Citrix SD-WAN Security, High Availability, and Troubleshooting
This domain covers the security features available at the branch, the HA models for SD-WAN appliances, and the diagnostic workflow when traffic stops. Questions often present a link that is up but a tunnel or application that is down.
Security
- Zone-based firewall policies control traffic between LAN, WAN, and overlay zones. Policies are evaluated by zone pair and rule order.
- IPS and URL filtering add inspection beyond stateful firewall rules; they depend on licensing and signature updates.
- IPSec protects overlay traffic. Control-plane connectivity and data-plane tunnels are separate; a registered node can still have a failed tunnel.
- Keep management access on a dedicated VLAN and restrict it by source.
High availability
- SD-WAN HA pairs are typically active-standby with VRRP or equivalent virtual IP ownership. Failover can be triggered by appliance health, link health, or path health depending on configuration.
- Test failover by disabling a WAN link and by rebooting the active node; they exercise different mechanisms.
- SD-WAN Center and orchestration must still reach the surviving node's management address.
Troubleshooting
- Check link status, virtual path status, IPSec SA status, route table, ARP, and firewall counters in that order.
- Use built-in diagnostics and packet capture at both ends; one-sided captures mislead when the return path differs.
- Verify NTP and licensing early; clock skew breaks certificates and logs, and expired licenses disable features.
Worked example
A branch has a green WAN link but no application traffic. The virtual path shows down and the IPSec SA is not established. Check the peer address, pre-shared key or certificate, and whether the underlay route to the peer exists. Reasoning: link-up only proves layer 1/2; virtual path and SA state prove the overlay, and the underlay route is the most common missing prerequisite.
Traps that cost marks
- Reading "link up" as "path up."
- Forgetting that firewall rules are zone-pair and order dependent.
- Testing HA only by reboot and never by link failure.
- Capturing packets on one side only.
- Ignoring NTP and license expiry during mysterious security or feature failures.