EA Feature: SLA-Based Prioritize Local Breakout

This section describes an SD-WAN feature in the Early Availability stage.

Important:

  • Contact the SD-WAN team to get information about the new R82 SD-WAN Early Availability features before starting your journey.

  • To get this feature, you must install the R82 Early Availability packages on the SD-WAN Security Gateway.

    See the "Downloads" section in sk180605.

For more information, see Routing Preference "Prioritize Local Breakout".

When you configure the Steering Behavior to use the type "Internet" with the Routing Preference "Prioritize Local Breakout":

  1. The Security Gateway uses direct WAN Links to connect to the Internet.

  2. If the Criteria parameters (even if one of them) exceed the configured thresholds in the applicable Steering Behavior in all direct WAN Links to the Internet, the Security Gateway uses the WAN Link with encrypted traffic to the Headquarters to connect to the Internet (the "Backhaul" behavior).

You can change the Security Gateway behavior to fail over to the "Backhaul" behavior when all direct WAN Links to the Internet are down (because a link is down, or the probing next hop is down):

  1. From the left navigation panel, click Network.

  2. In the middle section, click Profiles.

  3. Click the applicable SD-WAN profile.

  4. Click the Advanced tab.

  5. Click the left cell key and enter this parameter:

    sdw_bhl_prefer_brk

  6. Click the right cell value, enter digit "0", and press the Enter key:

    0

    The row with the configured parameter must appear below the default empty row "key - value".

  7. At the top, click Publish.

  8. At the top, click Enforce.

Important:

  • This parameter applies to all Security Gateways that use this SD-WAN Profile.

    If this behavior change is required only for some Security Gateways:

    1. Create a new SD-WAN Profile.

    2. Add only the applicable Security Gateways to this new profile.

    3. Configure the parameter "sdw_bhl_prefer_brk" in this new profile.

    4. Edit the SD-WAN Profile that contains Security Gateways, whose failover behavior must not change.

    5. Remove the applicable Security Gateways, for which you created a new SD-WAN Profile.

    6. At the top, click Publish.

    7. At the top, click Enforce.

  • If the $FWDIR/conf/sdwan/sdwan_steering_params.json file on a Security Gateway contains this parameter "sdw_bhl_prefer_brk", then the value of this parameter in this file takes precedence over the value of this parameter that you configured in an SD-WAN Profile.

    If you edit this file, then you must restart the SD-WAN Steering process on the Security Gateway:

    sdwan_steering_stop ; sdwan_steering_start

  • To restore the default Security Gateway behavior (fail over based on the Criteria parameters), delete the key "sdw_bhl_prefer_brk" in the applicable SD-WAN profile, click Publish, and click Enforce.

Important:

  • For Quantum Spark Gateways, this feature is still in the Early Availability stage.

    The Quantum Spark Gateway must run the R81.10.17 Early Availability firmware from sk180605.

  • In a Cluster, you must configure all the Cluster Members in the same way.

When you configure the Steering Behavior to use the type "Internet" with the Routing Preference "Prioritize Local Breakout":

  1. The Security Gateway uses direct WAN Links to connect to the Internet.

  2. If all direct WAN Links to the Internet are down (because a link is down, or the probing next hop is down), the Security Gateway uses the WAN Link with encrypted traffic to the Headquarters to connect to the Internet (the "Backhaul" behavior).

You can change the Security Gateway behavior to fail over to the "Backhaul" behavior if the Criteria parameters (even if one of them) exceed the configured thresholds in the applicable Steering Behavior in all direct WAN Links to the Internet:

  1. Connect to the command line on the Quantum Spark Gateway / each Quantum Spark Cluster Member.

  2. Log in.

  3. If your default shell is Gaia Clish, then go to the Expert mode:

    expert

  4. Modify the $FWDIR/conf/sdwan/sdwan_steering_params.json file:

    1. If the file $FWDIR/conf/sdwan/sdwan_steering_params.json exists, create a backup copy.

      Otherwise, create this file.

      Run this long command:

      if [ -f $FWDIR/conf/sdwan/sdwan_steering_params.json ] ; then echo "Creating the backup ..." ; cp -v $FWDIR/conf/sdwan/sdwan_steering_params.json{,BKP} ; else echo "Creating the file ..." ; touch $FWDIR/conf/sdwan/sdwan_steering_params.json ; stat $FWDIR/conf/sdwan/sdwan_steering_params.json ; fi

    2. Edit the $FWDIR/conf/sdwan/sdwan_steering_params.json file:

      vi $FWDIR/conf/sdwan/sdwan_steering_params.json

    3. If this file is empty, then add all these lines.

      If this file already contains other configuration parameters, then add this configuration parameter on a new line:

      {
    "sdw_bhl_prefer_brk" : 1
}

      Note - To restore the default Security Gateway behavior (fail over if all direct WAN Links to the Internet are down), remove this parameter from the configuration file.

    4. Save the changes in the file and exit the editor.

  5. Restart the SD-WAN Steering process:

    sdwan_steering_stop ; sdwan_steering_start

    Warning - Until the SD-WAN Steering process starts again (in normal circumstances, it takes less than one minute):

    • Existing and new VPN / Overlay connections are interrupted.

    • Existing Local Breakout connections may be interrupted.

    • New Local Breakout connections cannot undergo the SD-WAN Local Breakout routing.