>
    Strata Copilot
    Use Case 2 - Protect a Business Critical Enterprise Application
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma SD-WAN
    3. Prisma SD-WAN Administrator’s Guide
    4. Prisma SD-WAN Performance Policy
    5. Performance Policy Use Cases
    6. Use Case 2 - Protect a Business Critical Enterprise Application
    Download PDF
    Prisma SD-WAN

    Use Case 2 - Protect a Business Critical Enterprise Application

    Table of Contents

    Use Case 2 - Protect a Business Critical Enterprise Application

    Use Case 2: Protect a Business Critical Enterprise Application
    Where Can I Use This?What Do I Need?
    • Prisma SD-WAN (Managed by Strata Cloud Manager)
    • Prisma SD-WAN
    In this scenario, the business uses the application WebPoS for Point of Sale, and it is hosted in the corporate Data Centers. WebPoS can tolerate moderate levels of latency and jitter, but packet loss can affect the end-user experience, leading to failures in order processing. WebPoS is configured with these Path Policy rules:
    • Active Paths: Prisma SD-WAN VPN on Primary Internet.
    • Backup Paths: None
    • L3 Failure Paths: Prisma SD-WAN VPN on Metered 5G.
    Performance Policy Intent
    • Use the Active Path as long as it is available.
    • Use Link Quality Monitoring (LQM) information available from the Branch to Data Center VPNs, to adaptively control Forward Error Correction (FEC) for any observed packet loss.
    • Use only the L3 Failure Path if the active path is down, not degraded.
    Configure the Policy Rule
    1. Select the target policy set from ConfigurationPrisma SD-WANPoliciesPerformance.
    2. Select Add Rule and enter the Name as WebPoS, Description (optional), and the Order Number (optional).
      More specific rules should be organized at the top of the Policy Set list, else a less specific policy rule may be matched first.
    3. In the Actions section, select Forward Error Correction (FEC) and Move Flows.
    4. In the Match Criteria section, under App Filters, select the application WebPoS from the drop-down, select the category in Path Filters as All Public and All Private.
    5. Select the Path Type as Prisma SD-WAN VPN.
    6. In the Performance SLAs section, click Add New, and check the option Link Quality Metrics. Now, enter the SLA Name as WebPoS.
    7. In Link Quality Metrics, enter the Jitter value as 50 ms.
      On a per-branch circuit basis, this will utilize the best (lowest) measured Jitter value between the Branch and all Data Centers.
    8. Click the + sign to enter the Latency value as 150 ms.
      On a per-branch circuit basis, this will utilize the best (lowest) measured Latency value between the Branch and all Data Centers.
    9. Click the + sign to enter the Packet Loss value as 1%.
      On a per-branch circuit basis, this will utilize the best (lowest) measured Packet Loss value between the Branch and all Data Centers.
    10. Advanced Settings do not apply since the Create Incidents action was not specified.
    11. Review the Summary of the policy settings for the desired policy intent and Save & Exit.
    Monitor the Policy Intent
    • Link Quality Monitoring: The performance of the Prisma SD-WAN VPN (Secure Fabric Link) between the Branch and Data Center can be inspected by navigating to ConfigurationPrisma SD-WANResourcesApplications{Branch Site Name}{CircuitName}{Secure Fabric Name}. This view details the performance characteristics of the Secure Fabric VPN tunnel between the Branch and Data Center over time and reveals that loss is consistently high.
    • Application Monitoring: You can view the site-level impact of Forward Error Correction (FEC) on the WebPoS application by navigating to ConfigurationPrisma SD-WANResourcesApplicationsWebPoS (Branch Site Name). This view presents numerous data points reflecting the true health of the application at the site. Focusing on the Application Statistics Data reveals an effective 0% rate for Init Failures (3-way handshake) and Transaction Failures (TCP retransmission).
    • The Transaction Stats widget details the Init and Transaction statistics over time.
    • The App Reachability widget displays the application reachability status over time per WAN transport type, detailing good App Reachability.
    • Flow Browser: Flow Browser provides a detailed per flow account for all aspects of the app session, including the conditions at the time and actions taken to meet the configured SLA. Near the bottom of the Application Details screen in the Flows section, select the Flow Detail for the WebPoS application in the Flow Browser, then click on Advanced Info.
      • The Flow Decision Data indicates High Packet Loss on the Active Path.
      • As there are no other configured Active Paths nor Backup Paths, Forward Error Correction (FEC) is applied to the flow.
    • Summary: Implementing the Performance Policy rule for WebPoS ensures an optimal end-user experience by mitigating a consistent ~5% rate of transport packet loss down to 0% for the application sessions. The impact of the Protect WebPoS rule is easily monitored using the App Site Details, Link Quality Metrics, and Flow Browser.

    © 2026 Palo Alto Networks, Inc. All rights reserved.