Although we have configured all traffic to route through Private1(SD-WAN Router 1) using AAR, there is still some traffic passing through biz-int. We have built the SD-WAN environment with the configuration shown in the attached image.
On the vSmart, we have implemented the following settings to ensure that all data traffic is routed through Private1 using AAR.
app-route-policy Site01_AAR
vpn-list VPN3301
sequence 9999
action
count AAR_Sequence_9999
sla-class SLA_Class_0 preferred-color private1
policy
sla-class SLA_Class_0
loss 100
!
However, when checking with Zabbix (a network monitoring tool), we observed that there is traffic (about 20Mbps) passing through the WAN(Biz-internet) interface of SD-WAN Router 2.
Our expectation was that all traffic would be routed through the WAN of SD-WAN Router 1.
Do you have any idea why this might be happening? Could the traffic bursts observed in Zabbix be related to this issue?
@dijix1990
>So you aar policy seems correct, and it applied both to dc and branches and both from service side only, is it correct?,
Yes, correct.
data policy configuration is the following.
SD-WAN-Router2#show sdwan policy from-vsmart
from-vsmart sla-class SLA_Class_0
loss 100
from-vsmart data-policy VPN3301_Site30307005_DP
direction from-service
vpn-list VPN3301
sequence 9999
action accept
count DP_Sequence_9999
cflowd
log
default-action accept
from-vsmart cflowd-template VPN3301_netflow
flow-active-timeout 600
flow-inactive-timeout 60
template-refresh 60
flow-sampling-interval 1000
protocol ipv4
customized-ipv4-record-fields
no collect-tos
no collect-dscp-output
collector vpn 3301 address 10.122.242.243 port 2055 transport transport_udp
from-vsmart app-route-policy VPN3301_Site30307005_AAR
vpn-list VPN3301
sequence 9999
action
count AAR_Sequence_9999
sla-class SLA_Class_0
no sla-class strict
sla-class preferred-color private1
from-vsmart lists vpn-list VPN3301
vpn 3301
SD-WAN-Router2#
>Oh and can you do Simulate flow (monitor - devices - choose device - troubleshooting - Simulate flow) for traffic from vpn 3301 from both edge routers?
Yes, I can, I did simulation flow from both SD-WAN Router1 and 2 to the LAN IP address (VPN3301) of SD-WAN ROuter in another site.
SD-WAN ROuter 1
SD-WAN Router2
The traffic goes through private1 in both SD-WAN Router.
