What information does the SDWAN path-monitor stats command provide?
17018
Created On 12/01/22 21:04 PM - Last Modified 01/13/23 22:14 PM
Question
- What do the highlighted stats below represent?
paloalto@sdwan-firewall> show sdwan path-monitor stats active all
----------------------------------------------------------------
ethernet1/1 idx: 2 DIA monitor:8.8.4.4
Probing: Enabled Probing-interval: 2s
----------------------------------------------------------------
Probe-req-send:119516 State: up State-chg-cnt: 0
Probe-reply-recv:119489
packet loss : real-time crt-use version
per 100 pkt: 0 0 0
latency jitter pkt_loss health_ver
6000ms average
real time: 51 1 0
current use: 0 0 0 0
20000ms average
real time: 55 8 0
current use: 327 44 0 93
50000ms average
real time: 55 9 0
current use: 0 0 0 Environment
- Palo Alto Firewall.
- PAN-OS 9.1 and above.
- SD WAN Configured.
Answer
- The SD-WAN Path Quality profile is designed to set the threshold for latency, jitter, and packet loss % that an application can withstand on it current path before failing over to a new link.
- The profile allows the administrator to define the threshold's sensitivity.
- An average (using multiple probe packets) is used to compare the link's health to the thresholds.
Note: The probe values are configured under the SDWAN Interface Profile
- health_vers: The indication of the link selection decision when the data traffic is going to forwarding. The number gets incremented when metrics hit above the threshold. or back to metrics below the threshold. When the metrics go above the threshold, the traffic distribution profile will be re-evaluated before failing over to a new link/path. When the metrics return below the threshold, it will take around 20 seconds to return to the original link.
- 6000ms average: The amount of time that SDWAN uses in the short bucket to calculate the average latency by sending the probing packet every 200ms. Thus, fast switch, but less accurate. This bucket is typically used for the high sensitive traffic such as VoIP traffic.
- 20000ms average: The amount of time that SDWAN uses in the medium bucket to calculate the average latency by sending the probing packet every 200ms. This bucket is typically used for the medium sensitive traffic.
- 50000ms average: The amount of time that SDWAN uses in the long bucket to calculate the average latency by sending the probing packet every 200ms. This is the longest time bucket. Thus, slow switch, but more accurate. This bucket is typically used for the low sensitive traffic.
- packet loss: Packet loss is calculated based on the percentage of the transmit and receive of 100 pkt (icmp). If the return traffic is not received within 2 seconds (probing interval), it is considered as packet loss. Because of this reason, for the sensitive traffic, the recommendation is to use the latency in the short bucket.
- Note: The packet loss is the highest precedence over latency and jitter. It means that packet loss always gets evaluated first (packet loss -> latency -> jitter).