Business Policy rules are configured to steer the traffic, bandwidth management and ensure quality of service based on criterions like application, source and destination etc. Operators, Partners, and Admins of all levels can create a business policy. The business policy matches parameters such as IP addresses, ports, VLAN IDs, interfaces, domain names, protocols, operating system, object groups, applications, and DSCP tags. When a data packet matches the match conditions, the associated action or actions are taken. If a packet matches no parameters, then a default action is taken on the packet. You can create business policies for a Profile and Edge.

Prerequisites

Ensure that you have the details of IP addresses of your network.

Procedure

  1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles. The Profiles page displays the existing Profiles.
  2. Click the link to a Profile or click the View link in the Device column of the Profile. The configuration options are displayed in the Device tab.
  3. Click the Business Policy tab.
    From the Profiles page, you can navigate to the Business Policy page directly by clicking the View link in the Biz. Pol column of the Profile.
  4. In the Business Policy page, click + ADD. The Add Rule window is displayed.
  5. Enter the Rule Name and select the IP version. You can configure the Source and Destination IP addresses according to the selected IP version, as follows:
    • IPv4 and IPv4 – Allows to configure both IPv4 and IPv6 addresses in the matching criteria. If you choose this mode, you can choose the IP addresses from Object Groups containing Address Groups with both type of Address Groups. By default, this address type is selected.
    • IPv4 – Applies to traffic with only IPv4 address as source and destination.
    • IPv6 – Applies to traffic with only IPv6 address as source and destination.
      Note: When you upgrade, the Business policy rules from previous versions are moved to IPv4 mode.
  6. In the Match tab, configure the match criteria for Source, Destination, and Application traffic.
    Field Description
    Source
    Allows to specify the source for packets. Select any of the following options:
    • Any - Allows all source addresses by default.
    • Object Group - Allows you to select a combination of address group and service group.

      If address type is IPv4, then only IPv4 address from Address Groups are considered to match the traffic source.

      If address type is IPv6, then only IPv6 address from Address Groups are considered to match the traffic source.

      If address type is both IPv4 and IPv6, then IPv4 and IPv6 both addresses from Address Groups are considered to match the traffic source.

      For more information, see Object Groups and Configure Business Policies with Object Group.
      Note: If the selected address group contains any domain names, then they would be ignored when matching for the source.
    • Define - Allows you to define the source traffic from a specific VLAN, Interface, IP Address, Port, or Operating System. Select one of the following options:
      • VLAN - Matches traffic from the specified VLAN, selected from the drop-down menu.
      • Interface - Matches traffic from the specified interface selected from the drop-down menu.
        Note: If an interface cannot be selected, then the interface is either not activated or not assigned to this segment.
      • IP Address - Matches traffic from the specified IP address (IPv4 or IPv6).
        Note: This option is not available if you select IPv4 and IPv6 (Mixed mode) as the IP version. In the Mixed mode, the traffic is matched based on either the specified VLAN or interface.
        Along with the IP address, you can specify one of the following address types to match the source traffic:
        • CIDR prefix - Choose this option if you want the network defined as a CIDR value (for example: 172.10.0.0 /16).
        • Subnet mask - Choose this option if you want the network defined based on a Subnet mask (for example, 172.10.0.0 255.255.0.0).
        • Wildcard mask - Choose this option if you want the ability to narrow the enforcement of a policy to a set of devices across different IP subnets that share a matching host IP address value. The Wildcard mask matches an IP, or a set of IP addresses based on the inverted Subnet mask. A '0' within the binary value of the mask means the value is fixed and a '1' within the binary value of the mask means the value is wild (can be 1 or 0). For example, a Wildcard mask of 0.0.0.255 (binary equivalent = 00000000.00000000.00000000.11111111) with an IP Address of 172.0.0, the first three octets are fixed values, and the last octet is a variable value. This option is available only for IPv4 address.
      • Ports - Matches traffic from the specified source port or port range.
      • Operating System - Matches traffic from the specified operating system, selected from the drop-down menu.
    Destination Allows to specify the destination for packets. Select any of the following options:
    • Any - Allows all destination addresses by default.
    • Object Group - Allows you to select a combination of address group and service group. For more information, see Object Groups and Configure Business Policies with Object Group.
    • Define - Allows you to define the matching criteria for the destination traffic to a specific IP Address, Domain Name, Protocol, or Port. Select one of the following options, by default, Any is selected:
      • Any - Matches all destination traffic.
      • Internet - Matches all Internet traffic (traffic that does not match an SD-WAN Route) to the destination.
      • Edge - Matches all traffic to an Edge.
      • Non SD-WAN Destination via Gateway - Matches all traffic to the specified Non SD-WAN Destination through Gateway, associated with a Profile. Ensure that you have associated your Non SD-WAN sites via Gateway at the Profile level.
      • Non SD-WAN Destination via Edge - Matches all traffic to the specified Non SD-WAN Destination through Edge, associated with an Edge or Profile. Ensure that you have associated your Non SD-WAN sites via Edge at the Profile or Edge level.
    • Domain name - Matches traffic for the entire domain name or a portion of the domain name specified in the Domain Name field. For example, \"salesforce\" will match traffic to \"www.salesforce.com\".
    • Protocol - Matches traffic for the specified protocol, selected from the drop-down menu. The supported protocols are: GRE, ICMP, TCP, and UDP.
      Note: ICMP is not supported in Mixed mode.
    • Ports - Matches traffic from the specified source port or port range.
    Application Select any one of the following options:
    • Any - Applies the business policy rule to any application by default.
    • Define - Allows to select a specific application to apply the business policy rule. In addition, a DSCP value can be specified to match the traffic coming in with a preset DSCP/TOS tag.
    Note:
    • When creating a business policy rule matching an application only, to apply the Network Service Action for such application, the Edge might need to use DPI (Deep Packet Inspection) Engine. Generally, the DPI does not determine the application based on the first packet. The DPI Engine usually needs the first 5-10 packets in the flow to identify the application. For the first few packets received, traffic is unclassified and matches a less specific business policy, which might cause the traffic to take a different path, i.e. 'Direct' instead of 'Multipath', depending on the policy it matches. Once DPI determines the traffic type, it matches a more specific policy configured for this type of traffic. However, that flow continues to take the path from the original policy it matched, because steering to a new path would break the flow. This can cause the first flow to a specific Destination IP and port to take one path. Once the app cache in populated, the subsequent flows to the same Destination IP and port take another path as configured in a more specific policy for this type of traffic.
    • Once the DPI classifies the traffic, it adds the Destination IP and port to the app cache, and immediately classifies any subsequent flows to that same Destination IP and port. The app cache entry expires after 10 minutes of no traffic going to that Destination IP and port. The next flow to that Destination IP and port must go through the DPI again and may take an unexpected path based on the policy it matches before the DPI identifies the application.
  7. In the Action tab, configure the actions to be performed when the traffic matches the defined criteria.
    Note: Depending on your Match choices, some Actions may not be available.
    Field Description
    Priority Designate the priority of the rule as one of the following:
    • High
    • Normal
    • Low
    Enable Rate Limit Select the Enable Rate Limit check box to set limits for inbound and outbound traffic directions.
    Note: Rate limiting is performed per flow. Rate limiting for upstream traffic only works when you specify a link or Edge interface in the Business Policy. If you set the Steering option to Auto, Transport, or Group, the rate limit will apply to the total bandwidth of all the corresponding links. This may not enforce a strict rate limit as you expect. If you want to enforce a strict rate limit, you should steer traffic to a single link or Edge interface in the Business Policy.
    Network Service Set the Network Service to one of the following options:
    • Direct - Sends the traffic out of the WAN circuit directly to the destination, bypassing the SD-WAN Gateway.
      Note:

