Internet service and application control steering

An application, application group, or application category can be selected as an SD-WAN service rule destination criterion for IPv4 and IPv6 address modes.

To configure from the CLI:

config system sdwan
  config service
    edit <id>
      set internet-service enable
      set internet-service-app-ctrl <app id> [app id]   // basically can be one or more app IDs
      set internet-service-app-ctrl-group <app group> [app group]
      set internet-service-app-ctrl-category <category id> [category id]
    next 
  end 
end

To configure for IPv6 addressing mode from the CLI, enable addr-mode ipv6:

config system sdwan
  config service
    edit <id>
      set addr-mode ipv6
    next
  end
end

To view the detected application category details based on category ID, use diagnose sys sdwan internet-service-app-ctrl-category-list <id>.

This topic includes a GUI and CLI Example for application category and a CLI Example for IPv6.

Example for application category

In this example, traffic steering is applied to traffic detected as video/audio (category ID 5) or email (category ID 21) and applies the lowest cost (SLA) strategy to this traffic. When costs are tied, the priority goes to member 1, dmz.

To configure application categories as an SD-WAN rule destination in the GUI:

1. Enable the feature visibility:

   1. Go to System > Feature Visibility.

   2. In the Additional Features section, enable Application Detection Based SD-WAN.

   3. Click Apply.

   To enable GUI visibility of application detection based SD-WAN in the CLI: config system global set gui-app-detection-sdwan enable end

2. Configure the SD-WAN members:

   1. Go to Network > SD-WAN, select the SD-WAN Zones tab, and click Create New > SD-WAN Member.

   2. Set the Interface to dmz, and set the Gateway to 172.16.208.2.

   3. Click OK.

   4. Repeat these steps to create another member for the vlan100 interface with gateway 172.16.206.2.

3. Configure the performance SLA (health check):

   1. Go to Network > SD-WAN, and select the Performance SLAs tab, and click Create New.

   2. Configure the following settings:

      Name	1
      Protocol	DNS
      Server	8.8.8.8
      SLA Target	Enable

   3. Click OK.

4. Configure the SD-WAN rule to use the video/audio and email application categories:

   1. Go to Network > SD-WAN, select the SD-WAN Rules tab, and click Create New.

   2. In the Destination section, click the + in the Application field.

   3. Click Category, and select Video/Audio and Email.

      

   4. Configure the other settings as needed.

   5. Click OK.

5. Configure the firewall policy:

   1. Go to Policy & Objects > Firewall Policy and click Create New.

   2. Configure the following settings:

      Incoming Interface	port5
      Outgoing Interface	virtual-wan-link
      Source	172.16.205.0
      Destination	all
      Schedule	always
      Service	ALL
      Action	ACCEPT
      Application Control	g-default
      SSL Inspection	certificate-inspection

   3. Click OK.

To configure application categories as an SD-WAN rule destination in the CLI:

1. Configure the SD-WAN settings:

   config system sdwan
       set status enable
       config zone
           edit "virtual-wan-link"
           next
       end
       config members
           edit 1
               set interface "dmz"
               set gateway 172.16.208.2
           next
           edit 2
               set interface "vlan100"
               set gateway 172.16.206.2
           next
       end
       config health-check
           edit "1"
               set server "8.8.8.8"
               set protocol dns
               set members 0
               config sla
                   edit 1
                   next
               end
           next
       end
   end

2. Configure the SD-WAN rule to use application categories 5 and 21:

   config system sdwan
       config service
           edit 1
               set name "1"
               set mode sla
               set src "172.16.205.0"
               set internet-service enable
               set internet-service-app-ctrl-category 5 21
               config sla
                   edit "1"
                       set id 1
                   next
               end
               set priority-members 1 2
           next
       end
   end

3. Configure the firewall policy:

   config firewall policy
       edit 1
           set srcintf "port5"
           set dstintf "virtual-wan-link"
           set action accept
           set srcaddr 172.16.205.0
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set ssl-ssh-profile "certificate-inspection"
           set application-list "g-default"
       next
   end

To test the configuration:

