Configure Custom Applications

Configure custom applications on Prisma SD-WAN
Prisma SD-WAN
Custom Applications
are applications you wish to include in your system for your enterprise. You may define custom applications based on either L3/L4 or L7 characteristics.

Layer 3/Layer 4 Applications

  1. Select either
    Stacked Policies
    or
    Policies (Original)
    Policies from the Prisma SD-WAN web interface and click
    Apps
    .
  2. Click
    Add Application
    .
  3. Enter a
    Display Name
    .
    A suggested application abbreviation displays in the
    Abbreviation
    field.
  4. Select
    Network (L3/L4)
    for
    Identification
    .
  5. For
    UDP Filter Rules
    , include a mandatory port number, an
    (optional)
    DSCP value between 0 to 63, and an
    (optional)
    prefix filter.
    Layer 3 or Layer 4 applications require a port number and a prefix filter.
  6. For
    TCP Filter Rules
    , include the server port number,
    (optional)
    DSCP value between 0 to 63, and
    (optional)
    server prefix filter. The list of decimal values for common DSCP names are:
    Decimal Value
    Hex Value
    Meaning
    0
    0x00
    Best effort (CS0 - Default)
    8
    0x08
    CS1
    10
    0x0A
    AF11
    12
    0x0C
    AF12
    14
    0x0E
    AF13
    16
    0x010
    CS2
    18
    0x012
    AF21
    20
    0x014
    AF22
    22
    0x016
    AF23
    24
    0x018
    CS3
    26
    0x01A
    AF31
    28
    0x01C
    AF32
    30
    0x01E
    AF33
    32
    0x020
    CS4
    34
    0x022
    AF41
    36
    0x024
    AF42
    38
    0x026
    AF43
    40
    0x028
    CS5
    46
    0x02E
    Expedited forwarding (EF)
    48
    0x030
    CS6
    56
    0x038
    CS7
    Prefix filters with respective ports are required for a custom application. Although it is possible to reuse prefix filters, the ports need to be unique for each custom application.
    For prefix filters, define one or more IP addresses or subnets. IP addresses within a prefix are defined by the subnet. For example, 10.1.1.0/24 defines the entire limit of 255 IP addresses in that subnet.
    For global prefix filters, enter an IP and subnet address and for local prefix filters, select a site in addition to entering an IP and subnet address.
  7. For
    IP Rules
    , choose a protocol, and enter a DSCP marking and a destination prefix filter.
    1. Select a protocol from the
      Protocol
      drop-down. For example, GRE, or ICMP.
    2. (Optional)
      Enter a value in the range of 0 – 63 for DSP.
    3. Select a prefix filter from the
      Destination Prefix Filters
      drop-down.
      Up to eight destination prefixes may be added. You may add a new prefix filter by clicking
      Create New Filter
      , if prefix filters is not already defined.
    4. Select a prefix filter from the
      Source Prefix Filters
      drop-down.
      Up to eight destination prefixes may be added. You may add a new prefix filter by clicking
      Create New Filter
      , if prefix filters is not already defined.
  8. Select
    Apply
    .
    The new custom application displays under
    Custom Applications
    .

Layer 7 Applications

  1. Select either
    Stacked Policies
    or
    Policies (Original)
    Policies from the Prisma SD-WAN web interface and click
    Apps
    .
  2. Click
    Add Application
    .
    A suggested application abbreviation displays in the
    Abbreviation
    field.
  3. Select
    Application L7
    for
    Identification
    .
  4. For
    Domain
    , enter a domain name.
    Layer 7 applications require a domain name or URL address. You may add up to 16 domain names. You can accomplish a wildcard match by specifying the parent domain. For example, if you have an application that leverages different sub-domains, a search for the parent domain produces a result with all sub-domains.
  5. From the
    App Category
    drop-down, select a category.
  6. From the
    Transfer Type
    drop-down, select transfer type to be
    Transactional
    ,
    Bulk
    ,
    Real-Time Audio
    , or
    Real-Time Video
    .
    The order in which the queues are serviced within a priority level is Real-time audio, Real-time video, Transactional, and Bulk. This selection directly impacts the queue in which the traffic is placed within a priority tier (Platinum, Gold, Silver, or Bronze), as defined in a policy rule.
  7. Enter an
    Ingress Traffic Percentage
    .
    Ingress traffic percentage is the amount of traffic in bytes for a given application received by the ION device in the WAN-to-LAN direction compared to the overall traffic for that application. This percentage determines the weight given to bandwidth capacity and utilization when the system makes path-selection decisions. For example, 50% would provide equal weight to both ingress and egress traffic.
  8. Enter
    Connection Idle Timeout
    in seconds.
    Timeout, in terms of resources allocated, is when an application flow is maintained in the system when there is no traffic flow for the application. After the specified timeout, the flow is deleted from the system
  9. Set
    Path Affinity
    to
    Strict
    or
    None
    .
    • Strict
      —If a path selected for a client session is available within a policy, subsequent application sessions from the same client for this application adheres to the originally-selected path.
    • None
      —It is the opposite of strict. Each subsequent client session is free to take any path allowed by policy as long as that path is available within the service level agreement (SLA).
  10. Use the
    Using Unreachability Detection
    option to monitor applications for reachability.
    Use application reachability to determine if an application is reachable on a given path. This information is useful when making path selection decisions. If an application is considered unreachable on a given path, then that path is not used. If all paths are marked unavailable, then one of the active paths is selected as defined in the application path policy.
    The ION device continuously monitors the communication between clients (on the LAN side) and servers (on the WAN side). If the ION device determines that a server is not responding to a client's messages on a given path, it triggers the application reachability feature. The ION device actively probes the server on that path to ensure that the server is reachable and responding.
    The ION device monitors communication only for the TCP flows initiated from the LAN side of the ION device. All TCP applications have unreachability detection enabled by default. When configuring a custom application, this feature can be disabled optionally.
  11. Enable
    Network Scan App
    to designate custom applications as network scan applications.
    This functionality is disabled by default. Enabling the attribute on an existing custom application applies only for new flows coming in and hitting the application after the configuration is made. Existing flows hitting the custom application do not inherit the configuration,
  12. Select
    Apply
    .
    The new custom application displays under
    Custom Applications
    .

Recommended For You