Technical Tip: Application learning phases in SD-WAN application steering traffic
| Description | This article will describe how the application signature will be learned in the SD-WAN application steering. |
| Scope | FortiGate, SD-WAN, Application Steering. |
| Solution | When an application steering is performed with SD-WAN, FortiGate must first identify the application on the traffic before it can match the right rule. To accelerate application steering, FortiGate maintains an ISDB application cache. Each entry in the cache table maps a 3-tuple: destination IP, protocol, and destination port. This cache is used by FortiGate to quickly identify the application of new sessions based on the following premise. When FortiGate receives the first packet of a session, it proceeds as follows:-
The dirty flag triggers a session re-evaluation, and therefore, new route and firewall policy lookups on the next packet. If the application is not detected, FortiGate attempts to detect the application on the next packet. Consult the following links to configure the application-based SD-WAN rule: Before 7.2.x application option was available in the SD-WAN policy and after 7.2.x, the GUI app detection feature needed to be enabled first: config system global set gui-app-detection-sdwan enable end
Example: GoToMeeting traffic needs to be sent from one of the SD-WAN members port1: config system sdwan set status enable set load-balance-mode weight-based config zone edit "virtual-wan-link" next end config members edit 1 set interface "port1" set gateway 10.5.31.254 set weight 50 next edit 5 set interface "port6" set weight 50 next end edit "test_sla" set server "8.8.8.8" set members 1 5 next end config service edit 2 set name "Application_steering" set src "all" set internet-service enable set internet-service-app-ctrl 16354 17573 set priority-members 1 next end When traffic is not initiated, the cache list is blank: Lab_FGT# diagnose sys sdwan internet-service-app-ctrl-list Lab_FGT# After traffic is matched as per the policy and the application is detected: Lab_FGT(8) # show config firewall policy edit 8 set name "application_steering" set uuid f04c4690-31cf-51ee-0923-1179aaf0814e set srcintf "port4" set dstintf "virtual-wan-link" set action accept set srcaddr "all" set dstaddr "all" set schedule "always" set service "ALL" set utm-status enable set inspection-mode proxy set ssl-ssh-profile "certificate-inspection" set application-list "default" set logtraffic all set nat enable next end Lab_FGT# dia sys sdwan internet-service-app-ctrl-list GoToMeeting(16354 4294836966): 18.161.111.39 6 443 Mon Aug 28 21:17:36 2023 GoToMeeting(16354 4294836966): 18.161.111.59 6 443 Mon Aug 28 21:19:11 2023 GoToMeeting(16354 4294836966): 18.161.111.68 6 443 Mon Aug 28 20:58:17 2023 GoToMeeting(16354 4294836966): 34.198.75.68 6 443 Mon Aug 28 21:18:36 2023 GoToMeeting(16354 4294836966): 34.206.239.52 6 443 Mon Aug 28 21:19:36 2023 GoToMeeting(16354 4294836966): 52.40.83.126 6 443 Mon Aug 28 21:16:03 2023 GoToMeeting(16354 4294836966): 52.200.153.10 6 443 Mon Aug 28 20:58:05 2023 GoToMeeting(16354 4294836966): 52.205.189.0 6 443 Mon Aug 28 21:17:28 2023 GoToMeeting(16354 4294836966): 52.222.144.46 6 443 Mon Aug 28 21:15:54 2023 GoToMeeting(16354 4294836966): 52.222.144.71 6 443 Mon Aug 28 20:57:55 2023 GoToMeeting(16354 4294836966): 54.230.112.74 6 443 Mon Aug 28 21:16:55 2023 GoToMeeting(16354 4294836966): 54.230.112.105 6 443 Mon Aug 28 20:58:22 2023 GoToMeeting(16354 4294836966): 54.230.112.113 6 443 Mon Aug 28 21:16:54 2023 GoToMeeting(16354 4294836966): 96.16.248.27 6 443 Mon Aug 28 20:58:19 2023 GoToMeeting(16354 4294836966): 150.136.248.95 6 443 Mon Aug 28 20:58:22 2023 graviton-kvm01 # diagnose sys sdwan service 2 Service(2): Address Mode(IPV4) flags=0x200 use-shortcut-sla Tie break: cfg Gen(1), TOS(0x0/0x0), Protocol(0: 1->65535), Mode(manual) Members(1): 1: Seq_num(1 port1), alive, selected Internet Service(2): GoToMeeting(4294836966,0,0,0,0 16354) Bugzilla(4294836533,0,0,0,0 17573) Src address(1): 0.0.0.0-255.255.255.255 session info: proto=6 proto_state=11 duration=18 expire=3592 timeout=3600 flags=00000000 socktype=0 sockport=443 av_idx=9 us e=5 origin-shaper= reply-shaper= per_ip_shaper= class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255 state=redir log local may_dirty nlb f00 app_valid statistic(bytes/packets/allow_err): org=2593/18/1 reply=8769/19/1 tuples=3 tx speed(Bps/kbps): 61/0 rx speed(Bps/kbps): 390/3 orgin->sink: org pre->post, reply pre->post dev=6->3/3->6 gwy=10.5.31.254/0.0.0.0 hook=post dir=org act=snat 10.201.15.72:63143->96.16.248.27:443(10.5.20.11:63143) hook=pre dir=reply act=dnat 96.16.248.27:443->10.5.20.11:63143(10.201.15.72:63143) hook=post dir=reply act=noop 96.16.248.27:443->10.201.15.72:63143(0.0.0.0:0) pos/(before,after) 0/(0,0), 0/(0,0) misc=0 policy_id=8 pol_uuid_idx=15771 auth_info=0 chk_client_info=0 vd=0 serial=02140202 tos=40/40 app_list=2000 app=16354 url_cat=0 sdwan_mbr_seq=1 sdwan_service_id=2 rpdb_link_id=ff000002 ngfwid=n/a npu_state=0x001108 no_ofld_reason: redir-to-av app=16354 <----- Matched application ID from the cache list. sdwan_service_id=2<----- SD-WAN rule ID. sdwan_mbr_seq=1 <----- SD-WAN member ID. Note: Packets are always sent to the IPS for application detection which implies:
This way, FortiGate can later match the correct rule for the session if the detected application happens to be different from the one matched in the cache. That is, during the learning phase, a session may not match the expected rule and member. Related documents: |
