I85PREP
⌘ K
FCSS SD-WAN 7.4 Architect study materials
FCSS SD-WAN 7.4 Architect study resources

FCSS SD-WAN 7.4 Architect: Secure SD-WAN Security and Traffic Steering

FCSS SD-WAN 7.4 Architect · Work through your exam, one topic at a time.

All guide sections

Secure SD-WAN Security and Traffic Steering

Secure SD-WAN Security and Traffic Steering

This domain tests how traffic is matched, steered, and inspected. You need to know SD-WAN rule match criteria and order, how firewall policy applies after steering, and how to combine local internet breakout with NGFW inspection.

Core rules and concepts

  • Rule matching. SD-WAN rules are evaluated top-down; the first match wins. Match criteria include source, destination, user or group, application, internet service, protocol and port, DSCP, and input interface. An implicit rule handles unmatched traffic using the routing table.
  • Steering then security. The SD-WAN rule selects the egress member or zone. The firewall policy that permits the SD-WAN zone then applies security profiles such as IPS, application control, antivirus, web filtering, and SSL inspection. Steering does not replace policy.
  • Internet service database. Use ISDB entries for destination-based steering of SaaS and widely used services; they avoid maintaining IP lists. Custom internet services cover internal or regional destinations.
  • Application-based steering. Application control or ISDB can classify traffic for SD-WAN rules. For encrypted traffic, some applications need certificate inspection or deep inspection to be identified reliably.
  • Local breakout versus backhaul. Local breakout sends trusted SaaS traffic directly to the internet with security profiles at the branch; backhaul sends it to a hub or SASE point. Choose per application and compliance requirement.
  • DSCP and reverse marking. SD-WAN rules can match and mark DSCP, and reverse DSCP can preserve marking on return traffic for the provider or the hub.

Worked example

A branch must send Microsoft 365 directly to the internet with IPS and application control, send ERP traffic to the data centre over MPLS, and send all other traffic over the best available link.

  1. Create an SD-WAN rule for Microsoft-365 ISDB with the internet SD-WAN zone as the destination, and place it first.
  2. Create an ERP rule matching the data-centre prefix and the MPLS zone, placed second.
  3. Leave a final catch-all rule using best-quality with an SLA target.
  4. In firewall policy, permit the internet SD-WAN zone for Microsoft 365 with IPS and application control, permit the MPLS zone for ERP with the data-centre profile, and permit the catch-all zone with the standard profile.
  5. Verify rule hits and policy hits separately; a hit on the SD-WAN rule does not prove the traffic was inspected.

Traps

  • Putting a broad catch-all rule before specific SaaS rules; the first match wins and the specific rule is never reached.
  • Steering to an SD-WAN zone that no firewall policy permits, causing silent drops.
  • Assuming SD-WAN application matching works without the application control or ISDB licence and updates.
  • Breaking inspection with asymmetric routing when return traffic uses a different link.