How to Configure Performance-Based Transport Selection for VPN Tunnels with SD-WAN

Performance-Based Transport Selection selects the VPN transport offering the best latency (Round Trip Time) or bandwidth for the traffic matching the access rule. Only UDP transports with Dynamic Bandwidth and Round Trip Time Detection are supported. Performance-Based Transport Selection can route traffic using the following policies:

Optimize for Latency
Optimize for Outbound Bandwidth
Optimize for Inbound Bandwidth
Optimize for Combined Bandwidth

Before You Begin

Create a multi-transport VPN tunnel between two CloudGen Firewalls:

Create a TINA site-to-site VPN tunnel. For more information, see How to Create a TINA VPN Tunnel between CloudGen Firewalls or How to Create a VPN Tunnel with the VPN GTI Editor.
Add one or more additional UDP transports to the VPN tunnel. For more information, see How to Add a VPN Transport to a TINA VPN Tunnel with Explicit Transport Selection or How to Configure SD-WAN Using the VPN GTI Editor.
Create access rules for each type of traffic going through the VPN tunnel. For more information, see How to Create Access Rules for Site-to-Site VPN Access.
(Consolidated Shaping only) Set the QoS Profile and enable shaping for the physical interfaces used by the VPN traffic.

Step 1. Enable Dynamic Bandwidth and Latency Detection for Each Transport

On both VPN endpoints, edit all transports to enable Dynamic Bandwidth and Round Trip Time Detection.

Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN Service > Site-to-Site.
Click Lock.
Double-click the TINA VPN tunnel. The TINA Tunnel window opens.
Click the SD-WAN - Bandwidth Protection tab.
From the Dynamic Bandwidth Detection list, select the policy:
- Active Probing and Passive Monitoring
- Active Probing Only
- No Probing - use Estimated Bandwidth
Enter the Estimated Bandwidth bandwidth.
(optional) Select the Consolidated Shaping check box
Click OK.
Click Send Changes and Activate.

After completing these changes, go to VPN > Site-to-Site. Right-click the transport and select Monitor Traffic. The Round Trip Time, drop rate, and traffic on the transport is now displayed in real time.

Step 2. Create a Custom Connection Object for the SD-WAN Primary

Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > Firewall > Forwarding Rules.
In the left menu, click Connections.
Right-click the table and select New Connection. The Edit/Create a Connection Object window opens.
In the Name field, enter a name for the connection object.
From the Translated Source IP list, select Original Source IP.
To edit the VPN SD-WAN settings, click Edit/Show . The SD-WAN Settings window opens.
Configure the Transport Policies:
- Transport Selection Policy – Select the criteria to optimize for:
  - Optimize for Inbound Bandwidth
  - Optimize for Outbound Bandwidth
  - Optimize for Combined Bandwidth
  - Optimize for Latency
- SD-WAN Learning Policy – Select Primary.
Configure the Explicit Transport Selection as the fallback if no more transports with Dynamic Bandwidth and Round Trip Time Detection are available.
- Primary Transport Class – Select the primary transport class.
- Primary Transport ID – Select the ID for the primary transport.
- Secondary Transport Class – Select the secondary transport class.
- Secondary Transport ID – Select the ID for the secondary transport.
Click OK.
Click Send Changes and Activate.

Step 3. Create a Custom Connection Object for the SD-WAN Secondary

Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > Firewall > Forwarding Rules.
In the left menu, click Connections.
Right-click the table and select New Connection. The Edit/Create a Connection Object window opens.
Enter a Name.
From the Translated Source IP list, select Original Source IP.
To edit the VPN SD-WAN settings, click Edit/Show. The SD-WAN Settings window opens.
From the SD-WAN Learning Policy drop-down list, select Secondary.
Click OK.
Click Send Changes and Activate.