FortiGate SD-WAN SLA Dead: diagnose sys sdwan health-check When the Cheap Link Wins

FortiGate · Techclick CLI troubleshooting lab

Voice should use MPLS. It is riding the cheap broadband link and jitter is ugly. SD-WAN rule looks correct.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on FortiGate for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

If the MPLS health-check is dead, SD-WAN will skip that member. Fix the probe, do not rewrite the rule first.

Why this ticket shows up

SD-WAN rules honor SLA. A failed probe makes a perfect rule send traffic to the backup member.

Symptoms operators actually see

• Preferred member never used

• health-check dead on MPLS

• Probe IP blocked by the provider

• Rule sequence looks right

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

diagnose sys sdwan health-check
diagnose sys sdwan service
diagnose sys sdwan member
diagnose sys sdwan route
execute ping-options source <mpls-ip>
execute ping 8.8.8.8

How to read that output

health-check must be alive on the member you expect. A dead check forces failover even if the circuit can pass real traffic.

Triage order

1. Read health-check state per member

2. Ping the probe IP sourced from that member

3. Change the probe if the old IP is filtered

4. Confirm the service rule still prefers MPLS

5. Test a voice flow and read the selected member

Classic traps

What you see	Real cause	Fix
Rewrite SD-WAN rules	Probe is dead	Fix the probe
Disable SD-WAN	One health-check IP is gone	Pick a better probe
Blame the ISP first	Broadband is selected because MPLS SLA failed	Read the member

Proof the ticket is closed

• MPLS health-check alive

• diagnose sys sdwan service shows MPLS selected

• Jitter drops

Say this in an interview

I read SD-WAN health-check before I redesign rules. Dead SLA makes the 'wrong' link correct.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/