IP SLA

Configuration > TCAs > IP SLA

Use the IP SLA tab to create and manage IP SLA rules.

Using a polling process, IP SLA (Internet Protocol Service Level Agreement) tracking generates specific network actions that depend on the state of an IP interface or tunnel. The goal is to prevent dropped traffic. For example, associated IP subnets can be removed from the subnet table and from subnet sharing if the LAN-side interfaces on an appliance go down.

The IP SLA tab lists every IP SLA rule configured on the selected appliances. From this tab you can:

Click Add to create a rule.
Click the icon in the Charts column to view real-time and historical latency and loss trends for an interface or tunnel.
Click the IP SLA Summary link at the top of the tab to open the read-only, aggregated performance view across all appliances.

NOTE: For 9.6.0 or later deployments, your IP SLA Rule Destination addresses must be compatible with IPv6 if you want to use IPv6 local breakout addressing. The following IP SLA internet endpoints are recommended:

192.151.28.254,2600:9000:a60f:6c50:ca04:acb1:b183:9524,2600:9000:a70d:506e:85a8:bd96:7482:16,sp-ipsla.silverpeak.cloud

Replace the contents of the Address field on the IP SLA Rule Destination dialog box with these endpoints as one continuous string. For details, see Business Intent Overlays.

IP SLA Tab

Each row on the IP SLA tab represents one IP SLA rule on one appliance.

Column	Description
Appliance	The EdgeConnect appliance on which the rule is configured.
Active	Whether the rule is currently enabled (Yes) or disabled (No). Set this state with the ON/OFF toggle in the IP SLA Rule dialog box.
State	The current operational state of the rule, such as Up or Down. Down states are highlighted.
Monitor	The monitor type and its target, such as Ping with an address or Interface with an interface name.
Segment	The routing segment (VRF) in which the rule operates. Appears when segmentation is enabled.
Down action	The action performed when the monitored target transitions to the Down state.
Up action	The action performed when the monitored target returns to the Up state.
Route label	The route label, if any, associated with the rule.
Charts	Opens real-time and historical latency and loss trend charts for the rule.
Comment	An optional description of the rule. The first 64 characters appear in any alarms generated for the rule.
Up stats	The duration of the most recent up period.
Down stats	The number of down events and the duration of the most recent down period.
Actions	Edit or delete the rule.

IP SLA Monitor Use Cases

The following examples describe six basic use cases for IP SLA monitoring. The diagrams illustrate the network scenario and the intent of each rule; for the current field layout of the IP SLA Rule dialog box, see IP SLA Rule.

Example #1 – Ping via Interface

Two passthrough tunnels configured for Internet breakout and High Availability.
If the Primary passthrough tunnel goes down, traffic goes to the Backup tunnel.
Configure the IP SLA Rule with a Ping monitor and specify the same tunnel for both the Down Action and the Up Action. See IP SLA Rule for the field-by-field layout.

Example #2 – HTTP/HTTPS via Interface

Two passthrough tunnels configured for Internet breakout and High Availability.
If the Primary passthrough tunnel goes down, traffic goes to the Backup tunnel.
Configure the IP SLA Rule with an HTTP/HTTPS monitor and specify the same tunnel for both the Down Action and the Up Action. See IP SLA Rule for the field-by-field layout.

NOTE: Do not select a loopback interface for HTTP/HTTPS IP SLA monitoring. A loopback interface is invalid because packets cannot be sent to that interface. If the source interface selection is a tunnel, select a second source interface. This second source interface is used as the source IP address of the packet to be sent through the tunnel.

In the URL(s) field, the protocol identifier is required only when specifying HTTPS, as in https://www.google.com.

Example #3 – Monitor Interface

On EdgeConnect - A, we want subnet advertising conditional on LAN0 being up.
Configure the IP SLA Rule with an Interface monitor on LAN0 and set the Default Subnet Action to resume advertising subnets.

Example #4 – Monitor Interface (WAN0) to Ensure High Availability

If WAN0 goes down on the VRRP Master, we want to decrease its Priority so traffic goes to the VRRP Backup.
Configure the IP SLA Rule with an Interface monitor on WAN0 and set the Default Subnet Action to revert to the original priority.

NOTE: In this instance, the WAN0 interface was given the label MPLS to match the service to which it connected.

Example #5 – Monitor VRRP

To monitor the VRRP router state, use VRRP Monitor and specify the interface on which the VRRP instance is configured.

In this example, it is LAN0.
Here we are looking at an instance where the VRRP role changes, but priority does not, for whatever reason.
Configure the IP SLA Rule with a VRRP monitor and set the Default Subnet Action to revert to the original priority.

NOTE: In this instance, the WAN0 interface was given the label MPLS to match the service to which it connected.
Another option is to leave the VRRP priority unchanged and instead influence path selection through subnet metrics. Set Down Action = Modify Subnet Metric, then enter a positive value in the field that Orchestrator adds to increase the current subnet metric. Set Up Action = Default Subnet Action to restore the original metric when the monitored state recovers.

