Fortinet SD-WAN
We design, deploy and manage Fortinet SD-WAN across FortiGate, FortiManager and FortiAnalyzer. Application-aware routing, path-health monitoring and central policy give your IT team a consistent way to manage routing, failover and network change across sites.
How the Fortinet platform fits together
FortiGate
FortiGate provides SD-WAN routing and firewall capability at each site. Application-aware policy uses link health and application requirements when selecting an eligible path.
FortiManager
FortiManager provides central policy, configuration templates, policy packages, change control, firmware management, compliance reporting and zero-touch provisioning across the estate. We include it as standard in our multi-site Fortinet SD-WAN deployments.
FortiAnalyzer
FortiAnalyzer brings network and security logs together across sites for investigation, reporting and operational visibility.
FortiAIOps
FortiAIOps gives our engineers early warning of degradation and faster root-cause analysis across FortiGate, switching and Wi-Fi. It complements FortiAnalyzer telemetry and the configuration view held in FortiManager when we trace a network issue.
Performance SLA health checks
FortiGate Performance SLA health checks measure latency, jitter and packet loss across available WAN paths. We set thresholds around the applications and site requirements, then use those results in SD-WAN policy.
SD-WAN and firewall on one operating system
SD-WAN routing and firewall policy both run in FortiOS, so when a link fails and traffic moves to another path, security policy moves with it. We validate that behaviour during the pilot. Routing and security issues are investigated in one environment, without passing the incident between separate network and firewall support teams.
Where Fortinet SD-WAN fits well
Put the SD-WAN in FortiOS to work
Many FortiGates run as a basic firewall, with the SD-WAN capability in FortiOS left unused. Once model, capacity, firmware and licensing are checked, existing hardware can form part of the target design.
See what the assessment coversConsistent application routing across branches
Microsoft 365, Teams and other applications may be using different paths, or running against different firewall and routing configurations. Backhauling cloud traffic through a central firewall also adds latency to each request. SD-WAN rules give each branch the same application policy, with direct breakout where it suits.
Try the SD-WAN rule explorerOne management structure in FortiManager
FortiManager brings policy, configuration templates and change into one structure, so a policy update reaches the relevant sites without treating each firewall as a separate configuration.
How the platform fits togetherBack to an agreed standard
Firewall, routing and SD-WAN policy are reviewed and brought back to an agreed standard. Site-to-site VPN tunnels built up over time, with inconsistent settings and unreliable failover, are part of that review.
See what the assessment coversA common design across inherited sites
Each inherited site is assessed against a common architecture, without assuming each location needs identical connectivity.
From assessment to ongoing managementSecurity and operation stay with the network
With a carrier-managed service, security, application performance and post-go-live operation tend to fall back to the internal team or another vendor. We take responsibility for architecture, security, carrier coordination and day-to-day network operations.
Why clients choose usReview the underlay before the next term
A renewal is a natural point to compare MPLS with fibre, nbn, broadband and 5G at each site. We review each site's underlay before the next term is signed, so the decision rests on how each option performs there.
See how carrier ordering is plannedSD-WAN, firewall and secure access in FortiOS
Separate consoles, policies and support relationships slow down each incident. FortiOS brings SD-WAN, firewall and secure access into one management structure, with a path to FortiSASE when remote access needs change.
Where SASE and ZTNA fitAn assessment establishes what can be retained and where redesign will improve the environment.
Application routing based on path quality
Fortinet's Internet Service Database identifies Microsoft 365, Teams and other cloud services for use in SD-WAN policy.
Performance SLA health checks measure the available paths. Routing policy can then consider the application, latency, jitter, packet loss and the thresholds set for that site.
Probe targets, thresholds and failover behaviour are validated at representative sites so traffic does not move unnecessarily or fail over onto a path that cannot carry the workload.
Connectivity for each site is designed through our multi-site network upgrade work.
Pick a scenario or move the sliders to change what the health checks measure on fibre, then follow how FortiGate evaluates each rule.
Performance SLA health checks
Each path is probed continuously and scored against three SLA targets
SD-WAN rules, evaluated top to bottom
Traffic uses the first member in order that meets the rule's SLA
- Match
- Internet Service Database: Microsoft Teams
- SLA
- Voice latency ≤ 150 ms · jitter ≤ 30 ms · loss ≤ 1%
- Members
- Fibre 5G
- Match
- Internet Service Database: Microsoft 365
- SLA
- Cloud latency ≤ 100 ms · loss ≤ 2%
- Members
- Fibre nbn Direct breakout at the branch
- Match
- Address group: ERP data centre
- SLA
- Business latency ≤ 250 ms · loss ≤ 3%
- Members
- Fibre nbn
Fibre meets all three SLA targets, so each rule keeps its traffic on fibre. nbn and 5G are measured continuously, so the alternatives are already scored if fibre changes. Fibre is still up, but misses the Voice SLA on jitter (38 ms against 30 ms). Rule 1 moves Teams and voice to 5G. Microsoft 365 and ERP stay on fibre because their thresholds still hold. Fibre is still up, but misses the Voice SLA on latency (180 ms against 150 ms) and the Cloud SLA on latency (180 ms against 100 ms). Rule 1 moves Teams and voice to 5G and rule 2 moves Microsoft 365 to nbn. ERP stays on fibre because its threshold still holds. Fibre is still up, but misses the Voice SLA on loss (4% against 1%), the Cloud SLA on loss (4% against 2%) and the Business SLA on loss (4% against 3%). Rule 1 moves Teams and voice to 5G, rule 2 moves Microsoft 365 to nbn and rule 3 moves ERP to nbn. The health checks stop getting responses on fibre, so FortiGate marks it dead. Each rule moves to its next member: Teams and voice to 5G, Microsoft 365 and ERP to nbn. Firewall policy moves with the traffic, and we raise the carrier fault with the health-check data attached.