1. Verify that the traffic is sent over dmz:

   # diagnose firewall proute list
   list route policy info(vf=root):
   id=2133590017(0x7f2c0001) vwl_service=1(1) vwl_mbr_seq=1 2 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-65535 iif=0 dport=1-65535 path(2) oif=5(dmz) oif=95(vlan100)
   source(1): 172.16.205.0-172.16.205.255
   destination wildcard(1): 0.0.0.0/0.0.0.0
   internet service(2): (null)(0,5,0,0,0) (null)(0,21,0,0,0)
   hit_count=469 last_used=2021-12-15 15:06:05

2. View some videos and emails on the PC, then verify the detected application details for each category:

   # diagnose sys sdwan internet-service-app-ctrl-category-list 5
   YouTube(31077 4294838537): 142.250.217.110 6 443 Wed Dec 15 15:39:50 2021
   YouTube(31077 4294838537): 173.194.152.89 6 443 Wed Dec 15 15:37:20 2021
   YouTube(31077 4294838537): 173.194.152.170 6 443 Wed Dec 15 15:37:37 2021
   YouTube(31077 4294838537): 209.52.146.205 6 443 Wed Dec 15 15:37:19 2021

   # diagnose sys sdwan internet-service-app-ctrl-category-list 21
   Gmail(15817 4294836957): 172.217.14.197 6 443 Wed Dec 15 15:39:47 2021

3. Verify that the captured email traffic is sent over dmz:

   # diagnose sniffer packet any 'host 172.217.14.197' 4
   interfaces=[any]
   filters=[host 172.217.14.197]
   5.079814 dmz out 172.16.205.100.60592 -> 172.217.14.197.443: psh 2961561240 ack 2277134591

4. Edit the SD-WAN rule so that dmz has a higher cost and vlan100 is preferred.
5. Verify that the traffic is now sent over vlan100:

   # diagnose firewall proute list
   list route policy info(vf=root):
   id=2134048769(0x7f330001) vwl_service=1(1) vwl_mbr_seq=2 1 dscp_tag=0xff 0xff flags=0x0 tos=0x00 tos_mask=0x00 protocol=0 sport=0-65535 iif=0 dport=1-65535 path(2) oif=95(vlan100) oif=5(dmz)
   source(1): 172.16.205.0-172.16.205.255
   destination wildcard(1): 0.0.0.0/0.0.0.0
   internet service(2): (null)(0,5,0,0,0) (null)(0,21,0,0,0)
   hit_count=635 last_used=2021-12-15 15:55:43

   # diagnose sniffer packet any 'host 172.217.14.197' 4
   interfaces=[any]
   filters=[host 172.217.14.197]
   304.625168 vlan100 in 172.16.205.100.60592 -> 172.217.14.197.443: psh 2961572711 ack 2277139565

Example for IPv6

In this example, SD-WAN is configured to use an IPv6 service rule to steer traffic from FGT_A to FGT_B based on the following application control options:

• Application Telnet
• An application group for ping
• An application category that includes SSH

When the rule is matched, traffic is steered based on the lowest cost SLA strategy. In this example, vlan100 is the preferred interface, and traffic is routed to vlan100 on FGT_B.

To view the configuration:

1. View the SD-WAN configuration on FGT_A:

   SD-WAN has four members in the default virtual-wan-link zone, each with an IPv4 and IPv6 gateway. The SD-WAN service rule includes internet-service-app-ctrl 16091 for the Telnet, internet-service-app-ctrl-group "network-Ping" for ping , and internet-service-app-ctrl-category 15 for SSH applications.

   (sdwan) # show
   config system sdwan
       set status enable
       config zone
           edit "virtual-wan-link"
           next
       end
       config members
           edit 1
               set interface "dmz"
               set gateway 172.16.208.2
               set gateway6 2000:172:16:208::2
           next
           edit 2
               set interface "IPSec-1"
           next
           edit 3
               set interface "agg1"
               set gateway 172.16.203.2
               set gateway6 2000:172:16:203::2
           next
           edit 4
               set interface "vlan100"
               set gateway 172.16.206.2
               set gateway6 2000:172:16:206::2
           next
       end
       config health-check
           edit "1"
               set addr-mode ipv6
               set server "2000::2:2:2:2"
               set members 0
               config sla
                   edit 1
                   next
               end
           next
       end
       config service
           edit 1
               set name "1"
               set addr-mode ipv6
               set mode sla
               set internet-service enable
               set internet-service-app-ctrl 16091
               set internet-service-app-ctrl-group "network-Ping"
               set internet-service-app-ctrl-category 15
               config sla
                   edit "1"
                       set id 1
                   next
               end
               set priority-members 4 1 2 3
           next
       end
   end

