SD-WAN Policy and Traffic Management
SD-WAN Policy and Traffic Management
Expect questions on centralized versus local policy, the order policy components are evaluated, application-aware routing with SLA classes, and direct internet access.
Centralized policy building blocks
- Lists - site, VPN, data prefix, application or application family, SLA class, TLOC/color. Everything else references lists.
- Topology - hub-and-spoke, full mesh, partial mesh or custom, applied to sites.
- VPN membership - which sites import and export which VPNs.
- Application route (AAR) - matches applications to an SLA class and picks a compliant tunnel.
- Traffic flow (data policy) - match prefixes or apps, then accept, drop, NAT, set DSCP, count, or redirect to a service.
- Cflowd and control - flow export, and OMP route manipulation at vSmart.
A centralized policy does nothing until activated; it is then pushed to the site list over OMP. Local policy lives on the edge for route and data decisions that should not depend on vSmart.
Application-aware routing
An SLA class sets latency, jitter and loss thresholds. BFD must run on every candidate tunnel, because the edge measures each tunnel continuously and picks the path meeting the SLA for that flow. If none qualifies it falls back to the best path unless strict mode is set. Classification requires the application to be recognized, so DPI must be enabled on cEdge.
Direct internet access
A data policy in a service VPN matches internet-bound traffic and applies a NAT action, sending it out the VPN 0 transport interface. The transport needs NAT configured and a default route in VPN 0.
Worked example
Voice must prefer MPLS but fail over to internet. Create an SLA class: latency 150 ms, jitter 30 ms, loss 1%. Create an application list holding the voice application family, and a centralized app-route policy matching VPN 10 plus that list with the SLA class and a backup preference. After activation BFD probes run per tunnel; when MPLS loss exceeds 1%, new voice flows move to biz-internet, while established flows stay sticky until re-evaluated.
Traps
- AAR with BFD disabled on a transport leaves that transport out of the decision.
- Thresholds tighter than the probe behavior produces flapping decisions.
- Forgetting to activate the policy, or applying it to an empty site list.
- Confusing topology policy (who talks to whom) with data policy (what happens to a packet).