Course contents

Unit 7: Cloud and hybrid WANLesson 7.3 (2 of 4 in this unit)15 of 25 in the Advanced Cisco SD-WAN course

Cloud OnRamp for SaaS and application quality

How an edge measures SaaS application quality over each exit, scores it, and chooses direct internet access or a gateway site, with prerequisites and checks.

Advanced · 13 min read

You'll learn to explain how an edge scores a SaaS application over each exit, choose between direct internet, gateway and client sites, and work through the usual reasons the scores or the path look wrong.

Technical definition

Cloud OnRamp for SaaS is a Catalyst SD-WAN feature that measures how well a SaaS application is reached over each available exit, turns the measurements into a quality score for that application, and sends the application's traffic over the best exit. The exit may be a local internet circuit or a gateway site such as a hub.

BR-02 has one internet circuit and a hub that has two

BR-02 (site 102) is internet only. BR-01 (site 101) has MPLS and internet. HUB-01 (site 10) has good internet access at the data centre. A SaaS application used by all three can leave the network at the branch itself, through direct internet access (DIA), or travel across the overlay to HUB-01 and leave from there. Which is better is not a fixed fact. It depends on the local circuit, the hub circuit and the moment. Cloud OnRamp for SaaS measures both and decides per application. Site IDs and names here are lab examples.

How the measurement and the decision work

  1. Pick the application. In SD-WAN Manager (vManage) you choose which SaaS applications to monitor and which sites take part.
  2. Probe. An edge with an exit sends probes towards the application's endpoints through that exit and records loss and latency. A gateway site does the same through its own internet circuit.
  3. Score. The loss and latency are combined into a quality score for each application and exit. Check your release for the scale. It is commonly described as 0 to 10.
  4. Choose. The edge installs a path for that application over the exit with the best score. Traffic for other applications is not touched.
  5. Reselect. Measurement continues. If another exit becomes clearly better, the edge moves the application. The decision includes some hysteresis, a margin that stops it flipping between two exits with nearly equal scores. The exact margin depends on the release.
BR-02 chooses the best path to a SaaS application
BR-02 chooses the best path to a SaaS applicationBR-02 has one internet circuit. HUB-01 has two. The edge measures the path to the SaaS application directly and through HUB-01, using probes that report loss and delay. It sends the application over the better path and keeps measuring, so the choice can change when conditions change.BR-02one circuitHUB-01two circuitsSaaS applicationvia the hubdirect internet accessProbes measure loss and delay on each path; the better one carries the application.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The picture in Manager shows the measured score for each path. The feature does not create bandwidth; it only chooses among the paths you already have.

Three roles a site can have

Three roles a site can have
Three roles a site can haveRole; Meaning; Lab example; Suits. DIA site: Measures its own local internet exit and may use it for the application BR-02 with one circuit, BR-01 with its internet circuit Sites with usable internet and local NAT Gateway site: Offers its internet exit to other sites, and is measured too HUB-01 as a regional internet exit A hub or data centre with strong internet Client site: Has no good local exit for the application, or none, and compares gateway sites A site whose local internet is poor, using HUB-01 Small sites, or sites where local breakout is not allowedRoleMeaningLab exampleSuitsDIA siteMeasures its own localinternet exit and may useit for the applicationBR-02 with one circuit,BR-01 with its internetcircuitSites with usableinternet and local NATGateway siteOffers its internet exitto other sites, and ismeasured tooHUB-01 as a regionalinternet exitA hub or data centre withstrong internetClient siteHas no good local exitfor the application, ornone, and comparesgateway sitesA site whose localinternet is poor, usingHUB-01Small sites, or siteswhere local breakout isnot allowed

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

A site can combine roles. A DIA site can also be a client, so that it compares its own circuit with a gateway and takes the better one. Which combinations your release allows is a point to check in the configuration guide.

What has to be in place

PrerequisiteWhy it matters
Direct internet access on the exit interfaceThe router must be allowed to send traffic out of the transport interface, normally with NAT. Without NAT, probes and traffic leave with private addresses and are lost
NAT configured for the service VPNUser traffic from VPN 10 (corporate) must be translated when it leaves locally. See NAT for the basics
Working DNSThe application's names must resolve. Probes depend on the addresses the application uses
Reachable probe destinationsA firewall or upstream filter that drops probes gives a score of nothing useful
Application chosen and sites attached in ManagerThe feature does nothing for an application or a site that has not been selected
Gateway sites reachable through the overlayA client site can only use a gateway whose tunnels are up

The first prerequisite is the one that most often fails quietly. The local NAT is easy to check on the router.

Example output written for this lesson, simplified; real output has more fields and a different layout
BR-02#show ip nat translations
Pro  Inside global      Inside local       Outside local      Outside global
tcp  203.0.113.22:49812 10.10.1.50:49812   198.51.100.77:443  198.51.100.77:443
tcp  203.0.113.22:49820 10.10.1.51:49820   198.51.100.77:443  198.51.100.77:443
Inside local 10.10.1.x is a corporate host. Inside global 203.0.113.22 is the address the internet sees. Both lines go to port 443 on a SaaS-style endpoint. If the table has no entries while users run the application, the traffic is not leaving locally, whether because it follows the overlay or because it is being dropped. In a VRF setup some releases need the VRF named in the command, so check yours.