From first assessment to day-to-day management
We start with the estate you already have
We look at each FortiGate's model, firmware, licensing and capacity, how far FortiManager is already in use, and how applications currently travel between sites. That shows what can stay, what needs replacing and where configuration has drifted from the standard.
Each site gets a pattern that suits it
We size each FortiGate, set the Performance SLA health checks and map application routing to the Internet Service Database. Each site gets its own mix of fibre, nbn, 4G/5G or Starlink, with segmentation and firewall policy designed alongside FortiManager, FortiAnalyzer and FortiAIOps. Carrier orders go in early, because fibre and nbn lead times often set the timeline.
Deploy across multiple sites
We supply the FortiGate hardware and the FortiCare and FortiGuard licences. Configuration is prepared before devices ship, using zero-touch provisioning where it suits. We validate the design at representative sites, then cut over multiple locations simultaneously or in planned phases, with agreed change windows and rollback arrangements. Where technically possible, the existing WAN remains available until the new network is stable.
We keep running it after go-live
Once the network is live, we monitor paths and links, keep FortiOS current against Fortinet's PSIRT advisories and manage FortiGuard subscriptions. Routing and security policy are tuned as your applications change, our engineers escalate carrier faults, and you receive a monthly report on WAN health and application performance. Network documentation is kept current throughout.
Where SASE and ZTNA fit
Fortinet SD-WAN can provide the branch network foundation for FortiSASE and ZTNA. FortiSASE extends secure access to remote users through cloud-delivered security services, and FortiGate can provide ZTNA for selected applications. We design them alongside branch firewall and SD-WAN policy, so access controls stay consistent across branches and remote users.
The security architecture, cloud-delivered controls and newer AI application visibility are covered in the Fortinet Secure SD-WAN guide.
Why clients choose us for Fortinet network work
01
Fortinet network and security expertise
Our work spans FortiGate, FortiManager, FortiAnalyzer, FortiAIOps, routing, firewall policy, segmentation and secure access.
02
Application performance is part of the network work
We look at Microsoft 365, Teams, SaaS and other application paths alongside link and firewall behaviour.
03
Carrier choice stays separate from platform choice
The Fortinet design lets each site use the carrier and access technology that suits it.
04
FortiManager hosted in Australia
We host FortiManager in Australian data centres, keeping the FortiManager management and configuration data in Australia.
05
Internal IT keeps visibility
Management access, responsibilities and change authority are agreed with the internal team.
06
We stay involved after deployment
Our engineers stay directly involved in monitoring, changes, troubleshooting and carrier escalation after deployment, and you can contact the engineering team directly when a network issue needs investigating.
See what we’ve delivered for our clients
Common questions about Fortinet SD-WAN
Why choose Fortinet over a separate SD-WAN vendor?
Fortinet runs SD-WAN routing and the firewall in the same FortiGate operating system. Security policy follows traffic when it moves between paths, and network and security issues are investigated in one environment with one support relationship.
Do we need to replace our existing FortiGate hardware?
Not necessarily. We review the models, capacity, firmware and licensing first. Suitable FortiGate hardware can remain in the target design.
Why does FortiManager matter?
It provides central policy, templates, configuration control and firmware management across sites, reducing device-by-device administration.
What does FortiAnalyzer add?
It brings network and security logs together across sites, giving engineers a common view for investigation, reporting and troubleshooting.
How does zero-touch provisioning work?
We prepare the device configuration and register the FortiGate for the agreed provisioning method before it ships. Once it is connected at site, it establishes initial connectivity and retrieves its assigned configuration through the configured Fortinet provisioning process.
Our engineers then validate connectivity, routing and security policy before the site goes into production.
How disruptive is cutover for live branch operations?
Cutover is the highest-risk moment in a live migration. We schedule production-site cutovers after hours, around agreed change windows and the site's operating requirements.
Where the existing architecture permits it, we set up and test the FortiGate environment alongside the existing network before production traffic moves. Our engineers validate application performance, failover and security controls, with a rollback plan agreed before cutover.
Can Fortinet SD-WAN work with our existing links?
Yes. It can use existing nbn, fibre, broadband, 4G/5G, Starlink and MPLS links. The review identifies the best mix for each site, and existing connections don't need replacing before the architecture is understood.
What is FortiSASE and do we need it now?
FortiSASE provides cloud-delivered security services for remote users, including secure web gateway, ZTNA and CASB capabilities, depending on the subscribed services. You can deploy Fortinet SD-WAN without introducing FortiSASE straight away.
If secure access requirements change, we assess the existing FortiGate models, licences, configuration and integration requirements before recommending the next step.
Can you migrate us from another SD-WAN platform?
Yes. We assess the current platform, redesign the architecture and application policies for FortiGate, then cut over sites simultaneously or in planned phases.
Where the existing architecture supports parallel operation, we keep the old environment available while each site is validated. Each site's legacy service is retired once the FortiGate environment has been stable under production load.
Talk to us before your next FortiGate or WAN change
We can review the FortiGate estate, FortiManager, application paths, failover and current management approach before the next network change.