Routing, Policies, and Traffic Steering
What this domain covers
Routing, Policies, and Traffic Steering tests how packets enter the overlay, which path they take, and how QoS treats them. You must separate underlay routing from overlay path selection and know where application workflows, SLA thresholds, breakout, and QoS fit.
Core rules
- Underlay routing: the edge routes to its next hop using static routes, OSPF, or BGP on LAN/WAN. This decides reachability, not which overlay path an application prefers.
- Overlay steering: application workflows (traffic-steering policies) match traffic by application or group, source/destination, VLAN, DSCP, or port. Actions set path preference, fallback, QoS class, breakout, or drop. Policies are evaluated in order; first match wins, so put specific rules above broad ones.
- Dynamic WAN Selection: per-flow measurement of latency, jitter, loss, and throughput compares paths with the SLA objective. A path is eligible only if it meets the threshold; preference order breaks ties.
- Local breakout: sends SaaS or Internet traffic directly from the branch instead of backhauling to a hub. It still needs security policy and return-path design.
- QoS: shaping on the WAN link, queuing by class, and marking. FEC and duplication can protect real-time flows but consume bandwidth.
Worked example
Microsoft Teams must use broadband when it meets latency <150 ms and loss <2%; otherwise it must use MPLS. Guest traffic must break out locally. Create workflow 1: match Teams, real-time QoS, path preference broadband, fallback MPLS, SLA thresholds 150 ms/2%. Create workflow 2: match guest VLAN, action local breakout, low-priority QoS. Place both above a default any-any workflow. If Teams stays on MPLS, check whether the broadband path is actually meeting thresholds, whether the workflow is above the default, and whether the return path is symmetric.
Traps
Expecting the routing table to choose the best overlay path; reversing policy order so a broad rule hides a specific one; forgetting that breakout still needs security; measuring only one direction; and setting an SLA threshold so strict that no path qualifies.