To setup PRI behind an SDWAN please follow the below steps in a step by step sequence:



On-premise SDWAN Confiugration:

  1. Configure a Fortinet on-premise device with the basic Configuration (SDWAN, VPN Tunnels, and policy routes).
  2. Untag a LAN port from the internal switch ports to be used for different Subnet.
  3. Configure the LAN port to be used for the customer's local LAN uplink (172.16.10.0/24 Either on DHCP or point to point).
  4. Configure the internal switch interface as 10.30.N.5/24 (To be used for PRI network)
  5. Tag the Fortinet Wireless with the internal Switch (to be used for testing the reachability) 
  6. Create a new outgoing policy for the PRI subnet to go via the AWS Tunnel for MOR private IP.
  7. Create the reverse policy for the PRI subnet to come via the AWS Tunnel.
  8. Define the SDWAN policy route for MOR and define the VPN Tunnel.


PRI GW Configuration:

  1. Configure the PRI gateway Eth interface with 10.30.N.0/24 and GW 10.30.N.5/24
  2. Configure SIP endpoint IP 10.50.1.10
  3. Configure the call routing rules Incoming/outgoing
  4. Configure the PRI Line interface to E1 with United Kingdom ISDN.


On AWS Fortinet Confiugration:

  1. Configure the VPN tunnel for the new on-premise setup.
  2. Configure the normal policies for the Ziwo SDWAN traffic.
  3. Configure the static route for Ziwo SDWAN traffic.
  4. Configure a new additional outgoing policy for the Ziwo PRI Subnet to be received from XYZ Tunnel and the outgoing interface should be marked as GSM-Transit GW NAT should be disabled (this rule should strictly be allowed for PRI subnet only).
  5. Configure a new additional incoming policy for the Ziwo PRI Subnet to be received from GSM-Transit-GW Tunnel and the outgoing interface should be marked as XYZ VPN NAT should be disabled (this rule should strictly be allowed for PRI subnet only).
  6. Whitelist the local PRI Subnet with a static route on the AWS VPC side.
  7. Test the connectivity from the local PC connected behind the on-premise PRI subnet towards MOR private IP 10.50.1.10
  8. Test the connectivity from MOR towards the local PC connected behind the SDWAN PRI Subnet. 
  9. Check the SIP endpoints connectivity on the PRI GW.