2. View the default route for FGT_A:

   config router static
       edit 5
           set distance 1
           set sdwan-zone "virtual-wan-link"
       next
   end

3. View the firewall policy for FGT_A:

   The utm-status option is enabled to learn application 3T (3 tuple) information, and the default application profile of g-default is selected.

   config firewall policy
       edit 1
           set uuid f09bddc4-def3-51ed-8517-0d8b6bc18f35
           set srcintf "any"
           set dstintf "any"
           set action accept
           set srcaddr6 "all"
           set dstaddr6 "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set ssl-ssh-profile "certificate-inspection"
           set application-list "g-default"
       next
   end

To verify the configuration:

1. On FGT_A, check the routing table:

   The routing table has ECMP applied to default gateways for each SD-WAN member.

   # get router info routing-table  static
   Routing table for VRF=0
   S*      0.0.0.0/0 [1/0] via 172.16.203.2, agg1, [1/0]
                            [1/0] via 172.16.206.2, vlan100, [1/0]
                            [1/0] via 172.16.208.2, dmz, [1/0]
                            [1/0] via IPSec-1 tunnel 172.16.209.2, [1/0]

2. Check the SD-WAN service:

   Based on the service rule, member 4 named vlan100 is preferred. Traffic must also match the highlighted internet services.

   # diagnose system sdwan service
   
   Service(1): Address Mode(IPV6) flags=0x4200 use-shortcut-sla use-shortcut
    Tie break: cfg
     Gen(2), TOS(0x0/0x0), Protocol(0: 1->65535), Mode(sla), sla-compare-order
     Members(4):
       1: Seq_num(4 vlan100), alive, sla(0x1), gid(0), cfg_order(0), local cost(0), selected 
       2: Seq_num(1 dmz), alive, sla(0x1), gid(0), cfg_order(1), local cost(0), selected
       3: Seq_num(2 IPSec-1), alive, sla(0x1), gid(0), cfg_order(2), local cost(0), selected
       4: Seq_num(3 agg1), alive, sla(0x1), gid(0), cfg_order(3), local cost(0), selected
     Internet Service(3): Telnet(4294837974,0,0,0,0 16091) IPv6.ICMP(4294837087,0,0,0,0 16321) Network.Service(0,15,0,0,0)

3. Initiate traffic for ping, Telnet, and SSH to FGT_B, then FGT_A will learn 3T information for these applications, and use the SD-WAN rule to route traffic for the applications to the preferred interface of vlan100.

   • Following is the sniffer traffic for ping application. The ping traffic flows out of DMZ before 3T information is recognized, then out from vlan100 after T3 traffic is recognized:

     # diagnose sniffer packet any 'host 2000::2:0:0:4' 4
     interfaces=[any]
     filters=[host 2000::2:0:0:4]
     16.952138 port5 in 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 1 [flowlabel 0x5080d]
     16.954571 dmz out 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 1 [flowlabel 0x5080d]
     16.954920 dmz in 2000::2:0:0:4 -> 2000:172:16:205::100: icmp6: echo reply seq 1
     16.955086 port5 out 2000::2:0:0:4 -> 2000:172:16:205::100: icmp6: echo reply seq 1
     17.953277 port5 in 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 2 [flowlabel 0x5080d]
     17.953455 dmz out 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 2 [flowlabel 0x5080d]
     17.953622 dmz in 2000::2:0:0:4 -> 2000:172:16:205::100: icmp6: echo reply seq 2
     17.953722 port5 out 2000::2:0:0:4 -> 2000:172:16:205::100: icmp6: echo reply seq 2
     18.959823 port5 in 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 3 [flowlabel 0x5080d]
     18.960005 vlan100 out 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 3 [flowlabel 0x5080d]
     18.960015 agg1 out 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 3 [flowlabel 0x5080d]
     18.960024 port4 out 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 3 [flowlabel 0x5080d]
     18.960295 vlan100 in 2000::2:0:0:4 -> 2000:172:16:205::100: icmp6: echo reply seq 3
     18.960449 port5 out 2000::2:0:0:4 -> 2000:172:16:205::100: icmp6: echo reply seq 3
     19.983802 port5 in 2000:172:16:205::100 -> 2000::2:0:0:4: icmp6: echo request seq 4 [flowlabel 0x5080d]

