5.3 SD-WAN Actions, Metrics & Path Selection

5.3 SD-WAN Actions, Metrics & Path Selection

Quick Answer: WatchGuard describes SD-WAN as "a software-based routing solution that automatically distributes network traffic across multiple WAN connections based on policies you define." Administrators build an SD-WAN action (Network > SD-WAN) containing an ordered list of member interfaces — external interfaces, internal interfaces (Trusted, Optional, Custom), or a BOVPN virtual interface, noting that a BOVPN virtual interface cannot be combined with other interfaces in the same action. Optional metrics settings measure loss rate, latency, and jitter; in Fireware v12.5.4 and higher the defaults are 5%, 400 ms, and 100 ms. The action then uses one of two routing methods: Failover (move connections to a different interface when a threshold is exceeded) or Round-Robin (Fireware v12.8 and higher, splitting traffic by weight and dropping any interface that breaches a threshold). Failover adds a failback choice of No failback, Immediate failback (default), or Gradual failback. Binding the action on a policy's SD-WAN tab makes that policy ignore the global multi-WAN configuration.

---

The Evolution from Multi-WAN to Software-Defined WAN (SD-WAN)

Traditional Multi-WAN operates on a binary link-state model: an Internet circuit is evaluated as either functional (UP) or non-functional (DOWN). As long as synthetic probes return within the loss timeout, traditional Multi-WAN considers the link 100% operational and continues forwarding traffic across it.

However, modern cloud-delivered enterprise applications—such as Voice over IP (VoIP), Microsoft Teams, Zoom, Citrix virtual desktops, and cloud ERP systems—are acutely sensitive to sub-second network degradation. These applications suffer severe performance degradation long before a circuit completely severs:

• A fiber link experiencing carrier congestion might exhibit 350 ms latency (normal is 25 ms).
• An oversubscribed broadband cable connection might suffer 8% packet loss.
• A microwave wireless link buffering packets might induce 60 ms of jitter.

Under traditional Multi-WAN, this degraded state—known as a "brownout"—passes standard ping health checks. The firewall continues dispatching VoIP calls and video conferences across the impaired circuit, resulting in garbled audio, robotic voices, frozen video streams, and dropped application sessions.

WatchGuard Software-Defined WAN (SD-WAN) transforms the Firebox from a static connection balancer into an intelligent, application-aware transport orchestrator. SD-WAN measures the qualitative performance of every candidate path and steers traffic away from any interface whose measurements exceed the thresholds you configure.

SD-WAN was introduced in Fireware v12.3, where it replaced policy-based routing: on upgrade, a policy with policy-based routing and no failover becomes an SD-WAN action with a single interface, while policy-based routing with failover becomes an SD-WAN action with multiple interfaces. Fireware v12.4 added internal interfaces and BOVPN virtual interfaces as SD-WAN members, and v12.8 added the Round-Robin method.

---

The Three SD-WAN Measurements

An SD-WAN action can evaluate three optional measurements. You choose which of them are used, and each has a configurable threshold:

┌────────────────────────────────────────────────────────────────────────┐
│                   SD-WAN MEASUREMENTS AND DEFAULTS                     │
├───────────────┬───────────────────────────────┬────────────────────────┤
│ Measurement   │ Definition                    │ Default (v12.5.4+)     │
├───────────────┼───────────────────────────────┼────────────────────────┤
│ Loss Rate     │ Percentage of probe packets   │ 5 %                    │
│               │ that receive no response      │                        │
├───────────────┼───────────────────────────────┼────────────────────────┤
│ Latency       │ Round-trip time for a probe   │ 400 ms                 │
│               │ to return (ms)                │                        │
├───────────────┼───────────────────────────────┼────────────────────────┤
│ Jitter        │ Variation in packet arrival   │ 100 ms                 │
│               │ delay between probes (ms)     │                        │
└───────────────┴───────────────────────────────┴────────────────────────┘

1. Latency (Round-Trip Time)

• Definition: The time in milliseconds (ms) required for a synthetic probe packet to travel from the Firebox interface to a designated endpoint and return.
• Application Impact: High latency creates perceptible delay during real-time human interactions. In VoIP telephony and video conferencing, one-way latency exceeding 150 ms (or round-trip latency exceeding 300 ms) results in awkward conversational interruptions, where speakers inadvertently talk over each other.

2. Jitter (Delay Variation)

• Definition: The statistical variance in transit latency between successive packets over time. If Packet A takes 20 ms to arrive, Packet B takes 75 ms, and Packet C takes 15 ms, the network exhibits severe jitter.
• Application Impact: Real-time multimedia codecs (such as G.711 or Opus) rely on steady, predictable inter-packet arrival times. When jitter exceeds 25–30 ms, the client's jitter buffer becomes exhausted (buffer under-run), resulting in clipped syllables, robotic audio distortion, and dropped video frames.

