enterprise SD-WAN operations<\/a> article provides the wider operational model.<\/p>\nGame days should degrade or remove links intentionally and measure whether applications continue to meet their service objective.<\/p>\n
SD-WAN path quality is successful when steering follows application need<\/h3>\n A mature deployment has application-specific profiles, measured baselines, current bandwidth thresholds where applicable, monitored failover behavior, and clear evidence about why one path was selected.<\/p>\n
The purpose is not maximum path switching. It is keeping each application on a path that meets its performance requirement while exposing when no available path can do so.<\/p>\n
Path-quality thresholds should be based on application SLOs and provider baselines. A branch in Singapore reaching a European SaaS endpoint will have a very different normal latency from a branch in Frankfurt. Regional profiles or application-specific expectations are often more realistic than one enterprise-wide number.<\/p>\n
When bandwidth-based selection is used, link-speed configuration and real utilization measurement become important inputs. An incorrectly configured interface capacity can make a percentage threshold misleading. Validate that the firewall\u2019s understanding of link bandwidth matches the contracted and observed circuit.<\/p>\n
Brownout testing is more useful than only hard link failure. Introduce controlled latency, loss, or bandwidth pressure and verify when PAN-OS marks the path degraded, where new sessions move, and whether existing sessions behave as the application expects. Many production incidents are degradations, not total outages.<\/p>\n
Direct internet access paths should be evaluated separately from hub-tunneled paths. SaaS traffic may have a better user experience through local DIA even if the corporate tunnel is healthy. SaaS Quality Profiles and application-specific policy can help align steering with the actual destination type.<\/p>\n
Operations should retain path-quality history long enough to diagnose intermittent provider problems. A link that degrades for five minutes every afternoon can look healthy by the time an engineer opens the dashboard. Trend data and incident timestamps make carrier escalation more credible.<\/p>\n
Threshold changes should be treated as routing changes because they can alter active path selection immediately. Record the previous values, affected applications, and expected result so a rollback is possible if the new profile creates unstable steering.<\/p>\n
Path selection should be evaluated with encrypted tunnel overhead. The nominal circuit rate is not equal to application throughput after IPSec and other encapsulation, and bandwidth thresholds should leave enough headroom for protocol overhead and bursts.<\/p>\n
Applications with long-lived sessions may not move immediately when a path becomes degraded because steering often affects new session selection. Test how voice calls, persistent SaaS connections, and large transfers behave during path changes so business expectations match actual session behavior.<\/p>\n
Provider diversity should be real. Two links from different carriers can share the same physical last mile or regional exchange. SD-WAN can only steer around failure domains that actually differ.<\/p>\n
Path-quality incidents should preserve the before\/after metrics used to trigger steering. This helps carrier escalation and makes threshold tuning evidence-based instead of relying on user anecdotes.<\/p>\n
The mature design balances sensitivity and stability: it moves applications away from meaningful degradation quickly while avoiding unnecessary flaps when links remain inside acceptable performance ranges.<\/p>\n
Different link types can require different sensitivity. LTE\/5G backup, broadband internet, MPLS, and satellite links have different normal jitter, loss, cost, and bandwidth behavior. One threshold set copied across all link classes can constantly mark a healthy backup medium as degraded.<\/p>\n
Cost-aware routing may matter alongside path quality. A metered cellular path can be technically excellent but expensive; an organization may prefer it only when primary paths fail. Path quality should therefore work with path preference and policy rather than becoming the sole routing criterion.<\/p>\n
Application changes can require threshold changes. Moving voice from one codec, adopting a new SaaS region, or enabling higher-resolution video can change performance tolerance without any network change. Review path-quality profiles as part of major application rollouts.<\/p>\n
The best path-quality profile is one operators can explain from application requirements and validate against real experience data.<\/p>\n
Application owners should participate in threshold tuning. Network teams can measure latency and loss, but product teams know whether users can tolerate a brief failover, reduced video quality, or slower transaction time. The profile should encode service requirements, not only network preferences.<\/p>\n
Document path-quality policy alongside the link inventory so operators know which applications prefer which links, which metrics can disqualify a path, and what happens when every candidate link is degraded.<\/p>\n
Where several profiles overlap, confirm rule order and application matching so traffic receives the intended threshold set. A perfectly tuned profile has no effect when another SD-WAN rule matches the session first.<\/p>\n
Keep path-quality logic tied to application evidence and revisit it when link capacity, provider routing, or application behavior changes.<\/p>\n
Measure it against real user experience.<\/p>\n","protected":false},"excerpt":{"rendered":"
Palo Alto SD-WAN path quality determines when application traffic should stay on a link and when the firewall should steer new sessions to a better path. Path Quality Profiles define acceptable network conditions for applications, and SD-WAN policy rules attach those profiles to the traffic classes that need them. Within Palo Alto Security Operations, path […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-19842","post","type-post","status-publish","format-standard","hentry","category-general"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t