8.4 PAN-OS SD-WAN Subscription, Link Tags & Path Quality
Key Takeaways
- PAN-OS SD-WAN and Prisma SD-WAN are separate products: PAN-OS SD-WAN licenses existing PA-Series or VM-Series firewalls and is orchestrated by Panorama with the SD-WAN plugin, while Prisma SD-WAN uses ION appliances and its own cloud controller.
- Traffic Distribution profiles offer exactly three methods — Top Down Priority, Best Available Path, and Weighted Session Distribution — and Link Tag order plus the VPN Failover Metric only take effect under Top Down Priority.
- The VPN Failover Metric ranges from 1 to 65,535 with a default of 10, and a lower metric means higher priority for the tunnel.
- When a link becomes unqualified the firewall migrates a maximum of 1,000 sessions per minute to the next best path, so a tunnel carrying 3,000 sessions takes about three minutes to drain.
- Auto VPN builds the VPN cluster, IKE/IPSec configuration, and BGP peering automatically and creates the predefined zones zone-to-branch on the hub and zone-to-hub on the branch; multi-hub failover order is expressed as a BGP local preference derived from hub priority.
8.4 PAN-OS SD-WAN Subscription, Link Tags & Path Quality
Two Different SD-WAN Products, One Blueprint
Blueprint task 3.2.4 lists PAN-OS SD-WAN as a Cloud-Delivered Security Service component, and task 2.2 separately asks you to explain the function of Prisma SD-WAN. These are two different products with different hardware, different controllers, and different configuration models. Sections 8.1 to 8.3 taught Prisma SD-WAN. This section teaches the other one, and the exam will punish candidates who conflate them.
| PAN-OS SD-WAN | Prisma SD-WAN | |
|---|---|---|
| Runs on | Existing PA-Series, VM-Series next-generation firewalls | Purpose-built ION appliances (physical or virtual) |
| Orchestrated by | Panorama with the SD-WAN plugin | Prisma SD-WAN cloud controller |
| Licensing | SD-WAN subscription per firewall; Advanced SD-WAN for NGFW with AIOps for NGFW Premium, Strata Cloud Manager Pro, or Strata Cloud Manager Essentials for the advanced feature set | Per-ION subscription |
| Policy object | SD-WAN policy rule (pre/post rules in a device group) | App-defined path policy |
| Best for | Branches that already have a firewall and want SD-WAN without new hardware | Greenfield SD-WAN with app-defined autonomous fabric |
The strategic logic is straightforward: if a branch already terminates its WAN on a Palo Alto Networks firewall, PAN-OS SD-WAN converts that firewall into an SD-WAN edge with a licence and a Panorama plugin rather than a truck roll.
Deployment Prerequisites
- Install the SD-WAN plugin on Panorama. SD-WAN configuration is a Panorama plugin, not a native PAN-OS tab. Branch and hub firewalls are configured through templates and device groups pushed from Panorama.
- License each participating firewall with the SD-WAN subscription.
- Add the firewalls to a device group and template stack, so SD-WAN policy pre-rules and network profiles can be pushed.
- Define ISP connections and link types on each interface.
Link Tags: The Abstraction That Makes Policy Portable
A Link Tag is an administrator-defined label applied to physical links — MPLS, Broadband, LTE, Backup-5G. Policy references the tag, not the interface. That indirection is what lets one SD-WAN policy rule pushed to 400 branches behave correctly even though branch 1 uses ethernet1/3 for broadband and branch 380 uses ethernet1/7.
SD-WAN Interface Profile
Applied to each SD-WAN-enabled interface, the profile defines:
| Setting | Purpose |
|---|---|
| Link Type | ADSL/DSL, cable modem, Ethernet, fibre, LTE/3G/4G/5G, MPLS, microwave/radio, satellite, WiFi. Also drives sensible defaults for the other settings |
| Link Tag | The label policy will reference |
| Maximum Download / Upload (Mbps) | Committed capacity used for load-distribution maths |
| VPN Data Tunnel Support | When cleared, PAN-OS forwards traffic in clear text outside the SD-WAN VPN tunnel |
| VPN Failover Metric | Failover order for the VPN tunnels bundled into a hub or branch virtual interface. Range 1 to 65,535, default 10 — the lower the metric, the higher the priority. Only takes effect when the Traffic Distribution profile specifies Top Down Priority |
| Eligible for Error Correction Profile interface selection | Whether the encoding firewall may pick this interface for FEC or packet duplication. Clear it on expensive links such as LTE so costly error correction is never applied there |
Exam Trap Alert: Link Tags in a Traffic Distribution profile, the Link Tag applied to a hub virtual interface, and the VPN Failover Metric only work together when the Traffic Distribution profile specifies Top Down Priority. If the profile specifies Best Available Path, the firewall selects the best performing path regardless of cost and the metric is ignored.
Path Quality Profiles: Defining "Good Enough"
A Path Quality profile declares the thresholds an application needs, using three metrics, each with a threshold and a sensitivity (low, medium, high):
| Metric | Typical voice/video threshold | Effect of breach |
|---|---|---|
| Latency | 150 ms one-way for real-time voice | Conversation talk-over, unusable interaction |
| Jitter | 10 ms | Playout buffer underrun, robotic audio |
| Packet loss | 1% | Dropped syllables, video macroblocking |
Sensitivity governs how quickly a breach is acted upon: high sensitivity reacts to a brief excursion, low sensitivity tolerates transient spikes before declaring the path unqualified. A file-backup profile can safely use 300 ms latency at low sensitivity, while a voice profile uses tight thresholds at high sensitivity.
