Anyone actually using FortiGate in production for SD-WAN?

Hey everyone! 👋 I've been knee-deep in a FortiGate 200F deployment for the last six months, specifically using its SD-WAN features to replace a traditional dual-MPLS setup. The datasheet and feature list look great, but I'm curious about real-world, day-to-day production experiences.

What's working well for us so far:
* The performance-based routing is solid. We use SLA probes to critical SaaS IPs (like O365 endpoints) and it fails over from a flaky internet link surprisingly fast.
* The integration with security profiles means all our traffic gets inspected, even across multiple WAN paths, without needing separate boxes.
* Configuring basic load-balancing rules was straightforward in the GUI.

But I've hit a few snags that feel like "gotchas," especially around more advanced logic:
* The `internet-service` database for application-aware routing is powerful, but keeping it updated and ensuring it matches our internal app signatures feels like a moving target.
* I've had to write some less-than-elegant CLI scripts to handle edge cases. For example, here's a snippet to log when a specific performance SLA fails, because the GUI logging wasn't granular enough:

```bash
config system sdwan
config zone
edit "virtual-wan"
set service-sla-track-health 1
next
end
config health-check
edit "Probe_to_Cloud_App"
set detect-mode passive
set update-static-route disable
set members 1 2
config sla
edit 1
set latency-threshold 100
set jitter-threshold 40
set packetloss-threshold 5
next
end
next
end
end
```

* The HA (A-P) sync for SD-WAN rules has mostly been fine, but we saw a weird blip during a firmware upgrade where session persistence broke for a few minutes.

**My questions for the community:**
1. Are you using the SD-WAN features for critical production traffic, or just for best-effort internet breakout?
2. How do you handle testing and validation of new SD-WAN rules before pushing to production? Any tips for a staging workflow?
3. Have you found the application-based routing (`internet-service` or `application` rules) reliable enough to trust for L7 steering?
4. Any major pitfalls when scaling beyond, say, 10-15 branch offices?

I'd love to compare notes and learn from your setups!