{{ $t('productDocDetail.updateTime') }}: 2026-01-04

Fortigate Configuration Example

config system virtual-wan-link

    set status enable                              # Enable SD-WAN

    config members

        edit 1

            set interface "vpn_to_HQ_1"            # Member uses VPN tunnel interface 1

        next

        edit 2

            set interface "vpn_to_HQ_2"            # Member uses VPN tunnel interface 2

        next

    end

    config health-check

        edit "HQ_Tunnel_Monitor"

            set server "10.10.10.1"                # Probe target in HQ network

            set protocol ping                      # Use ping to check tunnel health

            set interval 5                         # Probe every 5 seconds

            set failtime 3                         # Mark down after 3 failures

        next

    end

    config service

        edit 1

            set name "HQ_Application_Traffic"      # Service that should go to HQ

            set dst "10.10.10.0/24"                # Destination network at HQ

            set priority-members 1 2               # Prefer vpn_to_HQ_1, then vpn_to_HQ_2

            set mode priority                       # Use priority (not load-balance)

        next

    end

end

Fortigate Parameter Explanation and Conversion Suggestions

FortiGate Parameter	FortiGate Parameter Description	Corresponding Sangfor NGAF Module/Parameter	Migration Notes
set status enable	Enable SD-WAN feature	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	If using Sangfor VPN, use NGAF’s SD-WAN module
config members / set interface "vpn_to_HQ_x"	Add VPN tunnel as SD-WAN member	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	Configure in the Path Selection Policy
config health-check / set server	Probe remote/internal IP to check tunnel availability	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	Configure in the Path Selection Policy
set protocol ping	Use ICMP to probe tunnel health	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	Configure in the Path Selection Policy
set dst "10.10.10.0/24"	Define service target (e.g., HQ subnet)	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	Configure in the Path Selection Policy
set mode priority	Priority mode (primary/backup)	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	Configure in the Path Selection Policy
set priority-members 1 2	Specify priority order of members	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	Configure in the Path Selection Policy
health-check interval/failtime	Probe interval and failure threshold	Network > Sangfor/IPsec VPN > SD-WAN Configuration > Path Selection Templates	Configure in the Path Selection Policy

Migrate to Sangfor NGFW

SD-WAN Path Selection Templates

You can create a local SD-WAN path selection template or download one from the Branch Business Center (BBC). You can also create path selection policies for the VPN HQ device or view path selection policies for the VPN HQ and branch devices, as shown in the following figure.

Step 1.On the VPN HQ tab, click Add. In the Add Path Selection Template dialog box, set the template name and select a branch, then click OK, as shown in the following figure.

Step 2.Click Configure Path Selection Policy in the Operation column for the created template, as shown in the following figure.

Step 3.On the page that appears, click Add, as shown in the following figure.

Step 4.In the Add Policy dialog box, select Specified for Mode in the App Identification section. Auto Ident is selected by default. The auto identification algorithm identifies the types and priorities of apps and automatically selects paths from them based on their service types and priorities. Herein, Specified is selected for ease of demonstration.

Step 5.Select apps for SD-WAN path selection in App Categories.

Step 6.Click Settings next to Specify Src/Dst IP and specify the IP range for SD-WAN path selection. All is selected by default.

Step 7.In the Path Selection Settings section, select AutoGO Smart Path Selection for Mode and select Paths for path selection. If no paths are selected, all paths are included by default. Click OK.

The configured VPN paths are available for Local Path, and four paths are available for Peer Path by default. You can click Delete in the Operation column to delete the VPN paths that do not exist.

If your device is not added to the BBC, you can configure SD-WAN path selection templates and policies on your local console. If your device is added to the BBC, you must configure SD-WAN path selection templates and policies on the BBC and push them down to your device. The configuration method in the BBC is the same as that in your local console.