Security topology · 05

SD-WAN and Multi-WAN

Access and security only matter if the path stays up. A head orchestrates the overlay. Each leg receives that config and puts it into effect. Multi-WAN watches the links under the overlay and takes a dead one out of the choice.

Flow from a branch through TOORCE to an active WAN, with a standby link used when the probe fails — The active link is the one whose probe is up and whose priority is best. When that probe fails, sessions move to the next healthy link. Weight shares traffic when more than one link is healthy.

Head and leg

The head decides. The leg applies it.

One appliance is the head, the orchestrator. Every other site is a leg, the endpoint. The head does not ask an operator to type each serial and each route by hand. It finds the legs, pushes one profile, and the leg installs what it received.

Head

The orchestrator. It floods discovery, keeps the topology, holds the profiles, and pushes routes, routing rules, and the secure-tunnel settings to each leg that has a profile.

Leg

The endpoint. It answers discovery, adds itself to the path, and implements the push: overlay routes, policy rules, and the TOORCE Secure Tunnel when the profile says to provision it.

1 Auto-discover
The head floods discovery. A leg answers, is recorded, and is allowed into the overlay. With discovery off, the leg uses a pinned head instead of the flood.
2 Auto-provision
A leg with an active profile receives that profile. The secure tunnel can be provisioned from the same push. A leg with no profile stays in the topology and gets no routes.
3 Detect a change
A link down, a link up, an address change, a neighbor that goes quiet, or a new routing rule is noticed. The old topology link is marked down.
4 Act
Discovery runs again. The head pushes the current profile. The leg installs routes and rules only when they differ from what is already in effect.

Head orchestrates discovery and a config push. The leg applies routes, rules, and the secure tunnel. A topology or rule change starts the cycle again. — The working cycle. Discover, then provision, then watch. A topology change or a routing-rule change sends a new config, and the leg acts on it.

Logical topology

The map draws every path it learned

Discovery builds a logical map, and that map is drawn. Each line is a connectivity path between a head and a leg. A second way to the same site is drawn as its own line, so the redundant path stays visible. When the links return to a node already on the path, that ring is a loop: it is detected and drawn, and an attachment that would send traffic around it is refused.

Connectivity path

A direct one-hop path from a leg to a head is drawn as a solid line. A path that reaches the head through another site is drawn dashed.

Redundant path

A second link to the same site, such as the other MPLS connection on a head, or a path through the second head. It is drawn beside the first, in its own color.

Loop

The links come back to a node already on the path. The ring is drawn on the map. Saving an overlay hop that would close that loop is refused, so traffic is not sent around it.

Logical map of two heads and four legs. Each head has two MPLS links. Green lines are connectivity paths, a dashed line is a redundant path from Leg 2 to Head B, and a rose ring between Leg 1 and Leg 2 is a detected loop. — Example: Head A and Head B, with Leg 1 through Leg 4. Each head has MPLS 1 and MPLS 2. Green is a connectivity path, the dashed line is a redundant path, and the rose ring is a loop that is detected and drawn.

What chooses the path

A route is not only a destination network. The profile the head pushes can send traffic by the source address, the destination address, a network application, an internet application, or an application you define.

Source and destination

Match the source address, the destination address, or both. A protocol and a port can narrow the same rule, so one subnet can take a different path from the rest of the site.

Network applications

Voice (SIP and RTP), RDP, SSH, DNS, and the other named network applications match by protocol and port. Each one can prefer its own path.

Internet applications

Facebook, YouTube, Google, Microsoft 365, and the other named sites match by their domain names. That traffic can leave on a different link from the rest of the internet.

Your application

A custom network application is an address and a port you set. A custom internet application is the domain list you set. Neither has to be in the built-in catalog.

A session is matched by source address, destination address, a network application, an internet application, or a custom application, then sent on the chosen path — The head stores the match. The leg installs it. Voice, RDP, YouTube, or a custom application can each take a different path.

Over the internet

The data plane rides a TOORCE Secure Tunnel

When the path between a leg and the head is the internet, the two appliances agree a tunnel before user traffic crosses it. The profile on the head is what turns that requirement on. A private overlay path does not need the same tunnel unless the profile enforces it there too.

1 Internet path
Discovery has a direct path to the head, with no private overlay neighbor on that link.
2 Leg asks
The leg sends its identity and the local networks that must be reached. It tries each head it can already reach.
3 Head answers
If the profile enforces the tunnel, the head builds it for that leg and opens the listener on the interface the request arrived on. Named listeners are used when the profile sets them.
4 Data plane
The leg brings the tunnel up. Site networks travel inside it. Prefixes that overlap the head are left out. The leg reports when the tunnel is up or down.

A leg and a head negotiate a TOORCE Secure Tunnel over the internet, then site traffic stays inside that tunnel — Auto negotiation over the internet. The leg asks, the head answers, and the data plane stays inside the TOORCE Secure Tunnel.

Two jobs, one result

The head, the legs, and the paths between them are the overlay. The profile on the head chooses the path: appended static routes, or an automatic choice of the shortest or lowest-latency path that discovery found. Multi-WAN is the health of the underlay. Each link can be probed with ping, TCP, or UDP, and watched for bandwidth. Priority (lower is preferred) and weight (higher carries more) decide which healthy gateway is used.

FortiGate SD-WAN and Palo Alto SD-WAN / Path Quality Monitoring sell the same outcome, often tied to their own overlay license and cloud orchestrator. TOORCE runs the overlay and the link monitor on the appliance: neighbor discovery, policy routes in their own routing tables, TOORCE Secure Tunnel legs where the underlay is not trusted, and a monitor that marks a link down when the probe fails.

What the business gets

A branch keeps working when one ISP fails, without someone moving a default route by hand.
Voice, RDP, YouTube, Facebook, or a custom application can prefer a path, while everything else takes another link.
A link is judged by more than “the interface is up”: it must answer ping, a TCP port, or a UDP probe, and it can be limited by bandwidth.
A new site is discovered and allowed, then receives its profile. A topology change or a routing-rule change is pushed again, and the leg applies it.
The logical map shows each connectivity path, a redundant path as its own line, and a loop when the links return to a node already on the path.

How it works

The head service floods discovery, records each leg, and draws that result as a logical map: each connectivity path, a second line when a redundant path exists, and a ring when the links loop. An overlay hop that would close that loop is refused. The head pushes the assigned profile on the same session that closed the topology. The leg installs the overlay routes and the routing rules. When the profile enforces a tunnel, the leg asks the head for it, the head returns a tunnel built for that leg, and site traffic uses that TOORCE Secure Tunnel. If the link, the neighbor, or the rules change, discovery starts again and the leg replaces only what differs. The Multi-WAN monitor reads each link’s probes and the gateway table, then treats a link as usable only when the enabled checks succeed. Failover, load balancing, and weighted use are the three outcomes of that table.

Open the Multi-WAN guide