FortiGate SD-WAN gives you application-aware path selection, but good behaviour is entirely down to how you design the health checks and steering rules. The defaults are a starting point, not a production configuration. This guide focuses on the settings that most affect real user experience.
Design SLA probes deliberately
Performance SLA health checks are the sensors your steering decisions rely on. Point probes at a target that genuinely represents the path's health — ideally the actual application or a reliable endpoint beyond the ISP handoff, not just the next-hop gateway, which can stay "up" while the path beyond it is failing. Set the probe interval, failure count and recovery count to balance responsiveness against stability: aggressive timers detect faults quickly but risk flapping on a lossy-but-usable link; conservative timers are stable but make a real failover feel like downtime.
Match link-quality thresholds to the traffic
Real-time traffic (voice, video, interactive apps) cares about latency, jitter and loss; bulk transfers care about throughput. Define SLA thresholds per application class rather than one global standard. A link that is fine for a file sync may be unusable for a call, and a single blanket threshold forces a compromise that serves neither well.
Get rule order and strategy right
SD-WAN rules are evaluated top-down; the first match wins. Place specific application and business-critical rules above broad catch-alls, and verify — using the SD-WAN monitor and session details — which rule traffic is actually hitting. The single most common tuning error we see is a general rule shadowing a specific one, sending an application over the wrong link. Choose the steering strategy per rule too: lowest-latency for interactive, best-quality for real-time, or manual/priority where a commercial or contractual preference must win.
Make failover seamless
Confirm behaviour under failure, not just under load. Introduce loss or latency on the preferred link and watch sessions move: real-time flows should re-steer within your target, and long-lived sessions should be handled per your design (some can migrate, some will re-establish). Validate that the return path stays symmetric after failover — asymmetry introduced by a link change breaks stateful inspection and is easy to miss in a quick test.
Keep it observable
Trend SLA metrics per link over time so you can distinguish a genuinely degrading circuit from a one-off blip, and so capacity and carrier decisions are based on data. Tuning is not a one-time task — traffic patterns change, and the thresholds that were right at rollout drift.