Layer 7 Applications

Select either
Stacked Policies
or
Policies (Original)
Policies from the Prisma SD-WAN web interface and click
Apps
.
Click
Add Application
.
A suggested application abbreviation displays in the
Abbreviation
field.
Select
Application L7
for
Identification
.
For
Domain
, enter a domain name.
Layer 7 applications require a domain name or URL address. You may add up to 16 domain names. You can accomplish a wildcard match by specifying the parent domain. For example, if you have an application that leverages different sub-domains, a search for the parent domain produces a result with all sub-domains.
From the
App Category
drop-down, select a category.
From the
Transfer Type
drop-down, select transfer type to be
Transactional
,
Bulk
,
Real-Time Audio
, or
Real-Time Video
.
The order in which the queues are serviced within a priority level is Real-time audio, Real-time video, Transactional, and Bulk. This selection directly impacts the queue in which the traffic is placed within a priority tier (Platinum, Gold, Silver, or Bronze), as defined in a policy rule.
Enter an
Ingress Traffic Percentage
.
Ingress traffic percentage is the amount of traffic in bytes for a given application received by the ION device in the WAN-to-LAN direction compared to the overall traffic for that application. This percentage determines the weight given to bandwidth capacity and utilization when the system makes path-selection decisions. For example, 50% would provide equal weight to both ingress and egress traffic.
Enter
Connection Idle Timeout
in seconds.
Timeout, in terms of resources allocated, is when an application flow is maintained in the system when there is no traffic flow for the application. After the specified timeout, the flow is deleted from the system
Set
Path Affinity
to
Strict
or
None
.
Strict
—If a path selected for a client session is available within a policy, subsequent application sessions from the same client for this application adheres to the originally-selected path.
None
—It is the opposite of strict. Each subsequent client session is free to take any path allowed by policy as long as that path is available within the service level agreement (SLA).
Use the
Using Unreachability Detection
option to monitor applications for reachability.
Use application reachability to determine if an application is reachable on a given path. This information is useful when making path selection decisions. If an application is considered unreachable on a given path, then that path is not used. If all paths are marked unavailable, then one of the active paths is selected as defined in the application path policy.
The ION device continuously monitors the communication between clients (on the LAN side) and servers (on the WAN side). If the ION device determines that a server is not responding to a client's messages on a given path, it triggers the application reachability feature. The ION device actively probes the server on that path to ensure that the server is reachable and responding.
The ION device monitors communication only for the TCP flows initiated from the LAN side of the ION device. All TCP applications have unreachability detection enabled by default. When configuring a custom application, this feature can be disabled optionally.
Enable
Network Scan App
to designate custom applications as network scan applications.
This functionality is disabled by default. Enabling the attribute on an existing custom application applies only for new flows coming in and hitting the application after the configuration is made. Existing flows hitting the custom application do not inherit the configuration,
Select
Apply
.
The new custom application displays under
Custom Applications
.