Reading the picture in Manager

Manager's monitoring pages for the feature list the applications, the sites, the exit in use and the score for each exit. There is no need for a screenshot to know what to look for.

Reading the picture in Manager
Reading the picture in ManagerWhat you see; Reads as. Every site shows a score for its local exit and a gateway, and the better one is in use: Healthy. The decision follows the scores One exit has a clearly lower score than the rest for several applications: That circuit has a problem (loss or latency), not the applications One application scores low everywhere: The problem is probably the application or its provider, or the probing path to it No score for a site, or a state that says no data: Probing is not running or not reaching. Check the prerequisites above Scores look fine but users complain: The score measures loss and latency to the endpoint, not the user's whole experience. Look at the application and the local networkWhat you seeReads asEvery site shows a scorefor its local exit and agateway, and the better oneis in useHealthy. The decision follows the scoresOne exit has a clearlylower score than the restfor several applicationsThat circuit has a problem (loss or latency), not the applicationsOne application scores loweverywhereThe problem is probably the application or its provider, or the probingpath to itNo score for a site, or astate that says no dataProbing is not running or not reaching. Check the prerequisites aboveScores look fine but userscomplainThe score measures loss and latency to the endpoint, not the user's wholeexperience. Look at the application and the local network

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

What this is not

Application-aware routing (AAR) measures the tunnels between SD-WAN sites with BFD and picks among tunnels whose loss, latency and jitter meet an SLA. Cloud OnRamp for SaaS measures paths to internet applications and picks among exits. They solve different problems and can both be active. A branch may use AAR to choose between its MPLS and internet tunnels to the hub, and Cloud OnRamp for SaaS to decide whether the SaaS application should leave locally or via the hub.

What if the hub is far from the SaaS provider?

Sending SaaS traffic across the overlay to a hub first adds the overlay delay and then the hub's delay to the provider. If the hub is in another country, its exit may score worse than a mediocre local circuit. The measurement catches this where a fixed rule such as "all internet goes via the hub" does not. It also means a good hub circuit does not guarantee a good score. The score depends on the whole path.

When it fails: symptoms and causes

When it fails: symptoms and causes
When it fails: symptoms and causesSymptom; Likely cause; First check. No score at a site: Site not attached, probing blocked, or DNS failing Site selection in Manager, DNS from the router, NAT table Application stays on the hub and does not use the local exit: Local exit scores lower, or local exit is not enabled for that site Scores per exit, site role, local NAT Traffic leaves locally but fails: NAT missing or wrong VPN, return traffic not reaching the router Show NAT translations, route to the VPN Application keeps moving between exits: Two exits with similar, noisy scores Score history, circuit quality, release hysteresis settings Client site cannot use a gateway: Tunnels to the gateway down, or gateway has no usable internet BFD sessions to the gateway, gateway score Feature turned off, traffic still works: Expected. Traffic follows normal routing Confirm the intended path with a traceSymptomLikely causeFirst checkNo score at a siteSite not attached, probing blocked,or DNS failingSite selection in Manager, DNS fromthe router, NAT tableApplication stays onthe hub and does notuse the local exitLocal exit scores lower, or localexit is not enabled for that siteScores per exit, site role, local NATTraffic leaves locallybut failsNAT missing or wrong VPN, returntraffic not reaching the routerShow NAT translations, route to theVPNApplication keepsmoving between exitsTwo exits with similar, noisy scoresScore history, circuit quality,release hysteresis settingsClient site cannot usea gatewayTunnels to the gateway down, orgateway has no usable internetBFD sessions to the gateway, gatewayscoreFeature turned off,traffic still worksExpected. Traffic follows normalroutingConfirm the intended path with atrace

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Test yourself on SaaS path selection

Predict · scenario 1

BR-02's internet circuit has 5 per cent loss, while HUB-01's internet exit is clean. BR-02 is a client site with HUB-01 as a gateway. What should Cloud OnRamp for SaaS do for a monitored application?

Predict · scenario 2

Manager shows no score at BR-01 for a selected application. DNS works from a PC. The NAT table on BR-01 is empty. What is the best next step?

Predict · scenario 3

A colleague says Cloud OnRamp for SaaS and application-aware routing are the same thing. Which statement corrects them best?

Predict · scenario 4

The Cloud OnRamp for SaaS measurement process stops working for a site. What do you expect users to see?

FAQ

What does the quality score mean?
It is a single number that summarises the loss and latency the edge measured towards the application over one exit. Higher is better. Cisco's documentation describes a scale of 0 to 10, but check your release for the exact scale and for the values it treats as good or poor. Compare the scores of the exits for one application. Do not compare scores between different applications.
Does the feature change my SD-WAN tunnels?
No. It does not measure or alter the tunnels between SD-WAN sites. It measures paths from your exits to internet applications, and it decides which exit that application's traffic uses.
What happens if the feature stops working?
Traffic for the application follows the normal routing table, as it did before the feature was turned on. A broken measurement should not cause an outage by itself, but it can leave users on a path that is no longer the best one.