD-WAN cu SLA

Rutezi o aplicatie pe linkul care respecta SLA-ul:

config system sdwan
    config service
        edit 1
            set name "voip"
            set mode sla
            set dst "voip-servers"
            config sla
                edit "health"
                    set id 1
                next
            end
            set priority-members 1 2
        next
    end
end

Diagnoza pe echipament

Verifici starea linkurilor si a SLA-urilor din CLI:

diagnose sys sdwan health-check
diagnose sys sdwan service
get router info routing-table all
diagnose sniffer packet any 'host 8.8.8.8' 4

ADVPN: full mesh dinamic

Tunelurile intre site-uri se formeaza automat, la cerere:

config vpn ipsec phase1-interface
    edit "advpn-hub"
        set type dynamic
        set auto-discovery-sender enable
        set auto-discovery-receiver enable
        set network-overlay enable
    next
end
# spoke-urile primesc shortcut-uri directe intre ele (fara sa treaca prin hub)

Management central + ZTNA

Impingi politici la zeci de branch-uri si inlocuiesti VPN-ul clasic cu ZTNA:

# FortiManager: policy package -> install to device group 'branches'
execute central-mgmt update
# ZTNA (acces per-aplicatie, verificare postura, fara tunel de retea)
config ztna traffic-forward-proxy
    edit "app-erp"
        set vip "erp-vip"
    next
end