      The Edge by default prefers a secure route over a business policy. In practice this means the Edge will forward traffic via Multipath (Branch to Branch or Cloud via Gateway, depending on the route) even if a business policy is configured to send that traffic via the Direct path if the Edge has received either secure default routes or more specific secure routes from the Partner Gateway or another Edge.

      This behavior can be overridden for Partner Gateway secure routes by activating the "Secure Default Route Override" feature for a customer. A Partner Super User or an Operator can activate this feature which overrides all Partner Gateway secure routes that also match a business policy. "Secure Default Route Override" does not override Hub secure routes.

    • Multi-Path - Sends the traffic from one SD-WAN Edge to another SD-WAN Edge.
    • Internet Backhaul - This network service is activated only if the Destination is set as Internet.
      Note: The Internet Backhaul Network Service will only apply to Internet traffic (WAN traffic destined to network prefixes that do not match a known local route or VPN route).

      For information about these options, see Configure Network Service for Business Policy Rule.

    If Conditional Backhaul is activated at the profile level, by default it will apply for all Business Policies configured for that profile. You can turn off conditional backhaul for selected policies to exclude selected traffic (Direct, Multi-Path, and CSS) from this behavior by selecting the Turn off Conditional Backhaul check box.

    For more information about how to activate and troubleshoot the Conditional Backhaul feature, see Conditional Backhaul.
    Link Steering Select one of the following link steering modes:
    • Auto - By default, all applications are set to automatic Link Steering mode. When an application is in the automatic Link Steering mode, the DMPO automatically chooses the best links based on the application type and automatically activates on-demand remediation when necessary.
      • Transport Group - Specify any one of the following transport group options in the steering policy so that the same Business Policy configuration can be applied across different device types or locations, which may have completely different WAN carriers and WAN interfaces:
        • Public Wired
        • Public Wireless
        • Private Wired
      • Interface - Link steering is tied to a physical interface and will be used primarily for routing purposes.
        Note: This option is only allowed at the Edge override level.
      • WAN Link - Allows to define policy rules based on specific private links. For this option, the interface configuration is separate and distinct from the WAN link configuration. You will be able to select a WAN link that was either manually configured or auto-discovered.
        Note: This option is only allowed at the Edge override level.
    • Inner Packet DSCP Tag - Select an Inner Packet DSCP Tag from the drop-down menu.
    • Outer Packet DSCP Tag - Select an Outer Packet DSCP Tag from the drop-down menu.
    Note: When the Network Service is configured as Direct, the IPv6 only Interfaces and IPv6 only WAN links are not supported in Link Steering mode.

    For more information about the link steering modes and DSCP, DSCP marking for both Underlay and Overlay traffic, see Configure Link Steering Modes.
    Enable NAT Activate or deactivate NAT. This option is not available for IPv4 and IPv6 mode. For more information, see Configure Policy Based NAT.
    Service Class Select one of the following Service Class options:
    • Real-time
    • Transactional
    • Bulk
    Note: This option is only for a custom application.
    VMware Apps/Categories fall in one of these categories.
  8. After configuring the required settings, click Create.
    A business policy rule is created for the selected Profile, and it appears under the Business Policy Rules area of the Profile Business Policy page.
    Note: The rules created at the Profile level cannot be updated at the Edge level. To override the rule, user needs to create the same rule at the Edge level with new parameters to override the Profile level rule.

    For the IPv6 and IPv4 and IPv6 modes, you can only Create Business policy rules from the Orchestrator. You can perform the rest of the operations like Update and Delete only through API.

    Related Information: Overlay QoS CoS Mapping