What information does the SDWAN path-monitor stats command provide?

What information does the SDWAN path-monitor stats command provide?

17018
Created On 12/01/22 21:04 PM - Last Modified 01/13/23 22:14 PM


Question


  • What do the highlighted stats below represent?
paloalto@sdwan-firewall> show sdwan path-monitor stats active all

----------------------------------------------------------------
ethernet1/1 idx: 2 DIA monitor:8.8.4.4
Probing: Enabled  Probing-interval: 2s
----------------------------------------------------------------
  Probe-req-send:119516 State: up  State-chg-cnt: 0
  Probe-reply-recv:119489

         packet loss :            real-time  crt-use   version
          per 100 pkt:                0               0          0

                                           latency   jitter    pkt_loss  health_ver
         6000ms average
            real time:                     51        1          0
          current use:                     0         0          0                0

         20000ms average
            real time:                     55         8          0
          current use:                    327        44          0              93

         50000ms average
            real time:                    55          9         0
          current use:                     0          0         0         


Environment


  • Palo Alto Firewall.
  • PAN-OS 9.1 and above.
  • SD WAN Configured.


Answer


  1. The SD-WAN Path Quality profile is designed to set the threshold for latency, jitter, and packet loss % that an application can withstand on it current path before failing over to a new link. 
  2. The profile allows the administrator to define the threshold's sensitivity. 
  3. An average (using multiple probe packets) is used to compare the link's health to the thresholds.

Note: The probe values are configured under the SDWAN Interface Profile
 
paht-quality.PNG

sdwan-intrerface.PNG
  • health_vers: The indication of the link selection decision when the data traffic is going to forwarding.  The number gets incremented when metrics hit above the threshold. or back to metrics below the threshold.  When the metrics go above the threshold, the traffic distribution profile will be re-evaluated before failing over to a new link/path.  When the metrics return below the threshold, it will take around 20 seconds to return to the original link.
  • 6000ms average: The amount of time that SDWAN uses in the short bucket to calculate the average latency by sending the probing packet every 200ms. Thus, fast switch, but less accurate.  This bucket is typically used for the high sensitive traffic such as VoIP traffic.  
  • 20000ms average: The amount of time that SDWAN uses in the medium bucket to calculate the average latency by sending the probing packet every 200ms.  This bucket is typically used for the medium sensitive traffic.
  • 50000ms average: The amount of time that SDWAN uses in the long bucket to calculate the average latency by sending the probing packet every 200ms. This is the longest time bucket.  Thus, slow switch, but more accurate.  This bucket is typically used for the low sensitive traffic.
  • packet loss: Packet loss is calculated based on the percentage of the transmit and receive of 100 pkt (icmp).  If the return traffic is not received within 2 seconds (probing interval), it is considered as packet loss.  Because of this reason, for the sensitive traffic, the recommendation is to use the latency in the short bucket.
    • Note: The packet loss is the highest precedence over latency and jitter.  It means that packet loss always gets evaluated first (packet loss -> latency -> jitter).


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kFQvCAM&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language