Use this approach when you want traffic to shift based on overlay route preference rather than by changing which appliance is the VRRP master. Raising the subnet metric makes the affected subnets less preferred to EdgeConnect peers, so traffic favors an alternate path across the SD-WAN fabric while the local VRRP master election stays the same. This produces a different result from adjusting VRRP priority: modifying the subnet metric steers routing among EdgeConnect peers, whereas changing VRRP priority steers first-hop gateway selection for locally attached clients.

In most scenarios, adjust VRRP priority when the goal is local gateway (first-hop) redundancy, and modify the subnet metric when the goal is to influence path selection across the fabric. If a single monitored event must affect both first-hop and fabric behavior, you can use both mechanisms together.

Example #6 – Revoke Static Route Using IP SLA

In example 6, the route label Internet is associated with an IP SLA rule to ping sp-ipsla.silverpeak.cloud. The route label is assigned to two static routes and each route is assigned a metric. When the static route with a metric of 50 goes down, traffic is routed to the backup route (with a metric of 60). See Route Labels for more information.
Configure the IP SLA Rule with the Down Action set to Raise Alarm Only and the Up Action set to Clear Alarm Only.

IP SLA Rule

Use the IP SLA Rule dialog box to create or modify an IP SLA rule. On the IP SLA tab, click Add to create a rule, or use the edit control in the Actions column to modify an existing rule.

Set the rule state with the ON/OFF toggle at the top of the dialog box. ON enables the rule; OFF disables the rule without deleting it. This state is reflected in the Active column on the IP SLA tab.

Under Monitor, select the type of target to monitor.

Option	Description
Interface	Monitors the operational status of a specific local interface.
Ping	Monitors the reachability of one or more IPv4 or IPv6 addresses.
HTTP/HTTPS	Monitors the reachability of an HTTP/HTTPS endpoint. NOTE: Both HTTP and HTTPS require a response of 200. Redirects are not supported. NOTE: Using HTTPS as a monitor for IP SLA with multiple targets can cause potential problems. HTTPS does not provide any additional benefit about the path check.
VRRP Monitor	Monitors the VRRP router state (TRUE if Master; FALSE if Backup) for a VRRP instance on an interface.

Complete the fields that appear for the monitor you selected. The dialog box displays a different set of fields for each monitor type.

Interface and VRRP Monitor

Field	Description
Interface	The local interface to monitor. For VRRP Monitor, this is the interface on which the VRRP instance is configured.
Check IP SLA status every	The polling interval, in seconds, at which the appliance checks the monitored interface or VRRP state. The default is 30 seconds.

Ping

Field	Description
Address	One or more target IPv4 or IPv6 addresses to ping. Separate multiple addresses with commas on a single line.
Source	Whether probes are sourced from an Interface or a Tunnel.
Tunnel	(Source = Tunnel) The passthrough tunnel used to send probes.
Source Interface / Interface	The interface used to source probes. When the source is a tunnel, this second interface supplies the source IP address of the probe packet.
Ping interval	The interval, in seconds, between successive pings.
Rolling average window for loss and latency	The averaging window, in seconds (1–900), used to smooth the loss and latency measurements.
Force DNS through probe path / Do not force DNS through probe path	Whether DNS resolution for the target is forced through the probe path.
Mark up after X sequential successes / Mark down after X sequential failures	The reachability thresholds that transition the rule up or down.
Mark up after loss below X % / Mark down after loss above X %	The packet-loss thresholds, as a percentage (0–100), that transition the rule up or down.
Mark up after average latency below X / Mark down after average latency above X	The average-latency thresholds, in milliseconds (0–9999), that transition the rule up or down.

HTTP/HTTPS

Field	Description
URL(s)	One or more HTTP or HTTPS endpoints to monitor. Separate multiple URLs with commas. The protocol identifier is required only when specifying HTTPS, as in `https://www.example.com`.
Proxy address	(Optional) The IPv4 or IPv6 address of a proxy server used to reach the endpoint.
Proxy port	(Required when a proxy address is set) The proxy server port (1–65535).
User agent	(Optional) A custom User-Agent string to send with the request.
HTTP request timeout	The time, in seconds, to wait for a response before the request is considered failed.
Source	Whether probes are sourced from an Interface or a Tunnel.
Tunnel	(Source = Tunnel) The passthrough tunnel used to send probes.
Source Interface / Interface	The interface used to source probes. When the source is a tunnel, this second interface supplies the source IP address of the probe packet.
Polling frequency	The interval, in seconds, between successive requests. The default is 60 seconds.
Rolling average window for loss and latency	The averaging window, in seconds (1–900), used to smooth the loss and latency measurements.
Force DNS through probe path / Do not force DNS through probe path	Whether DNS resolution for the target is forced through the probe path.
Mark up after X sequential successes / Mark down after X sequential failures	The reachability thresholds that transition the rule up or down.
Mark up after loss below X % / Mark down after loss above X %	The packet-loss thresholds, as a percentage (0–100), that transition the rule up or down.
Mark up after average latency below X / Mark down after average latency above X	The average-latency thresholds, in milliseconds (0–9999), that transition the rule up or down.

