Add Performance Policy Rules
Table of Contents
Expand all | Collapse all
-
-
- Add a Branch
- Add a Data Center
- Add a Branch Gateway
- Configure Circuits
- Configure Internet Circuit Underlay Link Aggregation
- Configure Private WAN Underlay Link Quality Aggregation
- Configure Circuit Categories
- Configure Device Initiated Connections for Circuits
- Add Public IP LAN Address to Enterprise Prefixes
- Manage Data Center Clusters
- Configure a Site Prefix
- Configure a DHCP Server
- Configure NTP for Prisma SD-WAN
- Configure the ION Device at a Branch Site
- Configure the ION Device at a Data Center
- Switch a Site to Control Mode
- Allow IP Addresses in Firewall Configuration
-
- Configure a Controller Port
- Configure Internet Ports
- Configure WAN/LAN Ports
- Configure a Loopback Interface
- Configure a PoE Port
- Configure and Monitor LLDP Activity and Status
- Configure a PPPoE Interface
- Configure a Layer 3 LAN Interface
- Configure Application Reachability Probes
- Configure a Secondary IP Address
- Configure a Static ARP
- Configure a DHCP Relay
- Configure IP Directed Broadcast
- VPN Keep-Alives
-
- Configure Prisma SD-WAN IPFIX
- Configure IPFIX Profiles and Templates
- Configure and Attach a Collector Context to a Device Interface in IPFIX
- Configure and Attach a Filter Context to a Device Interface in IPFIX
- Configure Global and Local IPFIX Prefixes
- Flow Information Elements
- Options Information Elements
- Configure the DNS Service on the Prisma SD-WAN Interface
- Configure SNMP
-
-
- Prisma SD-WAN Branch Routing
- Prisma SD-WAN Data Center Routing
-
- Configure Multicast
- Create a WAN Multicast Configuration Profile
- Assign WAN Multicast Configuration Profiles to Branch Sites
- Configure a Multicast Source at a Branch Site
- Configure Global Multicast Parameters
- Configure a Multicast Static Rendezvous Point (RP)
- Learn Rendezvous Points (RPs) Dynamically
- View LAN Statistics for Multicast
- View WAN Statistics for Multicast
- View IGMP Membership
- View the Multicast Route Table
- View Multicast Flow Statistics
- View Routing Statistics
- Prisma SD-WAN Incident Policies
-
- Prisma SD-WAN Branch HA Key Concepts
- Configure Branch HA
- Configure HA Groups
- Add ION Devices to HA Groups
- View Device Configuration of HA Groups
- Edit HA Groups and Group Membership
-
- Configure Branch HA with Gen-1 Platforms (2000, 3000, 7000, and 9000)
- Configure Branch HA with Gen-2 Platforms (3200, 5200, and 9200)
- Configure Branch HA with Gen-2 Embedded Switch Platforms (1200-S or 3200-L2)
- Configure Branch HA for Devices with Software Cellular Bypass (1200-S-C-5G)
- Configure Branch HA for Platforms without Bypass Pairs
- Prisma SD-WAN Clarity Reports
- Prisma SD-WAN Incidents and Alerts
Add Performance Policy Rules
Steps to add performance policy rules that are part of the performance
sets.
Where Can I Use This? | What Do I Need? |
---|---|
|
|
Performance Policy rules can be defined with Link Quality Metrics,
Application metrics thresholds, and System health probes. Performance Policy
provides two rule types that are used for Application/Network SLAs or System Metric
SLAs. Application / Network SLAs utilize Link Quality Metrics, Application Metrics,
and Probe Metrics while System Metrics utilize device and circuit resources. You can
select a rule type and apply the rule at an application or transfer-type level,
select Path filters; Circuit labels, Path types, and Data Center groups.
You can select a policy set and then add policy rules to the policy set. To
edit the rule, click on the Policy Rule name.
To add a performance policy rule to a policy set:
- Go to.ManagePoliciesPerformancePerformance Sets
- Select a.Policy SetAdd Rule
- In thesection, theAdd New RuleGeneralEnable Ruleis selected by default. Disable the rule if you don't want the ION device to consider this rule.
- Enter aRule Name,Description, and optionalTagsfor the policy rule.x`
- Enter anOrder Numberfor the policy rule. An order of 1 will place the rule at the top of the list.Organize specific rules at the top of the Policy Set list; otherwise, a less specific policy rule may be matched first.Performance Policy rules follow explicit ordering, wherein each rule within a policy set has an order number that is used, a set of match criteria, and a set of actions.The default order number will place the rule at the bottom of the policy set, just above the default rules. Rules will automatically reorder if a nondefault rule order is specified.
- Select theRule TypeasApp/Network SLAorSystem Health.App/Network SLA
- If you selectApp/Network SLAas theRule Type, go to theActionsection and select one or more actions.
- Create Incidentgenerates incidents for both Applications and Circuits using link quality and application performance SLA criteria, where applicable incidents are automatically correlated.
- Move Flowsmoves existing flows and excludes paths for new flows that are in violation of a performance SLA. These include both Link Quality and Application Metrics. When the Move Flows field is empty in a rule, the datapath won't consider Link Quality Metrics measurements during path selection.
- FEC (Forward Error Correction)must be enabled along with the Move Flows action. FEC only relies on the loss and Latency Link Quality Metrics and does not use Application metrics. FEC takes effect only on Prisma SD-WAN VPNs. If you enable FEC, note that:
- FEC is effective on packet loss between 1% and 10%.
- As the loss increases above 1% additional repair is added to the application session to which FEC is enabled on the VPN.
- Packet Duplicationassures the delivery of packets for critical applications even when all underlay paths are degraded beyond application SLA. It replicates an application session across up to three VPN paths simultaneously and is an additional action within the performance policy, selectable on a per-app and per-path basis. Leveraging this capability requires explicit selection of all paths onto which packets will be duplicated (secondary/alternate paths) and duplicated by (primary path). Packet Duplication must be enabled along with the Move Flows action and takes effect only on Prisma SD-WAN VPNs.
- Visibilityaffects the Secure Fabric Link-time series by displaying the performance SLA indicator in the graph. Visibility solely depends on Link Quality Metrics and does not utilize Application metrics.
- In theMatch Criteriasection, choose the following filters:If theMatch Criteriasection is left blank, this will be considered a match any.
- (Optional)InApp Filters, select anApplicationsfrom the drop-down to apply the policy rule. You can select 256 applications for one policy rule.
- (Optional)From theApplication by Transfer Typedrop-down, select the transfer type to be Bulk, Audio, Video, or Transactional.
- (Optional)InPath Filters, select thePath Categoryfrom the drop-down. Select an overlay and a Circuit Category for a path. You can't repeat a combination of an overlay and a circuit category for a policy rule.
- (Optional)Select thePath Typeas Direct, Prisma SD-WAN VPN, or Standard VPN.
- (Optional)Select the DC Group value from the drop-down. By default, if the section is left blank, all Service & DC Groups are included as well as branch to branch VPNs. If any DC Groups are specified, then branch to branch VPNs are excluded.
- In thePerformance SLAssection, you can either use anexistingperformance threshold, or to add a new threshold, clickAdd New.
- Check the desired performance SLA and enter the respective thresholds for the SLA.
- Expand theAdvanced Settingsdown arrow to set the values forRaise Above(between 10% to 100%) andClear Below(between 1% to 80%).
- Raise Above: If the aggregated percentage (comprising LQM samples over all paths for the same circuit) exceeds the configured percentage value, the system will raise an alarm for each circuit.
- Clear Below: The system will clear the alarm for the same circuit when the aggregated percentage exceeds the configured percentage value.
- Use the drop-down to select the monitoring approach to control the incident generation.
The monitoring approach actively adjusts using a time-based algorithm to control incident generation. AConservativemonitoring approach takes longer to trigger and clear an incident, as it evaluates a longer time period. Conversely, anAggressivemonitoring approach triggers and resolves incidents as conditions change. The time taken to generate and clear an incident depends on the configured percentages for raise above and clear below thresholds, the frequency of threshold violations over time, and the selected monitoring approach.System Metrics- If you selectSystem Healthas theRule Type, go to theActionsection and selectCreate Incident.Incidents are generated for system health metrics using Concurrent Flows, Memory, CPU, Disk, and Circuit Utilization SLA criteria.
- In thePerformance SLAssection, you can either use an existing performance threshold, or to add a new threshold, clickAdd New. Check any or all of the metrics.
- If you selectSystem Health Metrics,
- Enter theCPU Utilizationvalue (between 1-100%).
- Continue clicking the + sign or select from the drop-down to enter theMemory Utilizationvalue (between 1-100%) and theDisk Utilizationvalue (between 1-100%).
- Continue clicking the + sign or select from the drop-down to enter theMemory Utilizationvalue (between 1-100%) and theDisk Utilizationvalue (between 1-100%).
- Expand theAdvanced Settingsdown arrow to set the values forRaise Above(between 10% to 100%) andClear Below(between 1% to 80%).
- If you selectFlow Metrics,
- Enter theConcurrent Flow Utilizationvalue (between 1-100%).
- If you selectCircuit Utilization,
- InPath Filters, select theCategoryfrom the drop-down.
- Select an overlay and aCircuit Categoryfor a path. You can't repeat a combination of an overlay and a circuit category for a policy rule. Circuit Utilization SLA can be set per Circuit and for All Circuits.
- Review theSummaryof the policy rules for the desired policy intent andSave & Exit.