SDWAN Multi-WAN (Load Balance & Failover)

Navigation: Scenarios → SDWAN Multi-WAN

Configure SDWAN → Multi-WAN to use two or more internet uplinks with weighted load balancing, priority-based failover, or a combination. Health probes (Ping / TCP / UDP) monitor each link; the firewall selects the active path per session based on Weight and Priority.

Network design

Figure 1 — Dual-WAN topology with load balance and failover modes

Reference topology

Multi-WAN form — all fields explained

Go to SDWAN → Multi-WAN → + Add New (one record per WAN link).

Health monitoring (link status)

The firewall probes each enabled link continuously. Status appears in Logs & Events → M-WAN Logs:

A link marked DOWN in OVERALL is removed from load balancing and skipped in failover until probes recover.

Step 1 — Configure WAN interfaces

Before Multi-WAN, each uplink must exist under Network Settings → Interfaces:

See Network Interfaces.

Step 2 — Add Multi-WAN links

Go to SDWAN → Multi-WAN and add one row per WAN link.

Mode A — Equal load balance (50 / 50)

Distribute new sessions evenly across both healthy links.

Form values

How it works: Equal weights with the same priority → SDWAN engine splits new flows ~50% on each link. Existing sessions stay on the link they started on (stateful).

Packet flow

Figure 2 — Flow A and Flow B take different WAN paths

LAN PC ──► TOORCE-FW ──┬── 50% ──► WAN1 (enp9s0) ──► Internet
                       └── 50% ──► WAN2 (enp8s0) ──► Internet

Mode B — Failover (active / standby)

Use WAN1 only while healthy; switch all new traffic to WAN2 when WAN1 probes fail.

Form values

How it works: Priority 1 is the active link. When OVERALL = DOWN on WAN1, the firewall fails over to the next enabled link with Priority 2. WAN2 stays idle until needed.

Packet flow

Figure 3 — Normal path on WAN1; automatic switch to WAN2 after probe failure

Normal:    LAN ──► FW ──► WAN1 (Pri 1) ──► Internet     WAN2 standby
Failover:  LAN ──► FW ──► WAN2 (Pri 2) ──► Internet     WAN1 DOWN

Verify failover events under M-WAN Logs → Failover Events tab.

Mode C — Weighted load balance (70 / 30)

Send most traffic on the faster/cheaper link but keep the second link active for extra capacity.

Form values

Share calculation: 70 / (70+30) = 70% on WAN1 · 30 / (70+30) = 30% on WAN2

Packet flow

Figure 4 — Seven of ten new sessions on WAN1, three on WAN2

LAN ──► FW ──┬── 70% ──► WAN1 Fiber ──► Internet
             └── 30% ──► WAN2 LTE   ──► Internet

Mode D — Policy-based WAN (inline rule SDWAN profile)

Force specific traffic onto a chosen WAN link regardless of global weights.

1. Create Multi-WAN links (Modes A–C above).
2. Go to Rules & Policies → Inline Rules → + Add New.
3. On NAT/SDWAN tab, select SDWAN Profile matching the desired link/profile.
4. Example: Force_VoIP_WAN1 rule → SDWAN profile bound to enp9s0 only.

Step 3 — Default route and NAT

Ensure LAN traffic can exit via SDWAN:

1. Default route 0.0.0.0/0 via SDWAN-managed gateways (or per-link routes).
2. Inline rule with SNAT — see NAT Gateway.

Step 4 — Verify and monitor

Monitor link status, PING/TCP/UDP probes, OVERALL health, and ACTIVE LINK in Logs & Events → M-WAN Logs.

Mode comparison summary

Troubleshooting

Related topics

• Multi-WAN (SDWAN)
• M-WAN Logs
• Inline Rules — SDWAN profile
• Network Interfaces
• NAT Gateway
• All Scenarios