Technical Tip: Possible reasons for SD-WAN members in Performance SLA showing 'DOWN' status

Performance SLA is designed to reflect the performance status of participant SD-WAN members through the configured probe server(s). In some scenarios, given that the probe server(s) is reachable the performance SLA shows DOWN status for the participant SD-WAN members.

Possible things to check when troubleshooting the status of SD-WAN members in the performance SLA:

1. Protocol used to probe server(s). Lately, Microsoft Office/Office365 restricted HTTP protocol (port 80). This will bring the status DOWN of participating SD-WAN members. If instead Ping Protocol is used it will work. It is necessary to check all the supported protocols on the probe server(s) for the proper functionality of the respective SD-WAN health-check.

2. Very restricted SLA Target values for latency, jitter, and packet loss thresholds for the participating SD-WAN members. If the thresholds of SD-WAN members are slightly higher than the configured thresholds, the status will show DOWN. Reconsider SLA Target values and adjust them to be as close as, or slightly higher, than the performance metrics of participating SD-WAN members.

3. Bad performance metrics of the SD-WAN members even if the SLA Target values are not restricted. For example, if the SD-WAN members are public circuits connected to ISP routers that have very poor performance metrics due to ISP issues, this will increase the metric values to be more than the configured SLA Target thresholds (latency, jitter, and packet loss), and thus bring the participating SD-WAN members to DOWN status.

To troubleshoot the SLA status showing 'down', follow the steps below to root out the exact cause.

• Troubleshooting commands:

diagnose sys sdwan health-check
diagnose debug app link-monitor -1
diagnose debug app httpsd -1
diagnose debug enable

Wait for 2-3 minutes, then run the following:

diagnose debug disable
diagnose sys waninfo ipify
diagnose sys link-monitor interface <>

• Take the sniffer on the specific WAN interface with the command below and verify whether there is a response from the server.

diagnose sniffer packet <interface> "host <server ip>" 4 0 l