Best Practices and Recommendations

Simple Policy Sets
: Use simple policy stacks unless the modular flexibility of advanced stacks is required.
Rule Order
: As Performance Policy uses an explicit order, more specific (such as app match, path match, DC Group) rules must be placed at the top of the policy set and less specific rules at the bottom. Any match field left empty will be considered a match all.
Migration of Link Quality Metrics (LQM) and APT thresholds from Advanced Menu
: Prior to the availability of Performance Policy in 6.3.1, the configuration governing performance-based path selection was configured through the
Advanced
menu. As of 6.3.1 this configuration is longer used by the device and the rules must be configured in a performance policy set applied to the site.
Functional Limits for Forward Error Correction (FEC) and Packet Duplication
: FEC and Packet Duplication are adaptive and will only invoke when a Prisma SD-WAN VPN path exceeds the packet loss threshold specified in the SLA. As FEC or Packet Duplication is invoked, additional resources are required for processing the packet recovery information. The maximum VPNs actively encoding recovery information per platform is listed below:
ION Model	Max VPNs Branch	Max VPN DC
1000	8	N/A
1200	8	N/A
1200-S	8	N/A
2000	8	N/A
3000	16	32
3200	16	32
5200	32	128
7000	32	128
9000	64	256
9200	64	256
The branch ION determines if the SLA will be met in both the inbound and outbound directions on a per path basis. In the case that inbound (from the Data Center) loss exceeds the SLA, the branch ION sends an in-band instruction attached to a packet to the Data Center ION instructing it to invoke FEC for the affected flow.
If the number of VPNs actively invoking FEC and Packet Duplication meets the platform limit (above), then no further VPNs will be able to encode or decode recovery information.
When an ION simultaneously applies Forward Error Correction (FEC) and Packet Duplication on traffic from the same VPN, this counts as a single VPN instance.
ION Device version 6.3.2 or higher is recommended when using Forward Error Correction.
ION Device version 6.4.1 or higher is required when using Packet Duplication.
Policy Rule Configuration Limits
: Each ION device model varies in system resources depending on the targeted use case for the appliance.
The two important metrics to consider for Performance Policy are; the total number of rules and the number of specific App-IDs that matches per rule.
Multiply the total number of rules by the total number of application IDs matched.
Transfer Type
matches don't count all of the applications matched.
The table below is a reference for the maximum validated and recommended rule configurations:
ION Model	Rule Count	Max Rules x Apps
1000	30	150
1200	50	250
1200-S	200	1275
2000	50	1275
3000	255	1275
3200	255	1275
5200	255	1275
9000	255	1275
9200	255	1275
Prerequisites
: Ensure that
Use LQM on non-hub paths
is configured on each of the circuit categories used in the network.
Circuit-specific overrides may be configured.
Application & Network Performance and Reachability Information in Prisma SD-WAN:
Prisma SD-WAN uses a combination of real user traffic, reachability probes, service health probes, and link quality monitoring to form an accurate picture of the application & network performance landscape. These perspectives include:
Real User Traffic
: Prisma SD-WAN measures numerous parameters of each application session including:
Init Success and Failure Rate - TCP 3-way Handshake
Transaction Success / Failure Rate - TCP Retransmission
RTT - Application Round-Trip Time
SRT - Application Server Response Time
NTTn - Time for TCP Window Completion
UDP-TRT - DNS Transaction Time Round-Trip Time
Voice MOS
Voice and Video Packet Loss
Voice and Video Jitter
App Reachability Probe
: When the system detects a 3-way handshake failure for LAN initiated traffic, the ION crafts a special synthetic probe packet to mimic the original failed TCP SYN on that specific path. If the synthetic probe fails to establish a TCP connection, the path is automatically marked as unusable due to App Unreachable for that App/Path/Prefix combination. This probe continues to generate every 1 minute to verify the application reachability status. If the probe is successful, the path is then considered for path selection for that App/Path/Prefix combination.
Layer 3 Reachability
: If all VPNs on a WAN interface go down and there is no inbound traffic, the ION automatically generates traffic to verify the true usability status of the circuit. By default, these endpoints are:
Ping 8.8.8.8
Ping 8.8.4.4
Ping 208.67.222.222
HTTPS GET for captive.apple.com
HTTPS GET for captive.google.com
Starting from release 6.4.1, the Layer 3 Reachability probes can optionally be configured to use the results of Service Health Probes to determine the Layer 3 Reachability status of the circuit.
Standard VPN Endpoint Liveliness Probes
: This is an optional configuration that enables the system to generate probes through a standard VPN tunnel after it's created. There are two types of probes:
ICMP
Interval between 1 to 30 seconds.
Failure Count between 3 to 300; how many consecutive failures before the Standard VPN are marked as down.
IP Address
HTTP
Interval between 10 to 3,600 seconds.
Failure Count between 3 to 300; how many consecutive failures before the Standard VPN are marked as down.
HTTP Status Codes; A matched HTTP status code response will be considered as up. A failure to match the HTTP status code will mark the Standard VPN as down.
URL of the HTTP content.
Standard VPN IKE DPD
: DPD or Dead Peer Detection is a keepalive method used to determine the liveliness of the IKE peer.
VPN Keep-Alives
: Prisma SD-WAN VPNs utilize VPN Keep-Alives to ascertain their up or down status. The default configuration generates a Keep-Alive every second and identifies a VPN as down when it loses three consecutive Keep-Alives. This can be tuned to an aggressive 100 ms Keep-Alive interval with a minimum failure count of 3, resulting in 300 ms to detect a down path.
Link Quality Monitoring
: Link Quality Monitoring (LQM) provides automatic and continuous path monitoring for Branch to Data Center and Branch to Branch Gateway VPN connections, assessing Latency, Loss, Jitter, and link MOS. LQM results are visible in the web interface and can serve as App/Network SLA criteria in Performance Policy, enabling performance-based path selection, FEC or Packet Duplication, and incident generation. LQM can be disabled at the circuit category or site circuit definition.
ADEM
: Autonomous Digital Experience Monitoring (ADEM) provides always-on monitoring for business critical applications using the ION as a remote network sensor.
Service Health Probes
: Introduced in release 6.4.1, Service Health Probes offer the capability to configure health checks for specific endpoints. These probes monitor latency, loss, and jitter across the underlay, Prisma SD-WAN VPN overlay, and Standard VPNs. Each circuit can monitor up to eight health probe endpoints simultaneously across all path types. The results of these health probes are monitored under the circuit health, with optional incident generation. These metrics can also influence path selection and be utilized in a performance policy rule under the
Probe
SLA type, as well as to determine the
L3 Reachability
status of the circuit.