Creating SD-WAN rules

We will create two rules: one for traffic destined for HQ, and one for business traffic not destined for HQ. The first rule will specify traffic destined for HQ to take a VPN through WAN1 to HUB1 or HUB2, provided the measured SLA is met. Otherwise the traffic will use either VPN through WAN2 to HUB1 or HUB2. The second rule uses application identification to ensure business related traffic prefers the highest quality link at any given time. A final catch-all rule is created for the remaining traffic.

Following is an overview of the procedure:

1. Define SD-WAN rules for traffic from the branch to HQ. See Defining rules for branch to HQ traffic.
2. Define SD-WAN rules for business traffic to the internet. See Defining rules for business internet.
3. Define SD-WAN rules for non-business traffic to the internet. See Defining rules for non-business traffic.
4. Edit the Non-Business_Internet rule to specify it is for any traffic that is NOT part of the RFC-1918 subnets. See Editing the Non-Business_Internet rule .

Defining rules for branch to HQ traffic

To create SD-WAN rules for branch to HQ traffic:

1. Go to Network > SD-WAN > SD-WAN Rules, and click Create New.
2. Set Name to Branch_to_HQ.
3. In the Source section, set the following options:
   1. Click Source Address. The Select Entries pane is displayed.
   2. Click +Create > Address to define an object for your LAN network named Branch_LAN. The New Address pane is displayed.
   3. Set Name to Branch_LAN.
   4. Set IP/Netmask to 10.0.1.0/24.

      

   5. Click OK. The Branch_LAN object displays in the list.
   6. Select Branch_LAN, and click Close.
4. In the Destination section, set the following options:
   1. Click Address. The Select Entries pane is displayed.
   2. Click +Create > Address to define an object for your HQ network named HQ_LAN. The New Address pane is displayed.
   3. Set Name to HQ_LAN.
   4. Set IP/Netmask to 10.0.0.0/8.

      

   5. Click OK. The HQ_LAN object displays in the list.
   6. Select HQ_LAN, and click Close.
5. In the Outgoing Interfaces section, set the following options:
   1. Select Lowest Cost (SLA).
   2. Set Interface Preference to WAN1_VPN, WAN2_VPN.
   3. Set Required SLA target to HQ_VPN.
6. Click OK.

Defining rules for business internet

To create SD-WAN rules for business internet traffic:

1. Go to Network > SD-WAN > SD-WAN Rules, and click Create New.
2. Set Name to Business_Internet.
3. In the Source section, click Source Address, and select Branch_LAN.
4. In the Destination section, set the following options:
   1. Click Application. The Select Entries pane is displayed.
   2. Click +Create > Application Group. The New Application Group pane is displayed.
   3. Set Name to Critical_Apps.
   4. Click Members and select one or more applications that are critical to your business. Click Close when done.

      

   5. Click OK. The Critical_Apps object displays in the list.
   6. Select Critical_Apps, and click Close.
5. In the Outgoing Interfaces section, set the following options:
   1. Select Best Quality.
   2. Set Interface Preference to ISP1, ISP2.
   3. Set Measured SLA to Internet.
6. Click OK.

Defining rules for non-business traffic

This rule catches all remaining traffic. Matching traffic is defined as traffic destined for any non-private (RFC-1918) IP addresses.

To create SD-WAN rules for non-business internet traffic:

1. Go to Network > SD-WAN > SD-WAN Rules, and click Create New.
2. Set Name to Non-Business_Internet.
3. In the Source section, click Source Address, and select Branch_LAN.
4. In the Destination section, create and select an address object named RFC-1918-10:
   1. Click Address. The Select Entries pane is displayed.
   2. Click +Create > Address. The New Address pane is displayed.
   3. Set Name to RFC-1918-10.
   4. Set IP/Netmask to 10.0.0.0/8.

      

   5. Click OK. The RFC-1918-10 object displays in the list.
   6. Select RFC-1918-10. The Select Entries pane remains displayed.
5. Create and select an address object named RFC-1918-172:
   1. In the Select Entries pane, click +Create > Address. The New Address pane is displayed.
   2. Set Name to RFC-1918-172.
   3. Set IP/Netmask to 172.16.0.0/12.

      

   4. Click OK. The RFC-1918-172 object displays in the list.
   5. Select RFC-1918-172. The Select Entries pane remains open.
6. Create and select an address object named RFC-1918-192:
   1. In the Select Entries pane, click +Create > Address. The New Address pane is displayed.
   2. Set Name to RFC-1918-192.
   3. Set IP/Netmask to 192.168.0.0/16.

      

   4. Click OK. The RFC-1918-192 object displays in the list.
   5. Select RFC-1918-192.
7. Create and select an address group named RFC-1918:
   1. In the Select Entries pane, click +Create > Address Group. The New Address Group pane is displayed.
   2. Set Name to RFC-1918.
   3. Set Type to Group, and select the RFC-1918_<number> objects you created.

      

   4. Click OK. The RFC-1918 object displays in the list.
   5. Select RFC-1918. Click Close.
8. In the Outgoing Interfaces section, set the following options:
   1. Select Manual.
   2. Set Interface Preference to ISP2. This assumes that ISP2 is a lower quality or cheaper link and is preferred for non-critical traffic.
9. Click OK. The Non-Business_Internet rule is displayed.

Editing the Non-Business_Internet rule

Edit the Non-Business_Internet rule to specify it is for any traffic that is NOT part of the RFC-1918 subnets.

To edit the Non-Business_Internet rule in the CLI:

1. On the Network > SD-WAN > SD-WAN Rules page, right-click the Non-Business_Internet rule, and select Edit in CLI.

   

2. Configure the service:

   Branch1# config system sdwan 
   Branch1 (sdwan) # config service
   Branch1 (service) # edit 3
   Branch1 (3) # show
   config service
       edit 3
           set name "Non-Business_Internet"
           set dst "RFC-1918"
           set src "Branch_LAN"
           set priority-members 2
       next
   end

   The priority-members 2 option is the index of your ISP2 interface object.

3. Enable dst-negate:

   set dst-negate enable
   end
   end

4. Close the CLI menu, and reload the SD-WAN Rules page. The Destination address displays a red ! in front of the name to indicate it is for any destination that is NOT part of the RFC-1918 subnets.