topic Re: SD-WAN Traffic Control from the Hub Side in Next-Generation Firewall Discussions

SD-WAN Traffic Control from the Hub Side

D.Henze — Fri, 06 Dec 2024 12:23:14 GMT

Hi Guys,

our Palo Alto on the HUB side is equipped with a single 10G uplink interface. On the Spoke side, there are three uplinks with varying bandwidths, and in this setup, the Panorama SD-WAN plugin generates three IPsec tunnels. I can manage traffic from the Spoke to the HUB using SD-WAN Rules and Traffic Distribution Profiles.

However, is it possible to control traffic from the HUB to the Spoke? Currently, traffic is evenly distributed across all three links. This causes issues, as a link with very low bandwidth is also used, leading to congestion and degraded performance.

Best regards
Dirk

Re: SD-WAN Traffic Control from the Hub Side

S.Cantwell — Tue, 10 Dec 2024 20:30:24 GMT

Good Day

I am not sure which version of the SDWAN solution (PanOS vs Prisma SDWAN) you are using, so I am presuming PANOS SDWAN, else you would have mentioned IONs and SCM configurations.

I did not hear mention of the required Panorama and SDWAN licensing in your query. I presume the SDWAN licensing has been utilized.

Can you just confirm that Panorama is also part of the solution, so push down the configurations from the Panorama to the FWs (both HuB and Branch sites)

If you have 3 uplinks of various speeds, the SDWAN configurations (presuming you are using Panorama with current SDWAN plugin) and FWs with the correct SDWAN licensing, should utilize the expected feature that the best link should be used in communicating from Branch to Hub. How much Hub-sourced to Branch-destined traffic is occurring.

You may want to speak with your local PANW Domain Consultant (formerly SEs) to further assistance.

Re: SD-WAN Traffic Control from the Hub Side

D.Henze — Thu, 12 Dec 2024 11:32:19 GMT

Hi,

Thank you very much.

You are absolutely correct; we are using PANOS SD-WAN, and the SD-WAN licensing has been utilized.
I can also confirm that we exclusively use the Panorama SD-WAN configuration.

The communication from the branch side works as expected. However, I am unable to control the traffic flow from the hub to the branch side.
It seems that traffic from the hub to the branch side is distributed in a round-robin fashion across all three tunnel interfaces.