Configure Custom Applications
Table of Contents
Expand all | Collapse all
-
-
- Add a Branch
- Add a Data Center
- Add a Branch Gateway
- Configure Circuits
- Configure Internet Circuit Underlay Link Aggregation
- Configure Private WAN Underlay Link Quality Aggregation
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Loopback Interface
- Configure a PoE Port
- Configure and Monitor LLDP Activity and Status
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
- VPN Keep-Alives
-
- Configure Prisma SD-WAN IPFIX
- Configure IPFIX Profiles and Templates
- Configure and Attach a Collector Context to a Device Interface in IPFIX
- Configure and Attach a Filter Context to a Device Interface in IPFIX
- Configure Global and Local IPFIX Prefixes
- Flow Information Elements
- Options Information Elements
- Configure the DNS Service on the Prisma SD-WAN Interface
- Configure SNMP
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- View Routing Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
- Prisma SD-WAN Clarity Reports
- Prisma SD-WAN Incidents and Alerts
Configure Custom Applications
Configure custom applications on
Prisma SD-WAN
Layer 3/Layer 4 Applications
- Select.ManageResourcesApplication
- ClickAdd Application.
- Enter aDisplay Name.A suggested application abbreviation displays in theAbbreviationfield.
- SelectNetwork (L3/L4)forIdentification.
- ForUDP Filter Rules, include a mandatory port number, an(optional)DSCP value between 0 to 63, and an(optional)prefix filter.Layer 3 or Layer 4 applications require a port number and a prefix filter.
- ForTCP Filter Rules, include the server port number,(optional)DSCP value between 0 to 63, and(optional)server prefix filter. The list of decimal values for common DSCP names are:Decimal ValueHex ValueMeaning00x00Best effort (CS0 - Default)80x08CS1100x0AAF11120x0CAF12140x0EAF13160x010CS2180x012AF21200x014AF22220x016AF23240x018CS3260x01AAF31280x01CAF32300x01EAF33320x020CS4340x022AF41360x024AF42380x026AF43400x028CS5460x02EExpedited forwarding (EF)480x030CS6560x038CS7Prefix filters with respective ports are required for a custom application. Although it is possible to reuse prefix filters, the ports need to be unique for each custom application.For prefix filters, define one or more IP addresses or subnets. IP addresses within a prefix are defined by the subnet. For example, 10.1.1.0/24 defines the entire limit of 255 IP addresses in that subnet.For global prefix filters, enter an IP and subnet address and for local prefix filters, select a site in addition to entering an IP and subnet address.
- ForIP Rules, choose a protocol, and enter a DSCP marking and a destination prefix filter.
- Select a protocol from theProtocoldrop-down. For example, GRE, or ICMP.
- (Optional)Enter a value in the range of 0 – 63 for DSP.
- Select a prefix filter from theDestination Prefix Filtersdrop-down.Up to eight destination prefixes may be added. You may add a new prefix filter by clickingCreate New Filter, if prefix filters is not already defined.
- Select a prefix filter from theSource Prefix Filtersdrop-down.Up to eight destination prefixes may be added. You may add a new prefix filter by clickingCreate New Filter, if prefix filters is not already defined.
- SelectApply.The new custom application displays underCustom Applications.
Layer 7 Applications
- Select.ManageResourcesApplication
- ClickAdd Application.A suggested application abbreviation displays in theAbbreviationfield.
- SelectApplication L7forIdentification.
- ForDomain, enter a domain name.Domain names are case sensitive. Ensure that the domain name matches the name displayed as per the Server Name Indication (SNI), so thatPrisma SD-WANdetects the application as an L7 custom application.Layer 7 applications require a domain name or URL address. You may add up to 16 domain names. You can accomplish a wildcard match by specifying the parent domain. For example, if you have an application that leverages different sub-domains, a search for the parent domain produces a result with all sub-domains.
- From theApp Categorydrop-down, select a category.
- From theTransfer Typedrop-down, select transfer type to beTransactional,Bulk,Real-Time Audio, orReal-Time Video.The order in which the queues are serviced within a priority level is Real-time audio, Real-time video, Transactional, and Bulk. This selection directly impacts the queue in which the traffic is placed within a priority tier (Platinum, Gold, Silver, or Bronze), as defined in a policy rule.
- Enter anIngress Traffic Percentage.Ingress traffic percentage is the amount of traffic in bytes for a given application received by the ION device in the WAN-to-LAN direction compared to the overall traffic for that application. This percentage determines the weight given to bandwidth capacity and utilization when the system makes path-selection decisions. For example, 50% would provide equal weight to both ingress and egress traffic.
- EnterConnection Idle Timeoutin seconds.Timeout, in terms of resources allocated, is when an application flow is maintained in the system when there is no traffic flow for the application. After the specified timeout, the flow is deleted from the system
- SetPath AffinitytoStrictorNone.
- Strict—If a path selected for a client session is available within a policy, subsequent application sessions from the same client for this application adheres to the originally-selected path.
- None—It is the opposite of strict. Each subsequent client session is free to take any path allowed by policy as long as that path is available within the service level agreement (SLA).
- Use theUsing Unreachability Detectionoption to monitor applications for reachability.Use application reachability to determine if an application is reachable on a given path. This information is useful when making path selection decisions. If an application is considered unreachable on a given path, then that path is not used. If all paths are marked unavailable, then one of the active paths is selected as defined in the application path policy.The ION device continuously monitors the communication between clients (on the LAN side) and servers (on the WAN side). If the ION device determines that a server is not responding to a client's messages on a given path, it triggers the application reachability feature. The ION device actively probes the server on that path to ensure that the server is reachable and responding.The ION device monitors communication only for the TCP flows initiated from the LAN side of the ION device. All TCP applications have unreachability detection enabled by default. When configuring a custom application, this feature can be disabled optionally.
- EnableNetwork Scan Appto designate custom applications as network scan applications.This functionality is disabled by default. Enabling the attribute on an existing custom application applies only for new flows coming in and hitting the application after the configuration is made. Existing flows hitting the custom application do not inherit the configuration,
- SelectApply.The new custom application displays underCustom Applications.