: Use Case 2 - Protect a Business Critical Enterprise Application
Focus
Focus

Use Case 2 - Protect a Business Critical Enterprise Application

Table of Contents

Use Case 2 - Protect a Business Critical Enterprise Application

Use Case 2: Protect a Business Critical Enterprise Application
In this case, the business uses the application WebPoS for Point of Sale, and it's hosted in the corporate Data Centers. WebPoS can tolerate moderate levels of latency and jitter, but packet loss can affect the end-user experience, leading to failures in order processing. WebPoS is configured with these Path Policy rules:
  • Active Paths: Prisma SD-WAN VPN on Primary internet.
  • Backup Paths: None
  • Layer 3 Failure Paths: Prisma SD-WAN VPN on Metered 5G.
Performance Policy Intent
  • Use the Active Path as long as it's available.
  • Use Link Quality Monitoring (LQM) information available from the Branch to Data Center VPNs, to adaptively control Forward Error Correction (FEC) for any observed packet loss.
  • Use only the Layer 3 Failure Path if the active path is down, not degraded.
Configure the Policy Rule
  1. Select the target policy set from
    Manage
    Prisma SD-WAN
    Policies
    Performance
    .
  2. Select
    Add Rule
    and enter the
    Name
    as
    WebPoS
    ,
    Description
    (optional), and the
    Order Number
    (optional).
    More specific rules should be organized at the top of the Policy Set list, else a less specific policy rule may be matched first.
  3. In the
    Actions
    section, select
    Forward Error Correction (FEC)
    and
    Move Flows
    .
  4. In the
    Match Criteria
    section, under
    App Filters
    , select the application
    WebPoS
    from the drop-down. Select the category in
    Path Filters
    as
    All Public
    and
    All Private
    .
  5. Select the
    Path Type
    as
    Prisma SD-WAN VPN
    .
  6. In the
    Performance SLAs
    section, click
    Add New
    , and check the option
    Link Quality Metrics
    . Now, enter the
    SLA Name
    as
    WebPoS
    .
  7. In
    Link Quality Metrics
    , enter the
    Jitter
    value as 50 ms.
    On a per-branch circuit basis, this will utilize the best (lowest) measured Jitter value between the Branch and all Data Centers.
  8. Click the
    +
    sign to enter the
    Latency
    value as 150 ms.
    On a per-branch circuit basis, this will utilize the best (lowest) measured Latency value between the Branch and all Data Centers.
  9. Click the
    +
    sign to enter the
    Packet Loss
    value as 1%.
    On a per-branch circuit basis, this will utilize the best (lowest) measured Packet Loss value between the Branch and all Data Centers.
  10. Advanced Settings
    don't apply since the
    Create Incidents
    action wasn't specified.
  11. Review the
    Summary
    of the policy settings for the desired policy intent and
    Save & Exit
    .
Monitor the Policy Intent
  • Link Quality Monitoring
    : The performance of the Prisma SD-WAN VPN (Secure Fabric Link) between the Branch and Data Center can be inspected by navigating to
    Monitor
    Applications
    Prisma SD-WAN
    {Branch Site Name}
    {CircuitName}
    {Secure Fabric Name}
    . This view details the performance characteristics of the Secure Fabric VPN tunnel between the Branch and Data Center over time and reveals that loss is consistently high.
  • Application Monitoring
    : You can view the site-level impact of Forward Error Correction (FEC) on the WebPoS application by navigating to
    Monitor
    Applications
    Prisma SD-WAN
    WebPoS (Branch Site Name)
    . This view presents numerous data points reflecting the true health of the application at the site. Focusing on the
    Application Statistics Data
    reveals an effective 0% rate for Init Failures (3-way handshake) and Transaction Failures (TCP retransmission).
  • The
    Transaction Stats
    widget details the Init and Transaction statistics over time.
  • The
    App Reachability
    widget displays the application reachability status over time per WAN transport type, detailing good App Reachability.
  • Flow Browser:
    Flow Browser provides a detailed per flow account for all aspects of the app session, including the conditions at the time and actions taken to meet the configured SLA. Near the bottom of the
    Application Details
    screen in the Flows section, select the
    Flow Detail
    for the WebPoS application in the Flow Browser, then click on
    Advanced Info
    .
    • The Flow Decision Data indicates High Packet Loss on the Active Path.
    • As there are no other configured Active Paths nor Backup Paths, Forward Error Correction (FEC) is applied to the flow.
  • Summary
    : Implementing the Performance Policy rule for WebPoS ensures an optimal end-user experience by mitigating a consistent ~5% rate of transport packet loss down to 0% for the application sessions. The impact of the Protect WebPoS rule is easily monitored using the App Site Details, Link Quality Metrics, and Flow Browser.

Recommended For You