3. Loss Rate

• Definition: The percentage of transmitted probe packets that fail to elicit a response over the measurement window. WatchGuard calls this setting Loss Rate.
• Application Impact: In real-time UDP streams, lost packets cannot be retransmitted, causing audible dropouts and pixelated video blocks. For TCP-based business applications, packet loss forces TCP congestion avoidance algorithms to aggressively shrink the congestion window, slashing effective application throughput by 50% or more.

---

Building an SD-WAN Action

SD-WAN in Fireware is configured as a reusable SD-WAN action, created in the Fireware Web UI under Network > SD-WAN or in Policy Manager under Network > Configuration > SD-WAN. The workflow is short and worth memorizing in order:

1. Click Add SD-WAN (Web UI) or Add (Policy Manager).
2. Enter a name and an optional description.
3. Select the routing method: Failover or Round-robin.
4. Click Add to select the member interfaces, in the order you want them used.
5. Configure the optional metrics settings (loss rate, latency, jitter).
6. If the method is Failover, set the failback behavior.
7. Click Save, then attach the action to a policy.

Which Interfaces Can Be Members

An SD-WAN action can contain three categories of interface:

• External interfaces — physical copper/fiber ports, link aggregation groups, and external 802.1Q VLAN interfaces connected to ISPs.
• Internal interfaces — Trusted, Optional, or Custom interfaces. Added in Fireware v12.4, these let SD-WAN steer traffic across internal paths, not just WAN circuits.
• BOVPN virtual interfaces — route-based IPSec tunnels linking headquarters, branches, and cloud VPCs/VNets. Also added in v12.4.

[!IMPORTANT] A BOVPN virtual interface cannot be mixed with other interfaces in the same SD-WAN action. WatchGuard documents that "if you select a BOVPN virtual interface, you cannot select other interfaces." To fail an MPLS link over to a VPN tunnel you build the action around the appropriate interface set rather than assuming you can list a physical WAN port and a bvif side by side.

Metrics Settings and the Failover Trigger

The metrics settings are optional, and you choose which of loss rate, latency, and jitter participate. In Fireware v12.5.4 and higher the default values are 5% loss rate, 400 ms latency, and 100 ms jitter.

The way a breach is interpreted depends on the routing method:

• Failover: "If the value for any selected measurement is exceeded, the Firebox fails over connections to a different interface." By default failover occurs if any selected measurement is exceeded; you can optionally require that all selected measurements be exceeded before failover happens.
• Round-Robin: "If the value for any selected measurement is exceeded, the Firebox removes the route so the interface no longer participates in Round Robin path selection." The interface rejoins path selection when its measurements return within the thresholds.

---

The Two SD-WAN Routing Methods

Fireware provides exactly two SD-WAN routing methods. This is a common exam trap: SD-WAN does not offer a "lowest cost" or "best metric" selector — those concepts belong to other vendors' implementations.

                  ┌─────────────────────────────────┐
                  │     SD-WAN Routing Method       │
                  └────────────────┬────────────────┘
                                   │
            ┌──────────────────────┴──────────────────────┐
            │                                             │
    ┌───────┴────────┐                            ┌───────┴────────┐
    │   FAILOVER     │                            │  ROUND-ROBIN   │
    │ (all versions) │                            │ (v12.8 and up) │
    └───────┬────────┘                            └───────┬────────┘
            │                                             │
            ▼                                             ▼
Ordered interface list. Traffic uses the      Outgoing traffic is split between
first interface; when a selected              multiple interfaces by weight and
measurement is exceeded, connections          other factors. An interface that
fail over to a different interface.           breaches a threshold is removed
Failback: No / Immediate / Gradual.           from path selection until it recovers.

1. Failover

• Mechanics: The action holds an ordered list of interfaces. Traffic matching the bound policy uses the interfaces in that order.
• Trigger: When a selected measurement (loss rate, latency, or jitter) exceeds its threshold, the Firebox fails the connections over to a different interface. The default trigger is "any selected measurement exceeded"; the alternative is "all selected measurements exceeded," which is far less twitchy on links that occasionally spike a single metric.
• Failback: Three choices, and the exam expects all three.
  • Immediate failback (the default) — active and new connections return to the original (failback) interface.
  • Gradual failback — active connections continue to use the failover interface; new connections use the original interface.
  • No failback — active and new connections continue to use the failover interface indefinitely.
• Manual Failback: If you select Gradual failback or No failback, you can initiate a manual failback from the SD-WAN Status page in the Fireware Web UI, or from SD-WAN monitoring in Firebox System Manager. This is the setting that gives engineers control over an unstable circuit — and it exists for SD-WAN only, not for the global multi-WAN failback setting described in Section 5.2.
• Ideal Scenario: An MPLS primary with a BOVPN virtual interface standby for voice or ERP traffic, where you want the traffic pinned to the better path but moved the moment quality degrades.