NOTE: Do not select a loopback interface for HTTP/HTTPS IP SLA monitoring. A loopback interface is invalid because packets cannot be sent to that interface. If the source is a tunnel, select a second source interface; this interface is used as the source IP address of the packet sent through the tunnel.

NOTE: For Ping and HTTP/HTTPS monitors, the IP version of the target must match the IP version of the source interface or path used to send the probes. If the target is an IPv6 address (or resolves only to IPv6) but the source interface has no IPv6 address configured—or the reverse—the monitor is marked Down and its Down Action is applied. Make sure the source interface is configured for the same IP version (IPv4 or IPv6) as the monitored target.

Select an action from the Down Action list. This action runs when the monitored target transitions to the Down state.

Down Action	Description
Enable Tunnel	Enable a passthrough (internet breakout) tunnel for IP SLA tracking purposes. Select the tunnel in the Tunnel field that appears.
Disable Tunnel	Disable a passthrough (internet breakout) tunnel for IP SLA tracking purposes. The tunnel can no longer be used for load balancing (when load balancing traffic between multiple passthrough tunnels), although it can still be used as a last resort for traffic forwarding. Select the tunnel in the Tunnel field that appears.
Advertise Subnets	Advertise subnets to EdgeConnect peers. Select the interface in the Interface field that appears.
Decrease VRRP Priority	Decrease the configured VRRP router priority by a delta amount. Select the Interface and enter the Priority delta in the fields that appear.
Disable Subnet Sharing	Disable the sharing of subnets with other EdgeConnect peers on the appliance.
Increase VRRP Priority	Increase the configured VRRP router priority by a delta amount. Select the Interface and enter the Priority delta in the fields that appear.
Modify Subnet Metric	Add a metric delta to the metric of all subnets shared with EdgeConnect peers. Enter the amount in the Delta field that appears.
Remove Auto Subnets	Remove from the subnet table an auto subnet for a port (including all VLAN and subinterface subnets). Select the interface in the Interface field that appears.
Raise Alarm Only	Raise an alarm when the IP SLA rule goes down.

NOTE: If an IP SLA rule is misconfigured, the appliance marks the rule Down and applies its Down Action. Verify the monitor and source settings if a rule remains Down unexpectedly.

Select an action from the Up Action list. This action runs when the monitored target returns to the Up state.

Up Action	Description
Enable Tunnel	Enable a passthrough (internet breakout) tunnel for IP SLA tracking purposes. Select the tunnel in the Tunnel field that appears.
Disable Tunnel	Disable a passthrough (internet breakout) tunnel for IP SLA tracking purposes. The tunnel can no longer be used for load balancing (when load balancing traffic between multiple passthrough tunnels), although it can still be used as a last resort for traffic forwarding. Select the tunnel in the Tunnel field that appears.
Decrease VRRP Priority	Decrease the configured VRRP router priority by a delta amount.
Increase VRRP Priority	Increase the configured VRRP router priority by a delta amount.
Default Subnet Action	Reverts whatever the Down Action was back to the normal state. Examples: If Down Action = Disable Subnet Sharing, the Up Action re-enables subnet sharing. If Down Action = Remove Auto Subnets, the Up Action re-adds the auto subnet. If Down Action = Modify Subnet Metric, the Up Action restores subnet metrics to their original values.
VRRP Default	Reverts the VRRP priority back to the configured value.
Clear Alarm Only	Clears any alarms created as a result of an IP SLA rule going down.

NOTE: If a default Up Action (Default Subnet Action, VRRP Default, or Clear Alarm Only) is used, it must match the corresponding Down Action.

(Optional) Select a Route Label from the list of configured route labels to assign to the rule.

The Route Label field is in addition to the Down Action and Up Action fields. Route labels are used with IP SLA rules to mark associated, locally configured static or announce-only routes Down when the route label state is Down.
- Route labels are configured globally at Configuration > Overlays & Security > Route Labels.
- Multiple IP SLA rules can reference the same route label. The route label remains Up as long as at least one associated IP SLA rule is Up. The route label is marked Down only when all IP SLA rules referencing it are Down. The exact behavior also depends on the route label’s IP SLA Condition (ALL or ANY).
- Route labels apply only to locally configured static or announce-only routes. They do not affect routes received from BGP, OSPF, or fabric peers.
- The Route Label action is independent of the Down Action field; both can be configured on the same rule.
For more information, see Route Labels.
(Optional) In the Comment field, enter a description of the rule. The first 64 characters are included in any alarms generated for the rule.
Click Save.