SD-WAN
SD-WAN tests application-aware branch networking: how to steer traffic across multiple WAN links based on application SLA, not just link state.
Core rules
- ION devices sit at branches and build overlay tunnels over MPLS, broadband, and LTE links.
- The Prisma SD-WAN Controller manages fabric and policy; devices use the controller for configuration and telemetry.
- Application definitions classify traffic by app signatures, IP/port, or custom match.
- Path quality profiles define latency, jitter, and loss thresholds; application SLA ties an app to those thresholds.
- Network rules decide which traffic uses which path/topology; QoS rules shape and prioritize.
- Direct internet breakout sends SaaS traffic locally instead of backhauling to a data center, while security policy can be enforced in Prisma Access.
Policy order
The exam often tests order: match traffic, apply path selection/SLA, then QoS/security. A common model is network rules first, then path quality/application SLA, then QoS. If a rule sends voice to “best available” without an SLA, the branch may choose a high-bandwidth but high-jitter link.
Worked example
Voice requires latency < 150 ms, jitter < 30 ms, loss < 1%. The branch has MPLS (stable, 40 ms) and broadband (200 Mbps, 80 ms latency, 12 ms jitter, 2% loss). The SLA profile marks broadband out of compliance for voice. Path selection keeps voice on MPLS; bulk backup traffic can use broadband. Reasoning: SD-WAN chooses per application and per SLA, not by bandwidth alone.
Traps
- Treating SD-WAN as simple active/active link load balancing.
- Ignoring policy order and QoS.
- Confusing Prisma SD-WAN with PAN-OS SD-WAN features.
- Forgetting underlay vs overlay: tunnels ride WAN links, not replace them.