Association between Fortigate NAT IPPool and SD-WAN

SD-WAN functionality enables Fortigate to choose the best Wan output to an application, perform other QoS and security applications. Also at the level of security policies it is very simple to manage because as the target interface it is only necessary to put “SD-WAN” which will contain all the WAN interfaces that make it up (for practical purposes it works like a Zone)

It is common for these SD-WAN supported security policies to activate NAT output, and Fortigate gives us the option to exit with the IP of the exit interface or exit with an IPPool. However, if you don't associate each IPPool with an interface, connection errors will occur, as Fortigate will assign that IPPool without ordering.

The way to solve this is to associate IPPools objects with a wan interface,

this way, Fortigate knows which one to use at any given moment and for each WAN interface of SD-WAN.

This Example will be done via the CLI.
config firewall ippool

edit "IPPOOL-WAN1"

set startip 1.1.1.1

set endip 1.1.1.1

set arp-intf "wan1"

set associated-interface "wan1"

next

edit "IPPOOL-WAN2"

set startip 2.2.2.2

set endip 2.2.2.2

set arp-intf "wan2"

set associated-interface "wan2"

next

end