Fortinet SD-WAN: Security-Driven Networking in Practice
Fortinet occupies an unusual position in the SD-WAN market. It did not build a standalone SD-WAN product and later add security to it — nor did it acquire a WAN optimization vendor and rebrand the technology. Instead, Fortinet embedded SD-WAN capabilities directly into FortiOS, the same operating system that runs its NGFW, IPS, SSL inspection, and application control functions. The result is an architecture the company calls security-driven networking, and it has made Fortinet one of the leading positions in Gartner’s SD-WAN Magic Quadrant for multiple consecutive years.
This article examines what Fortinet’s approach actually delivers, where it is strongest, and what trade-offs it involves.
The FortiOS Foundation
The critical distinction in Fortinet’s SD-WAN is that there is no separate SD-WAN daemon or overlay software layer. SD-WAN is a native function of FortiOS, running on the same kernel as the firewall, the IPS engine, and the application identification engine.
This has a concrete architectural implication: every packet that enters a FortiGate for SD-WAN routing is also inspected by the security stack. There is no performance penalty for enabling security alongside SD-WAN because they share the same processing pipeline. On hardware appliances with Fortinet’s custom ASICs (NP7, SP5), both SD-WAN traffic steering and security inspection are hardware-accelerated simultaneously.
In practice, this means a branch FortiGate can:
- Identify the application using DPI (the same DPI engine used for firewall policies)
- Apply SD-WAN path selection based on application identity and real-time link quality
- Simultaneously run full NGFW inspection on the same traffic
- Apply SSL deep inspection without a separate appliance
Competing vendors that sell SD-WAN and security as separate products — whether physically separate devices or separate software modules — introduce either additional latency, additional cost, or both. Fortinet’s single-OS approach eliminates that architectural friction.
SD-WAN Traffic Steering: How FortiOS Does It
Fortinet’s SD-WAN traffic steering is built around three concepts:
SD-WAN Rules Policies that match traffic by application, user, source/destination, or DSCP marking, and assign it to an SD-WAN interface group (a logical grouping of WAN links). Rules are evaluated top-down, similar to firewall policies.
Performance SLAs Continuous active monitoring of each WAN link using configurable probes (ICMP, HTTP, DNS). FortiOS measures latency, jitter, and packet loss in real time and compares them against defined thresholds. When a link degrades below threshold, it is automatically removed from consideration for SLA-sensitive applications.
Link Cost and Bandwidth Management Beyond performance-based steering, FortiOS supports load balancing across links using weighted distribution, spillover (use secondary link when primary exceeds a bandwidth threshold), and volume-based billing management for links with data caps.
The steering decision happens at the kernel level, not in a user-space process, which keeps forwarding latency minimal even at high throughput.
Gartner Magic Quadrant Positioning
Fortinet has been positioned in the Leaders quadrant of Gartner’s Magic Quadrant for SD-WAN for several consecutive years, typically cited for:
- Completeness of vision: integrated security and SD-WAN, SASE roadmap, global threat intelligence from FortiGuard Labs
- Ability to execute: large installed base, broad partner ecosystem, consistent delivery across hardware tiers from small-branch FG-40F to data-center-class appliances
The most consistent analyst criticism is around management complexity at scale and the learning curve for organizations that are not already Fortinet shops. FortiManager is a capable centralized management platform, but its interface is dense and requires investment to operate effectively. Organizations without existing Fortinet expertise should factor this into their evaluation.
FortiManager and Centralized Orchestration
Large SD-WAN deployments require centralized orchestration — you cannot configure hundreds of branch appliances individually. FortiManager is Fortinet’s on-premises (or cloud-hosted) management platform for this.
FortiManager provides:
- Template-based configuration with device-specific variable substitution
- SD-WAN overlay provisioning (hub-and-spoke, full-mesh, or hybrid topologies)
- Centralized performance SLA monitoring across all sites
- Policy packages that can be applied to groups of devices
- Automated provisioning workflows (zero-touch provisioning for new sites)
The zero-touch provisioning capability is particularly relevant for large rollouts. A new FortiGate at a branch boots, contacts the FortiManager registration server, authenticates with a pre-shared serial number, and automatically receives its configuration. A network engineer can provision a new branch site without ever touching the device physically beyond connecting the WAN cables.
FortiAnalyzer works alongside FortiManager for log aggregation, reporting, and SD-WAN application performance analytics.