   • Following is the sniffer traffic for Telnet application group. The Telnet traffic flows out of agg1 before 3T information is recognized, then out from vlan100 after T3 traffic is recognized:

     # diagnose sniffer packet any 'host 2000::2:0:0:4 and dst port 23' 4 
     interfaces=[any]
     filters=[host 2000::2:0:0:4 and dst port 23]
     4.096393 port5 in 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: syn 2723132265  [flowlabel 0xd4e65]           
     4.096739 agg1 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: syn 2723132265  [flowlabel 0xd4e65]
     4.096752 port4 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: syn 2723132265  [flowlabel 0xd4e65]
     .........
     5.503679 port5 in 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: psh 2723132345 ack 544895389  [flowlabel 0xd4e65]
     5.503894 vlan100 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: psh 2723132345 ack 544895389  [flowlabel 0xd4e65]
     5.503907 agg1 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: psh 2723132345 ack 544895389  [flowlabel 0xd4e65]
     5.503918 port4 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: psh 2723132345 ack 544895389  [flowlabel 0xd4e65]
     5.504641 port5 in 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: ack 544895390  [flowlabel 0xd4e65]
     5.504713 vlan100 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: ack 544895390  [flowlabel 0xd4e65]
     5.504721 agg1 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: ack 544895390  [flowlabel 0xd4e65]
     5.504728 port4 out 2000:172:16:205::100.43128 -> 2000::2:0:0:4.23: ack 544895390  [flowlabel 0xd4e65]

   • Following is the sniffer traffic for SSH application category. The SSH traffic flows out of dmz before 3T information is recognized, then out from vlan100 after T3 traffic is recognized:

     # diagnose sniffer packet any 'host 2000::2:0:0:4 and dst port 22' 4
     interfaces=[any]
     filters=[host 2000::2:0:0:4 and dst port 22]
     5.910752 port5 in 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: syn 980547187  [flowlabel 0xf1403]
     5.911002 dmz out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: syn 980547187  [flowlabel 0xf1403]
     5.914550 port5 in 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: ack 583860244  [flowlabel 0xf1403]
     5.914651 dmz out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: ack 583860244  [flowlabel 0xf1403]
     .....
     8.116507 port5 in 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: psh 980549261 ack 583862554  [class 0x10] [flowlabel 0xf1403]
     8.116663 vlan100 out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: psh 980549261 ack 583862554  [class 0x10] [flowlabel 0xf1403]
     8.116674 agg1 out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: psh 980549261 ack 583862554  [class 0x10] [flowlabel 0xf1403]
     8.116685 port4 out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: psh 980549261 ack 583862554  [class 0x10] [flowlabel 0xf1403]
     8.118135 port5 in 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: ack 583862598  [class 0x10] [flowlabel 0xf1403]
     8.118171 vlan100 out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: ack 583862598  [class 0x10] [flowlabel 0xf1403]
     8.118179 agg1 out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: ack 583862598  [class 0x10] [flowlabel 0xf1403]
     8.118189 port4 out 2000:172:16:205::100.35146 -> 2000::2:0:0:4.22: ack 583862598  [class 0x10] [flowlabel 0xf1403]

4. View the IPv6 application control internet service ID list:

   # diagnose system sdwan internet-service-app-ctrl6-list
   
   Telnet(16091 4294837974): 2000::2:0:0:4 6 23 Thu Apr 20 17:43:00 2023
   IPv6.ICMP(16321 4294837087): 2000::2:0:0:4 58 0 Thu Apr 20 17:43:00 2023

5. View the IPv6 application control internet service ID list by category:

   # diagnose system sdwan internet-service-app-ctrl6-category-list
   
   SSH(16060 4294837772): 2000::2:0:0:4 6 22 Thu Apr 20 17:43:00 2023