Overview

This Knowledge Base article explains how to use user-defined URL categories to perform traffic steering in Versa Networks SD-WAN deployments with/without requiring a Next-Generation Firewall (NGFW). It covers the configuration steps, the importance of the HTTP inspection pipeline, and troubleshooting tips for consistent URL category matching in SD-WAN rules.

Configuration Steps with NGFW:

1. Create a user-defined URL category:
   • Navigate to Objects & Connectors
   • Under Objects > Custom Objects > URL Categories
   • Create the desired user defined URLs or domains to the category.
   • Save the changes
2. Create an SD-WAN rule for traffic steering:

   rules {
       Traffic-Steering-Site12 {
           rule-disable false;
           match {
               source {
                   user {
                       user-type any;
                   }
               }
               url-category {
                   user-defined [ atlassian ];
               }
           }
           set {
               action             allow;
               forwarding-profile Traffic-steering-URL;
               lef {
                   event      never;
                   rate-limit 10;
               }
           }
       }

• Match the desired user-defined URL category.
• Set the action to allow and specify the forwarding profile for traffic steering.

3. Enable URL Category Cache:
   • Navigate to Services > SDWAN
   • Under Application Detection > Enable the URL Category Cache option to improve lookup performance.
     
     
     
     
     
4. Configure HTTP Inspection Pipeline:
   • Navigate to Next Gen Firewall
   • Under Security Settings > URL Filtering
   • Edit settings and set the Match Type to "HTTP Host URI".
   • Save the changes.

HTTP Inspection Pipeline

URL category matching in SD-WAN rules relies on the HTTP inspection pipeline(Available under NGFW) to extract the URL from the request. The processing chain is as follows:

1. TCP SYN: A session is created, and the initial SD-WAN rule is matched based on IP, port, and application.
2. HTTP GET: The URL is extracted from the Host header (or SNI field for HTTPS).
3. URL Category Lookup: The extracted URL is matched against predefined and user-defined categories.
4. Session Re-classification: The SD-WAN rule is re-evaluated based on the URL category.

The key point is that step 2 (URL extraction for SD-WAN re-classification) is only triggered when the security/inspection pipeline is active. The "HTTP Host URI" match type in the security settings activates the L7 HTTP inspection engine, which feeds the URL into the classification pipeline.

Troubleshooting Inconsistent Matching

If URL-based traffic steering is not working consistently, consider the following:

• Ensure that the HTTP inspection pipeline is properly configured with the "HTTP Host URI" match type.
• Verify that the user-defined URL category contains the correct URLs or domains.
• Check that the SD-WAN rule's match criteria are correctly defined to capture the desired traffic.
• Confirm that the URL Category Cache is enabled for faster lookups.

Without the HTTP inspection pipeline, the AppID/sPACK engine may identify the application, but the URL extraction required for user-defined URL categories, which are not part of the sPACK, will not occur. This can lead to inconsistent traffic steering.
Above settings can work with sample spack for user defined urlf for traffic steering.

Using Premium SPACK when NGFW service is not enabled on VOS:

The configuration described above stands as it is for this case except for NGFW security settings. For traffic steering based on user defined url categories we must use Premium spack if NGFW is not available or used on VOS platform.
With the premium SPACK, the HTTP inspection pipeline is automatically triggered, ensuring that URLs are properly extracted and matched against the predefined categories. This enables consistent traffic steering based on URL categories without the need for additional NGFW configuration.

Please Note: Sub domains will not get identified even with premium spack. We must have NGFW enabled for sub-domian categorizations

Conclusion

Using user-defined URL categories for traffic steering in Versa Networks SD-WAN deployments requires careful configuration of the HTTP inspection pipeline and the SD-WAN rules. Enabling the URL Category Cache and loading the premium sPACK can significantly improve the consistency and performance of URL-based traffic steering.

By understanding the role of the HTTP inspection pipeline and properly configuring the security settings, network administrators can effectively steer traffic based on user-defined URL categories without relying on a full-fledged NGFW solution.