SASE Integration: Fortinet’s Cloud-Delivered Extension
Fortinet extends its SD-WAN architecture into a SASE offering through FortiSASE — a cloud-delivered security service that provides secure internet access for remote users and branch offices without requiring all traffic to backhaul through a physical FortiGate.
FortiSASE includes cloud-delivered NGFW, secure web gateway, CASB, ZTNA, and DNS filtering functions, all managed through the same FortiOS policy model familiar to Fortinet administrators. For organizations that have invested in FortiOS expertise, the operational consistency across on-premises and cloud-delivered security is a genuine advantage.
Where Fortinet SD-WAN Excels
Security-first environments If the primary WAN requirement is not just connectivity but also threat prevention, SSL inspection, and application control, Fortinet’s integrated model eliminates the need to size, deploy, and manage separate security appliances at each branch. Total cost of ownership is often lower than a competing SD-WAN appliance plus a separate NGFW.
FortiGate installed base Organizations that already run FortiGate firewalls at their sites can often enable SD-WAN functions on existing hardware with a licensing change. This dramatically reduces migration friction compared to ripping out existing devices and deploying a new SD-WAN overlay.
Mid-market and distributed branch deployments Fortinet’s hardware range extends down to very compact, cost-effective appliances suitable for retail locations, small branch offices, and even industrial environments. The FG-40F and FG-60F cover the small branch segment at a price point that dedicated SD-WAN vendors often cannot match while maintaining the same FortiOS feature set.
High-throughput sites requiring security At higher-end appliances, Fortinet’s custom ASICs provide hardware-accelerated throughput for both SD-WAN and security functions simultaneously. Sites requiring multi-gigabit throughput with full security inspection are well served by the FortiGate hardware line.
Where Fortinet SD-WAN Has Limitations
Not a pure-play SD-WAN Organizations evaluating SD-WAN purely on WAN optimization metrics — sophisticated application acceleration, WAN deduplication, advanced TCP optimization — will find dedicated SD-WAN vendors like Silver Peak (now HPE Aruba) historically offered more granular WAN optimization capabilities. Fortinet’s strength is the security integration, not deep WAN optimization.
Management complexity FortiManager is powerful but complex. Small organizations or those without dedicated network engineering staff may find the management overhead significant. Simpler cloud-managed alternatives may be more appropriate in those environments.
Vendor lock-in The tight FortiOS integration is a strength in Fortinet environments and a constraint in multi-vendor environments. Organizations running Cisco switching, Aruba wireless, and Palo Alto firewalls may find Fortinet’s SD-WAN harder to integrate cleanly than a vendor-agnostic overlay.
Typical Deployment Architecture
A standard Fortinet SD-WAN hub-and-spoke deployment looks like this:
- Hub sites (data center or regional hub): FortiGate with two or more WAN links, running as SD-WAN hub and SD-WAN gateway for spoke sites. FortiManager manages configuration centrally.
- Spoke sites (branch offices): FortiGate appliances with dual WAN (e.g., MPLS + broadband). Zero-touch provisioned via FortiManager. SD-WAN rules steer application traffic to optimal path. Local internet breakout for cloud applications.
- Remote users: FortiClient VPN or FortiSASE for cloud-delivered secure access.
Overlay tunnels between spokes and hubs use IPsec with automatic key management. FortiOS supports both static tunnel and dynamic tunnel (ADVPN — Auto Discovery VPN) topologies, where spoke-to-spoke traffic can establish direct tunnels on demand rather than always routing through the hub.
Summary
Fortinet’s SD-WAN is the right choice when security and SD-WAN need to be a unified function rather than adjacent products. The FortiOS integration delivers genuine operational and cost advantages for organizations willing to invest in the platform. The same DPI that identifies applications for traffic steering is the DPI that enforces firewall policy — no duplication, no performance penalty.
The trade-off is ecosystem commitment. Fortinet SD-WAN works best in Fortinet environments. Organizations with significant existing investments in other vendors’ security infrastructure should evaluate whether the FortiOS-centric model creates more complexity than it solves.
For the Gartner Magic Quadrant, Fortinet’s consistent Leaders placement reflects a platform that delivers on its core promise: security and connectivity from a single operating system, at scale, across hundreds or thousands of sites.
Next in this series: Cisco SD-WAN — Catalyst SD-WAN and the Enterprise Architecture Approach