Technical Tip: Application learning phases in SD-WAN application steering traffic

[pgautam]

Description	This article will describe how the application signature will be learned in the SD-WAN application steering.
Scope	FortiGate, SD-WAN, Application Steering.
Solution	When an application steering is performed with SD-WAN, FortiGate must first identify the application on the traffic before it can match the right rule. To accelerate application steering, FortiGate maintains an ISDB application cache.  Each entry in the cache table maps a 3-tuple- destination IP, protocol, and destination port. This cache is used by FortiGate to quickly identify the application of new sessions based on the following premise. When FortiGate receives the first packet of a session, it proceeds as follows:- Check if the 3-tuple on the packet matches an entry in the ISDB application cache. If so, FortiGate routes the packet based on the matching SD-WAN rule and then performs a firewall policy lookup. If the packet does not match an entry in the cache FortiGate performs route and firewall policy lookup for the packet After the firewall policy lookup, FortiGate must identify the application. This applied to sessions that match an entry in the cache. The packet is sent to the IPS engine for application detection. After the application is detected, FortiGate adds the session 3-tuple to the cache, writes the application info to the session, and flags the session as dirty (SNAT conditions apply). The dirty flag triggers a session re-evaluation, and therefore, new route and firewall policy lookups on the next packet. If the application is not detected, FortiGate attempts to detect the application on the next packet. It is possible to use the below links to configure the application-based SD-WAN rule: Before 7.2.x application option was available in the SD-WAN policy and after 7.2.x first GUI app detection feature needed to be enabled: config system global     set gui-app-detection-sdwan enable end Application steering using SD-WAN rules Application steering using SD-WAN rules Example: GoToMeeting traffic needs to be sent from one of the SD-WAN members port1: config system sdwan     set status enable     set load-balance-mode weight-based     config zone         edit "virtual-wan-link"         next     end     config members         edit 1             set interface "port1"             set gateway 10.5.31.254             set weight 50         next         edit 5             set interface "port6"             set weight 50         next     end edit "test_sla"             set server "8.8.8.8"             set members 1 5         next     end     config service         edit 2             set name "Application_steering"             set src "all"             set internet-service enable             set internet-service-app-ctrl 16354 17573             set priority-members 1         next end When traffic is not initiated, the cache list is blank: Lab_FGT# diagnose sys sdwan internet-service-app-ctrl-list Lab_FGT#  After traffic is matched as per the policy and the application is detected: Lab_FGT(8) # show config firewall policy     edit 8         set name "application_steering"         set uuid f04c4690-31cf-51ee-0923-1179aaf0814e         set srcintf "port4"         set dstintf "virtual-wan-link"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"         set utm-status enable         set inspection-mode proxy         set ssl-ssh-profile "certificate-inspection"         set application-list "default"         set logtraffic all         set nat enable     next end Lab_FGT# dia sys sdwan internet-service-app-ctrl-list GoToMeeting(16354 4294836966): 18.161.111.39 6 443 Mon Aug 28 21:17:36 2023 GoToMeeting(16354 4294836966): 18.161.111.59 6 443 Mon Aug 28 21:19:11 2023 GoToMeeting(16354 4294836966): 18.161.111.68 6 443 Mon Aug 28 20:58:17 2023 GoToMeeting(16354 4294836966): 34.198.75.68 6 443 Mon Aug 28 21:18:36 2023 GoToMeeting(16354 4294836966): 34.206.239.52 6 443 Mon Aug 28 21:19:36 2023 GoToMeeting(16354 4294836966): 52.40.83.126 6 443 Mon Aug 28 21:16:03 2023 GoToMeeting(16354 4294836966): 52.200.153.10 6 443 Mon Aug 28 20:58:05 2023 GoToMeeting(16354 4294836966): 52.205.189.0 6 443 Mon Aug 28 21:17:28 2023 GoToMeeting(16354 4294836966): 52.222.144.46 6 443 Mon Aug 28 21:15:54 2023 GoToMeeting(16354 4294836966): 52.222.144.71 6 443 Mon Aug 28 20:57:55 2023 GoToMeeting(16354 4294836966): 54.230.112.74 6 443 Mon Aug 28 21:16:55 2023 GoToMeeting(16354 4294836966): 54.230.112.105 6 443 Mon Aug 28 20:58:22 2023 GoToMeeting(16354 4294836966): 54.230.112.113 6 443 Mon Aug 28 21:16:54 2023 GoToMeeting(16354 4294836966): 96.16.248.27 6 443 Mon Aug 28 20:58:19 2023 GoToMeeting(16354 4294836966): 150.136.248.95 6 443 Mon Aug 28 20:58:22 2023 graviton-kvm01 # diagnose  sys sdwan service 2 Service(2): Address Mode(IPV4) flags=0x200 use-shortcut-sla  Tie break: cfg   Gen(1), TOS(0x0/0x0), Protocol(0: 1->65535), Mode(manual)   Members(1):     1: Seq_num(1 port1), alive, selected   Internet Service(2): GoToMeeting(4294836966,0,0,0,0 16354) Bugzilla(4294836533,0,0,0,0 17573)   Src address(1):         0.0.0.0-255.255.255.255 session info: proto=6 proto_state=11 duration=18 expire=3592 timeout=3600 flags=00000000 socktype=0 sockport=443 av_idx=9 us e=5 origin-shaper= reply-shaper= per_ip_shaper= class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255 state=redir log local may_dirty nlb f00 app_valid statistic(bytes/packets/allow_err): org=2593/18/1 reply=8769/19/1 tuples=3 tx speed(Bps/kbps): 61/0 rx speed(Bps/kbps): 390/3 orgin->sink: org pre->post, reply pre->post dev=6->3/3->6 gwy=10.5.31.254/0.0.0.0 hook=post dir=org act=snat 10.201.15.72:63143->96.16.248.27:443(10.5.20.11:63143) hook=pre dir=reply act=dnat 96.16.248.27:443->10.5.20.11:63143(10.201.15.72:63143) hook=post dir=reply act=noop 96.16.248.27:443->10.201.15.72:63143(0.0.0.0:0) pos/(before,after) 0/(0,0), 0/(0,0) misc=0 policy_id=8 pol_uuid_idx=15771 auth_info=0 chk_client_info=0 vd=0 serial=02140202 tos=40/40 app_list=2000 app=16354 url_cat=0 sdwan_mbr_seq=1 sdwan_service_id=2  rpdb_link_id=ff000002 ngfwid=n/a npu_state=0x001108 no_ofld_reason:  redir-to-av app=16354 <----- Matched application ID from the cache list. sdwan_service_id=2<----- SD-WAN rule ID. sdwan_mbr_seq=1 <----- SD-WAN member ID. Note: Packets are always sent to the IPS for application detection. This way, FortiGate can later match the correct rule for the session if the detected application happens to be different from the one matched in the cache. That is, during the learning phase, a session may not match the expected rule and member Related documents: Technical Tip: 'Dirty' session Application steering using SD-WAN rules Application control Technical Tip: How does the IPS engine determine if a packet contains an attack or anomaly https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/565562/intrusion-prevention