Hi I’m Jelan from Sophos Techvids and today I’ll be walking you through the new
SD-WAN features in Sophos Firewall version 19.
SFOS V19 delivers greatly enhanced SD-WAN, VPN, and Networking capabilities.
This enables you to easily meet your connectivity goals
while making day-to-day management even easier.
Performance-Based Link Selection ensures your most
important traffic is routed over your best performing WAN connection
based on latency, jitter, and packet loss.
Zero-Impact Failover Transitions between WAN links to ensure end-user applications
are not impacted by ISP outages or disruption.
In this video, I’ll demonstrate how to set up an SD-WAN route with a performance SLA.
How Zero-Impact transitions work.
And finally how to breakout traffic for SaaS applications like Office365, and SalesForce.
Let's start with an example of a generic company.
#1 They’re going through a digital transformation and are using SaaS applications
like Office 365, Salesforce etc.
#2 Their IT department wants to use voice and video to enable global collaboration using a private VoIP application.
And finally
#3 They're looking to reduce TCO or WAN OPEX Spending without compromising SLA.
Let's jump into SFOS V19 and see how they can do this.
As you can see we have an MPLS link on Port 2 and a broadband link on Port 3.
We've also established a VPN tunnel over the broadband link and we can verify
the connectivity status of the VPN showing that it's up and running.
We'll also verifythe rules and policies to ensure that we have appropriate rules for both VPN and MPLS traffic.
Currently, most of their traffic is backhauled to the Data Center but we want to break-out
some of the SaaS traffic so that it can go directly from the branch to the internet.
First, let's configure SD-WAN profiles under routing SD-WAN Profiles
We'll create two profiles, one for the general traffic to the Data Center
and another for the VoIP application.
We'll start with the profile for the general web traffic.
For the Gateway, we'll select VPN for the first link and MPLS as the second link.
For the SLA we'll choose custom SLA and leave the configuration as default.
For the health check let's set the probe-target to a destination host
which is reachable by both MPLS and VPN
and we'll reduce the timers for faster failover.
Let's save this configuration.
Next, let's create the SD-WAN profile for voice over IP traffic.
For the gateway, again we'll select VPN as the first link and MPLS as the second link.
We'll again define a custom SLA criteria to meet the VoIP application requirements
and reduce the latency jitter and packet loss so that it's appropriate for VoIP traffic.
The info however, it actually shows performance SLA recommended
values for different application categories like web Voice Over IP and office 365.
For health check let's again set the probe target to a destination host
that's reachable by both MPLS and VPN.
We'll reduce the timers to the minimums
and hit save.
All right, so we have both of our profiles created
and we can see VPN overlay is the preferred link
because it's performing well under the SLA criteria.
Now let's create SD routes to route traffic to the Data Center.
Our first route will be for general web traffic.
We'll use a destination based SD-WAN route.
I've already created an IP host for the remote subnet 192.168.1.0/24
network as we saw in the topology, so we'll select that for the destination network.
Under Link Selection, we'll select the SD-WAN profile
we created for the web traffic and save this configuration.
Next, for all the critical web traffic we'll clone the route
and configure an application-based SD-WAN route for the VoIP traffic.
Now I've already created an application object for VoIP but to create the application object
click ADD and using the smart filter to filter for SIP leave select all and save.
Now under link selection, we'll select the SD-WAN profile we created for VoIP traffic and hit clone.
Let's reorder the routes by placing void traffic at the top.
Okay now that we have the profiles and routes set up, let's test.
Going back to our network topology.
Let's say Alonso at branch 1 is trying to call Blake at the Data Center.
Based on the configuration, the call will be routed through the VPN link.
Now to ensure failover is working, we'll inject some delay into the VPN link so that
once the system detects that delay, it switches over to MPLS.
For making the call, I'm using an open SIP phone using SIP and UDP protocols.
Let's go ahead and make that call.
And now we're connected.
Enabled video so we can actually see the XGS on the remote side.
To ensure that it's going through the right connection.
There's actually a traffic usage counter and we
can see traffic is flowing through this profile.
