Arista ACE Specialist - WAN Routing: Policy and Traffic Steering

Policy and Traffic Steering

Policy and traffic steering are at the heart of SD-WAN’s value proposition. You must understand how policies are defined (centrally via CloudVision) and enforced (at the edge) to steer traffic based on application, user, or network conditions. Arista’s SD-WAN uses a policy framework that includes match criteria (e.g., application ID, DSCP, source/destination) and actions (e.g., prefer path, backup path, drop). Traffic steering can be static (based on predefined paths) or dynamic (based on real-time metrics).

Traps often involve confusing policy direction (inbound vs. outbound) or misunderstanding the order of policy evaluation. Policies are evaluated top-down, and the first match wins. Another trap is assuming that all traffic is steered by default; in reality, only traffic matching a policy is steered, while other traffic follows the default route. Also, be clear on how policies interact with overlay tunnels: policies determine which tunnel (path) traffic uses.

Worked example / rule of thumb: When writing a policy, always include a default action (e.g., allow or deny) to handle unmatched traffic. For application steering, use the application ID (e.g., Office365) as the match criterion and set the action to prefer a low-latency path. Remember that policies are applied at the edge on ingress or egress, depending on direction.

Key points:

Policies are defined centrally and enforced at the edge.
Match criteria include application ID, DSCP, IP addresses, etc.
Actions include prefer, backup, drop, or allow.
Policies are evaluated top-down; first match wins.
A default action is required for unmatched traffic.

Operations, Observability and Troubleshooting

This domain focuses on the day-to-day management and troubleshooting of an SD-WAN environment. You must understand the tools available for monitoring (CloudVision, Pathfinder dashboards), how to interpret metrics (latency, jitter, loss, throughput), and how to troubleshoot common issues such as tunnel flaps, policy misconfigurations, and routing loops. Arista’s SD-WAN provides extensive telemetry and logging capabilities, often leveraging streaming telemetry for real-time insights.

Traps often involve misinterpreting metrics: for example, high latency might be caused by congestion, but could also be due to path selection. Another trap is assuming that all logs are centralized; some logs remain on the edge device. Also, be clear on the difference between control-plane and data-plane troubleshooting: control-plane issues affect tunnel establishment, while data-plane issues affect packet forwarding. Familiarize yourself with commands like show sdwan tunnel, show sdwan policy, and show sdwan path (conceptual, as exact commands may vary).

Worked example / rule of thumb: When troubleshooting a tunnel that is down, first check underlay reachability (ping between VTEPs), then verify controller connectivity, and finally check policy for any deny actions. Use the Pathfinder dashboard to view real-time path metrics and identify if a path is being avoided due to poor performance.

Key points:

Use CloudVision and Pathfinder for centralized monitoring and telemetry.
Key metrics: latency, jitter, packet loss, throughput.
Troubleshoot tunnels by checking underlay reachability, controller connectivity, and policies.
Differentiate control-plane (tunnel establishment) and data-plane (forwarding) issues.
Streaming telemetry provides real-time visibility.