Traffic Distribution Profiles: Choosing the New Path
The Traffic Distribution profile specifies how a firewall determines a new best path once the current preferred path exceeds a path quality threshold. There are exactly three methods, and each behaves differently under brownout, blackout, and recovery.
| Method | New-session behaviour | Multiple links sharing one tag |
|---|---|---|
| Top Down Priority | Examines Link Tags in the configured top-to-bottom order and takes the first qualified path. If no tag yields a qualified path, it falls back to Best Available Path | Shares session load equally among links within the tag |
| Best Available Path | Selects the best performing path irrespective of link cost or tag order | Shares session load based on best path within the tag |
| Weighted Session Distribution | Distributes sessions across tags by administrator-assigned weight percentages that must total 100%, using round-robin within a tag until health metrics are reached | Shares load by the assigned percentage |
Recovery behaviour is where these differ most and is heavily examined:
| Condition | Top-Down Priority | Best Available Path | Weighted Session Distribution |
|---|---|---|---|
| Existing path down (blackout) | All sessions fail over to the next path on the list | All sessions fail over to the next best path | All sessions fail over to other tags by weight |
| Brownout, no better path qualified | Take best available path | Take best available path | Take best available path |
| Session fails a health threshold (brownout) | Affected session fails over to a better path if available | Affected session fails over to a better path if available | Affected sessions do not fail over |
| Preferred path recovers and is still qualified | Affected session fails back | Session stays on the existing path, does not fail back | Sessions do not fail over |
There is also a documented rate limit: when a link becomes unqualified, the firewall migrates a maximum of 1,000 sessions per minute from the unqualified link to the next best path. A tunnel carrying 3,000 sessions therefore takes about three minutes to drain — an important number when an exam scenario asks why a failover "took too long."
Error Correction Profiles
For applications that cannot tolerate loss, an Error Correction profile applies one of two techniques to traffic matched by an SD-WAN policy rule:
- Forward Error Correction (FEC): adds parity so the receiving firewall reconstructs packets lost in transit without retransmission.
- Packet duplication: duplicates the application session onto a second tunnel, and the receiver discards the duplicate. Costs double the bandwidth, so it is reserved for small, critical flows.
Both depend on the interface being marked Eligible for Error Correction Profile interface selection in its SD-WAN Interface profile.
Auto VPN and the Predefined Zones
Panorama's SD-WAN plugin can build the underlay fabric automatically. Auto VPN creates VPN clusters (hub-and-spoke or mesh), generates the IKE and IPSec configuration, establishes BGP peering between branch and hub, and creates predefined zones so security policy is portable:
- On the hub firewall the zone is named
zone-to-branch. - On the branch firewall the zone is named
zone-to-hub(created when VPN Data Tunnel Support is disabled on the branch interface profile so traffic is forwarded in clear text outside the SD-WAN VPN tunnel).
Panorama automates this to guarantee correct hub-branch communication. If you had pre-existing firewall policies referencing older zone names, you must update those policies to use the predefined SD-WAN zone names.
In a multi-hub cluster you assign each hub a priority. Panorama converts the priority into a BGP local preference and pushes it to the branches, and the branches use local preference to select among multiple routes to the same destination — which is how hub failover order is expressed in routing rather than in a proprietary construct.
Direct Internet Access (DIA) and SaaS Monitoring
DIA breaks internet-bound traffic out locally at the branch instead of hauling it to a data centre. Two behaviours matter for the exam:
- DIA VPN / DIA failover to the hub: you must permit the branch to redirect its DIA traffic to the hub by enabling the Allow DIA VPN option in the Panorama SD-WAN plugin's VPN Cluster hub configuration. DIA traffic can also fail over to the hub through the MPLS link to reach the internet by an alternate route.
- DIA AnyPath: allows DIA traffic to fail over across the bundled VPN tunnels, using the VPN Failover Metric to determine order.
A SaaS Quality profile monitors the DIA link from a branch or hub firewall to a specific SaaS application destination. Instead of measuring generic internet health, the firewall measures the path to the application that actually matters — Microsoft 365, Salesforce, Zoom — and can fail the branch over to a hub firewall whose DIA link to that SaaS application is performing better. Creating multiple Link Tags for DIA links lets you apply different monitoring settings per SaaS application based on link type.
Monitoring
Panorama provides operational awareness across the SD-WAN estate: application performance, link performance, and path health with historical trend analysis. This is the PAN-OS SD-WAN analogue of the Prisma SD-WAN health dashboards covered in section 8.2, and in an SD-WAN troubleshooting scenario it is where you separate "the application is slow" from "this specific link degraded at 09:14."
Branch Prefix Redistribution
By default, branch firewalls redistribute their non-public connected routes to the hub. From PAN-OS 9.1.2 and SD-WAN plugin 1.0.2 onward you can also redistribute additional prefixes to the hub — necessary whenever a branch has routes learned from a downstream router that the hub must reach.
A branch firewall uses a Traffic Distribution profile set to Best Available Path with Link Tags ordered MPLS, then Broadband, then LTE. The MPLS interface profile has a VPN Failover Metric of 5 and the LTE profile has a metric of 100. Broadband is currently the best performing path. Which path will new sessions use?
Which statement correctly distinguishes PAN-OS SD-WAN from Prisma SD-WAN?
A voice application at a branch needs protection against sporadic packet loss on the only available broadband link, and duplicating the session across a second tunnel is acceptable for this small flow. Which two configuration elements are required?