Under Live Connection,
I have a session initiation protocol which is SIP.
and you can see XFRM or VPN is the preferred link.
Now let's see Zero-Impact transitions in action.
First we'll inject latency on the VPN interface connected on Port 3
to verify whether the system is responding to
this degradation and rerouting to a better link.
You can see the firewall is currently selected VPN as the link performance latency jitter and
loss are well under the acceptable criteria.
Now let's inject latency on the VPN interface.
You can see the green tick has immediately shifted to MPLS
and the SLA tooltip reflects the increase in latency values.
This demonstrates how the firewall immediately responded to this delay by
rerouting the active connection to MPLS without any impact
and as you can see the video call is still up and running.
We can also verify this under current activities Live Connection.
For SIP you can see all active connections are flowing through Port 2, the MPLS link.
To monitor link performance, navigate to Diagnostics, SD-WAN Performance.
You can monitor SD-WAN link performance in real-time and get historical performance data allowing you to
easily optimize your SD-WAN profile settings.
Here we can see degradation in the SLA performance
of the VPN link as it's reached its maximum acceptable values.
Now you might be wondering how to ensure whether this is a seamless failover
or a new connection initiated by the client
To verify this on the command line I'm going
to take the conntrack output for the VoIP call.
I'll filter the destination host IP and RTP port 7078.
Let's copy the conntrack ID for the RTP connection and filter based on this ID.
We can see the mark entry as 4004 which means the SD-WAN route matches.
Also, root ID-2 is selected for the Out interface and the SD-WAN profile-id is 2.
We can verify this information in the UI by looking at the ID column which shows
VoIP traffic ID as 2.
This also confirms that the OUT interface used is Port 2 MPLS.
Let's bring up the video call window.
What I'll do this time is actually
unplug the MPLS link to see if the system immediately reroutes to the VPN connection.
Okay I've removed the MPLS link and within about a second or two the firewall will reroute
the active VoIP connection to the VPN link.
You can see that the call is still running
and the connection has shifted to VPN.
We'll verify the contract output again for the same ID.
As you can see, for the same connection ID, the connection is still up the call
is still running and we can see the out port has changed to VPN the XFRM Port 3.
Again we can verify this under Current Activities, Live Connection
And we can see SIP
and we can see all active connections are flowing through VPN.
And that demonstrates Zero-Impact failover.
Sophos Firewall ensures all SD-WAN link transitions have Zero-Impact on active connections
and sessions, making ISP disruptions transparent to end-users.
For monitoring SD-WAN routing activity in the log viewer,
additional routing and profile information has been added to the firewall logs.
Also, a new SD-WAN log viewer module is introduced
to monitor SD-WAN route and health related information.
Next, let's see how we can breakout some of the SaaS traffic like Office 365
Salesforce and Zoom, to go directly from the Branch to the Internet.
We'll go to routing,
SD-WAN route
and click ADD.
I'll select the SaaS traffic by selecting application objects for Office 365 Salesforce
and Zoom, which I've pre-configured.
Under Link Selection settings we'll select SD-WAN profile
and click + (new) to add the profile for the SaaS traffic.
I'll name the profile and select the internet links.
We'll leave the rest of the configuration as default
hit SAVE then save the SD-WAN route.
And now the new SD-WAN route for
SaaS applications is configured.
You can see the usage under SD-WAN profile.
It takes a few seconds to calculate the SLA
then you can see the firewall has measured the SLA and selected the best link.
The new Xstream SD-WAN capabilities with Performance-Based Routing Strategies,
Zero-Impact Transitions
and Real-Time Monitoring,
enable you to achieve your SD-WAN goals quickly and easily.
Optimize the performance of your SD-WAN network
to ensure maximum resiliency in application performance
while providing the best end-user experience
in even the most unstable ISP environments.
We hope you found this video useful.
Let us know by giving us a thumbs up on Techvids
and comment if we resolved your issue.
Check out the documentation for this video in the video description
and for further assistance view and post questions on
community.sophos.com
Lastly, make sure to check out techvids.sophos.com
for more great videos like this one.
Thanks for watching. Stay safe out there.