2. Round-Robin (Fireware v12.8 and Higher)

• Mechanics: Round-Robin is a load-balancing method that "splits outgoing traffic between multiple interfaces based on weight and other factors," distributing connections proportionally across the interfaces that currently qualify.
• Trigger: An interface that exceeds a selected measurement is removed from path selection until its measurements recover — so a degraded circuit stops receiving new connections instead of dragging down a share of the traffic.
• Ideal Scenario: Two or more comparable, unmetered circuits where aggregate throughput matters more than pinning traffic to a single preferred path.

Worked Example: Voice Over a Degrading Fiber Link

An SD-WAN action named VoIP_Path uses the Failover method, lists Eth0_Fiber first and Eth2_Broadband second, selects latency and jitter as measurements, and leaves the v12.5.4 defaults in place (400 ms and 100 ms). The action is bound to the SIP policy on its SD-WAN tab.

• During the afternoon peak, fiber latency climbs to 380 ms and jitter to 65 ms. Latency is below the 400 ms threshold and jitter is below 100 ms, so no failover occurs with the default values.
• The voice team therefore tightens the action to 150 ms latency and 20 ms jitter. On the next measurement window the fiber breaches the jitter threshold, and — because the default trigger is "any selected measurement exceeded" — calls move to Eth2_Broadband.
• With failback left at Immediate failback, calls return to the fiber as soon as it recovers. The team switches to Gradual failback so in-progress calls finish on broadband, and now has the option to trigger manual failback from the SD-WAN Status page.

This example is the practical answer to "why did SD-WAN not fail over?" — the defaults are deliberately loose, and a real voice deployment has to tighten them.

---

Applying SD-WAN Actions to Firewall Policies

The architectural power of Fireware SD-WAN lies in its integration with the Firebox policy engine. Unlike basic Multi-WAN — which applies globally across the entire appliance — SD-WAN actions are bound directly to individual firewall policies on the policy's SD-WAN tab, and WatchGuard notes that SD-WAN ignores global multi-WAN configuration settings for the traffic those policies handle.

[Internal Network Clients]
        │
        ├── SIP / VoIP Traffic ────────► [Policy: VoIP-SIP-Proxy]
        │                                └── SD-WAN action "Voice_Path"
        │                                    ├── Method: Failover (Eth0 then Eth2)
        │                                    ├── Measurements: latency 150 ms, jitter 20 ms
        │                                    └── Failback: Gradual (manual failback available)
        │
        ├── Microsoft 365 Traffic ─────► [Policy: O365-HTTPS-Proxy]
        │                                └── SD-WAN action "Cloud_Apps"
        │                                    ├── Method: Round-Robin (v12.8+)
        │                                    └── Measurements: loss 5%, latency 400 ms (defaults)
        │
        └── General Web Browsing ──────► [Policy: Outgoing-Web]
                                         └── No SD-WAN action ──► Global Multi-WAN method applies

Practical Policy Deployment Workflow:

1. Define the SD-WAN Action: Navigate to Network > SD-WAN. Create an action named VoIP_Optimization, choose the Failover method, add Eth0_Fiber and Eth2_Broadband as members in that order, select latency and jitter as the measurements and tighten them to 150 ms and 20 ms, and set failback to Gradual failback.
2. Attach the Action to a Policy: Open the SIP-ALG or VoIP policy. On the SD-WAN tab, select the SD-WAN action from the drop-down list (you can also create a new action from here).
3. Result: Voice traffic follows the SD-WAN action and ignores the global multi-WAN configuration, while general Internet browsing on the Outgoing policy continues to follow the global multi-WAN method.

Dynamic Mid-Session Steering & Connection Handling

When an interface breaches its configured SLA threshold during an active session:

• UDP Flows (VoIP/Streaming): UDP is connectionless. Fireware immediately steers subsequent UDP packets out the alternate compliant interface. End users experience at most a sub-second audio stutter before call quality fully recovers.
• TCP Flows (SaaS/Web): Because TCP connections are tied to specific socket pairs and NAT IP addresses, migrating an active TCP session to a new external interface resets the TCP handshake. The failback setting is where this trade-off is expressed: Immediate failback moves active and new connections back at once, while Gradual failback lets established sessions finish on the failover interface and sends only new connections to the original one.

---

Traditional Multi-WAN vs. Fireware SD-WAN Comparison

The following matrix summarizes the architectural distinctions between basic Multi-WAN and Fireware SD-WAN: