Focus

Use Case 2 - Protect a Business Critical Enterprise Application

Table of Contents

Filter

Expand All | Collapse All

Prisma SD-WAN Docs

Administration
Deployment
Incidents & Alerts
CloudBlades
Version
- AWS Transit Gateway
- Azure vWAN
- Azure vWAN with vION
- ChatBot for MS Teams
- ChatBot for Slack
- CloudBlades Integration with Prisma Access
- GCP NCC
- Service Now
- Zoom QSS
- Zscaler Internet Access
Reference
Release Notes
Version
- ION 5.2
- ION 5.3
- ION 5.4
- ION 5.5
- ION 5.6
- ION 6.0
- ION 6.1
- ION 6.2
- ION 6.3
- ION 6.4
- New Features Guide
- On-Premises Controller
- Prisma Access CloudBlade Cloud Managed
- Prisma Access CloudBlade Panorama Managed
- Prisma SD-WAN CloudBlades

Use Case 1 - Protect a Business Critical SaaS Application

Use Case 3 - Protect Physical Security on LEO Satellite and 5G

Use Case 2 - Protect a Business Critical Enterprise Application

Use Case 2: Protect a Business Critical Enterprise Application

Where Can I Use This?	What Do I Need?
Prisma SD-WAN	Active Prisma SD-WAN license

In this scenario, the business uses the application WebPoS for Point of Sale, and it is hosted in the corporate Data Centers. WebPoS can tolerate moderate levels of latency and jitter, but packet loss can affect the end-user experience, leading to failures in order processing. WebPoS is configured with these Path Policy rules:

Active Paths: Prisma SD-WAN VPN on Primary Internet.
Backup Paths: None
L3 Failure Paths: Prisma SD-WAN VPN on Metered 5G.

Performance Policy Intent

Use the Active Path as long as it is available.
Use Link Quality Monitoring (LQM) information available from the Branch to Data Center VPNs, to adaptively control Forward Error Correction (FEC) for any observed packet loss.
Use only the L3 Failure Path if the active path is down, not degraded.

Configure the Policy Rule

Select the target policy set from ManagePrisma SD-WANPoliciesPerformance.
Select Add Rule and enter the Name as WebPoS, Description (optional), and the Order Number (optional).

More specific rules should be organized at the top of the Policy Set list, else a less specific policy rule may be matched first.
In the Actions section, select Forward Error Correction (FEC) and Move Flows.
In the Match Criteria section, under App Filters, select the application WebPoS from the drop-down, select the category in Path Filters as All Public and All Private.
Select the Path Type as Prisma SD-WAN VPN.
In the Performance SLAs section, click Add New, and check the option Link Quality Metrics. Now, enter the SLA Name as WebPoS.
In Link Quality Metrics, enter the Jitter value as 50 ms.
On a per-branch circuit basis, this will utilize the best (lowest) measured Jitter value between the Branch and all Data Centers.
Click the + sign to enter the Latency value as 150 ms.
On a per-branch circuit basis, this will utilize the best (lowest) measured Latency value between the Branch and all Data Centers.
Click the + sign to enter the Packet Loss value as 1%.
On a per-branch circuit basis, this will utilize the best (lowest) measured Packet Loss value between the Branch and all Data Centers.
Advanced Settings do not apply since the Create Incidents action was not specified.
Review the Summary of the policy settings for the desired policy intent and Save & Exit.

Monitor the Policy Intent

Link Quality Monitoring: The performance of the Prisma SD-WAN VPN (Secure Fabric Link) between the Branch and Data Center can be inspected by navigating to MonitorApplicationsPrisma SD-WAN{Branch Site Name}{CircuitName}{Secure Fabric Name}. This view details the performance characteristics of the Secure Fabric VPN tunnel between the Branch and Data Center over time and reveals that loss is consistently high.
Application Monitoring: You can view the site-level impact of Forward Error Correction (FEC) on the WebPoS application by navigating to MonitorApplicationsPrisma SD-WANWebPoS (Branch Site Name). This view presents numerous data points reflecting the true health of the application at the site. Focusing on the Application Statistics Data reveals an effective 0% rate for Init Failures (3-way handshake) and Transaction Failures (TCP retransmission).
The Transaction Stats widget details the Init and Transaction statistics over time.
The App Reachability widget displays the application reachability status over time per WAN transport type, detailing good App Reachability.
Flow Browser: Flow Browser provides a detailed per flow account for all aspects of the app session, including the conditions at the time and actions taken to meet the configured SLA. Near the bottom of the Application Details screen in the Flows section, select the Flow Detail for the WebPoS application in the Flow Browser, then click on Advanced Info.
- The Flow Decision Data indicates High Packet Loss on the Active Path.
- As there are no other configured Active Paths nor Backup Paths, Forward Error Correction (FEC) is applied to the flow.
Summary: Implementing the Performance Policy rule for WebPoS ensures an optimal end-user experience by mitigating a consistent ~5% rate of transport packet loss down to 0% for the application sessions. The impact of the Protect WebPoS rule is easily monitored using the App Site Details, Link Quality Metrics, and Flow Browser.