This article provides frequently asked questions about SD-WAN in SonicOS 8.2.1. These enhancements introduce improved interface grouping, application-aware path selection, and real-time path health monitoring to enable intelligent traffic steering across multiple WAN connections.
SD-WAN in SonicOS is a policy-based traffic steering mechanism that dynamically selects the best path for network traffic across multiple WAN interfaces.Path selection is based on real-time link conditions, application requirements, and administrator-defined policies rather than static routing
SonicOS 8.2.1 enhances SD-WAN capabilities in these primary areas:
These enhancements allow administrators to move from basic failover and load balancing to policy-driven, application-centric traffic steering.
There are four functional interface categories:
These categories help ensure correct traffic steering and maintain separation between different network domains.
No. SD-WAN interface groups are not predefined or automatically generated in the user interface.They are design guidelines that help administrators organize WAN interfaces based on their role, security characteristics, and routing behavior. In SonicOS SD-WAN, administrators manually create interface groups by selecting interfaces. While the system does not provide predefined group templates, it enforces key architectural boundaries during configuration.
SonicOS does not allow VPN and Non-VPN interfaces to be placed in the same SD-WAN group.
This restriction ensures that traffic cannot automatically switch between encrypted and unencrypted paths within a single group, preserving security boundaries by design.
The recommended grouping strategies such as
represent best practices for structuring SD-WAN deployments. These categories reflect how different interface types behave in terms of trust, encryption, and routing.
For example:
By organizing interfaces according to these guidelines, administrators can:
Although SonicOS enforces certain constraints, following these design principles is essential for building a secure and reliable SD-WAN deployment.
VPN and direct internet interfaces operate in different security domains.A VPN tunnel provides encrypted and authenticated communication with a trusted peer, while a direct internet interface carries unencrypted traffic to external destinations.Mixing these interfaces in the same group can result in unintended traffic shifts between secure and non-secure paths during failover or path switching.
SonicOS 8 uses per-application SLA policies to determine the best path for traffic.
Administrators define thresholds such as:
The firewall continuously evaluates path performance and automatically selects the best available path for each application based on these thresholds.
Applications are identified using Application Control, which classifies traffic through Deep Packet Inspection (DPI) rather than relying solely on traditional attributes such as IP address, port number, or protocol.
This allows the firewall to accurately determine the actual application generating the traffic, even in cases where:
Once identified, the application is mapped to an Application Control signature or category. SD-WAN policies can then use this classification to apply per-application path selection.
For example:
Real-time applications such as voice or video can be steered to low-latency, low-jitter links.Business-critical SaaS applications can be routed over the most reliable ISP.Bulk or non-sensitive traffic can be directed to lower-cost or backup links.
This level of identification ensures that SD-WAN decisions are based on the actual application experience, not just network-level assumptions, resulting in more precise and effective traffic steering.
If a path fails to meet the defined SLA thresholds for an application, traffic is automatically redirected to the next best available path.If no path meets the SLA requirements, the firewall uses the best available path instead of dropping traffic.
SonicOS continuously monitors each interface using probe traffic.Metrics such as latency, jitter, and packet loss are updated in real time and used to drive path selection decisions.Probe methods include ICMP or HTTP-based monitoring to configured targets.
SonicOS supports multiple probe types for monitoring path health:
These probes provide flexibility in validating reachability and measuring real-world application performance across different types of networks.
Interface cost-based routing allows administrators to assign priority or preference to specific WAN links.Lower-cost interfaces are preferred for traffic forwarding, while higher-cost links are used as backup or overflow paths.This provides predictable routing behavior aligned with business or cost requirements.
Yes. Private circuit interfaces such as MPLS and leased lines can be included in SD-WAN policy groups.These interfaces are typically grouped separately to ensure that sensitive or compliance-driven traffic remains on private networks and does not traverse the public internet.
Yes. SonicOS SD-WAN supports deployments with multiple WAN connections, including broadband, LTE/5G, MPLS, and VPN tunnels.
(VPN and Non-VPN interfaces cannot be part of the same SD-WAN group)
Traffic can be dynamically steered across these links using SD-WAN policies based on defined SLA thresholds such as latency, jitter, and packet loss.In addition to SLA-based path selection, SonicOS supports bandwidth-based spillover behavior. In this model, a primary interface is used until its configured bandwidth threshold is reached. Once the threshold is exceeded, additional traffic is automatically distributed (spilled over) to other available interfaces in the SD-WAN group.
When a path degrades, becomes congested, or fails to meet SLA conditions, traffic is redirected to the next best available path, ensuring continuity and performance.Administrators can also control how different types of traffic use these links by defining separate SD-WAN policies and interface groups, ensuring that traffic is routed according to both performance requirements and security considerations.
Bandwidth-based spillover allows traffic to be distributed across multiple interfaces based on utilization thresholds. A primary interface carries traffic until it reaches a defined bandwidth limit. Once exceeded, additional traffic is automatically routed through secondary interfaces.This helps prevent congestion and ensures efficient utilization of available bandwidth across all WAN links.
For full configuration details, see the official feature guide: SonicOS 8 SD-WAN — About SD-WAN