FortiGate SD-WAN + EIGRP — Enterprise Network Simulation

Project 08 — Network Lab

FortiGate SD-WAN + EIGRP — Enterprise Network Simulation

A full enterprise network simulation built inside EVE-NG using two FortiGate firewalls, two Cisco IOS routers, managed switches, Linux clients, and an app server — connected through a virtual SD-WAN fabric with dynamic EIGRP routing and FortiGate security policies.

EVE-NG Lab Topology

Platform ► EVE-NG Community Edition — Windows Host

Devices ► FortiGate-HQ · FortiGate-Branch1 · Router-HQ · Router-Branch1 · Switch-HQ · Switch-Branch1 · App-Server-HQ · Client-HQ · Client-Branch1

OS ► FortiOS 7.x · Cisco IOSv · Ubuntu Server (QEMU)

Subnets ► 192.168.10.0/24 (HQ LAN) · 192.168.20.0/24 (Branch LAN) · 10.0.x.0/30 (WAN links)

EIGRP Dynamic Routing

Configured EIGRP AS 10 on both Cisco routers across dual WAN links. Used passive interfaces on LAN-facing ports. Verified neighbor adjacency on Gi0/2 and Gi0/3, and confirmed EIGRP-learned routes with dual equal-cost paths.

EIGRP Neighbors show ip protocols show ip route eigrp

Protocol ► EIGRP AS 10

Links ► Gi0/2 (10.0.5.0/30) · Gi0/3 (10.0.6.0/30)

Result ► Dual adjacency confirmed — ECMP paths active

FortiGate SD-WAN Configuration

Configured SD-WAN on both FortiGate units with a virtual-wan-link zone. Created Performance SLA probes using ICMP ping on both firewalls. Built SD-WAN rules using latency-based criteria. Verified via CLI: 0% packet loss, ~2ms latency, jitter under 2ms, MOS 4.4.

SD-WAN Zone HQ SD-WAN Zone Branch SD-WAN Rule Performance SLA HQ Performance SLA Branch SD-WAN CLI Health Check

SD-WAN Zone ► virtual-wan-link — port3

SLA Probes ► SLA_Branch1 (HQ) · SLAHQ (Branch) — Ping · Threshold 5/5

CLI Result ► state(alive) · packet-loss(0.000%) · latency(2.289ms) · MOS(4.401)

Firewall Policies

Defined bidirectional firewall policies on both FortiGate units covering LAN-to-Internet with NAT, LAN-to-Branch with AV and IPS profiles, and return Branch-to-LAN traffic.

FortiGate HQ Firewall Policy FortiGate Branch Firewall Policy

Policies ► LAN-to-Internet (NAT) · LAN-to-Branch (AV + IPS) · Branch-to-LAN

Security Profiles ► AV default · IPS default · SSL no-inspection

End-to-End Throughput Testing — iperf3

Ran iperf3 between App-Server-HQ and Client-Branch1 across the full SD-WAN path. Confirmed 0% packet loss on ping. The 30-second TCP test achieved ~940 Kbits/sec with 3.38 MB transferred.

iperf3 throughput test

Tool ► iperf3 — Ubuntu Server / QEMU

Result ► ~940 Kbits/sec · 3.38 MB transferred · 0% packet loss

← Back to projects