Use Case 2 - Protect a Business Critical Enterprise Application
Table of Contents
Expand all | Collapse all
-
-
- Add a Branch
- Add a Data Center
- Add a Branch Gateway
- Configure Circuits
- Configure Internet Circuit Underlay Link Aggregation
- Configure Private WAN Underlay Link Quality Aggregation
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Loopback Interface
- Configure a PoE Port
- Configure and Monitor LLDP Activity and Status
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
- VPN Keep-Alives
-
- Configure Prisma SD-WAN IPFIX
- Configure IPFIX Profiles and Templates
- Configure and Attach a Collector Context to a Device Interface in IPFIX
- Configure and Attach a Filter Context to a Device Interface in IPFIX
- Configure Global and Local IPFIX Prefixes
- Flow Information Elements
- Options Information Elements
- Configure the DNS Service on the Prisma SD-WAN Interface
- Configure SNMP
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- View Routing Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
- Prisma SD-WAN Clarity Reports
- Prisma SD-WAN Incidents and Alerts
Use Case 2 - Protect a Business Critical Enterprise Application
Use Case 2: Protect a Business Critical Enterprise Application
Where Can I Use
This? | What Do I
Need? |
---|---|
|
|
- Active Paths: Prisma SD-WAN VPN on Primary Internet.
- Backup Paths: None
- L3 Failure Paths: Prisma SD-WAN VPN on Metered 5G.
Performance Policy Intent
- Use the Active Path as long as it is available.
- Use Link Quality Monitoring (LQM) information available from the Branch to Data Center VPNs, to adaptively control Forward Error Correction (FEC) for any observed packet loss.
- Use only the L3 Failure Path if the active path is down, not degraded.
Configure the Policy
Rule
- Select the target policy set from.ManagePrisma SD-WANPoliciesPerformance
- SelectAdd Ruleand enter theNameasWebPoS,Description(optional), and theOrder Number(optional).More specific rules should be organized at the top of the Policy Set list, else a less specific policy rule may be matched first.
- In theActionssection, selectForward Error Correction (FEC)andMove Flows.
- In theMatch Criteriasection, underApp Filters, select the applicationWebPoSfrom the drop-down, select the category inPath FiltersasAll PublicandAll Private.
- Select thePath TypeasPrisma SD-WAN VPN.
- In thePerformance SLAssection, clickAdd New, and check the optionLink Quality Metrics. Now, enter theSLA NameasWebPoS.
- InLink Quality Metrics, enter theJittervalue as 50 ms.On a per-branch circuit basis, this will utilize the best (lowest) measured Jitter value between the Branch and all Data Centers.
- Click the+sign to enter theLatencyvalue as 150 ms.On a per-branch circuit basis, this will utilize the best (lowest) measured Latency value between the Branch and all Data Centers.
- Click the+sign to enter thePacket Lossvalue as 1%.On a per-branch circuit basis, this will utilize the best (lowest) measured Packet Loss value between the Branch and all Data Centers.
- Advanced Settingsdo not apply since theCreate Incidentsaction was not specified.
- Review theSummaryof the policy settings for the desired policy intent andSave & Exit.
Monitor the Policy Intent
- Link Quality Monitoring: The performance of the Prisma SD-WAN VPN (Secure Fabric Link) between the Branch and Data Center can be inspected by navigating to. This view details the performance characteristics of the Secure Fabric VPN tunnel between the Branch and Data Center over time and reveals that loss is consistently high.MonitorApplicationsPrisma SD-WAN{Branch Site Name}{CircuitName}{Secure Fabric Name}
- Application Monitoring: You can view the site-level impact of Forward Error Correction (FEC) on the WebPoS application by navigating to. This view presents numerous data points reflecting the true health of the application at the site. Focusing on theMonitorApplicationsPrisma SD-WANWebPoS (Branch Site Name)Application Statistics Datareveals an effective 0% rate for Init Failures (3-way handshake) and Transaction Failures (TCP retransmission).
- TheTransaction Statswidget details the Init and Transaction statistics over time.
- TheApp Reachabilitywidget displays the application reachability status over time per WAN transport type, detailing good App Reachability.
- Flow Browser:Flow Browser provides a detailed per flow account for all aspects of the app session, including the conditions at the time and actions taken to meet the configured SLA. Near the bottom of theApplication Detailsscreen in the Flows section, select theFlow Detailfor the WebPoS application in the Flow Browser, then click onAdvanced Info.
- The Flow Decision Data indicates High Packet Loss on the Active Path.
- As there are no other configured Active Paths nor Backup Paths, Forward Error Correction (FEC) is applied to the flow.
- Summary: Implementing the Performance Policy rule for WebPoS ensures an optimal end-user experience by mitigating a consistent ~5% rate of transport packet loss down to 0% for the application sessions. The impact of the Protect WebPoS rule is easily monitored using the App Site Details, Link Quality Metrics, and Flow Browser.