Data plane tunnel performance monitoring

Monitor data plane tunnel performance

The Bidirectional Forwarding Detection (BFD) protocol runs over all data plane tunnels between Cisco IOS XE Catalyst SD-WAN devices, monitoring the liveness, and network and path characteristics of the tunnels. Application-aware routing uses the information gathered by BFD to determine the transmission performance of the tunnels. Performance is reported in terms of packet latency and packet loss on the tunnel.

BFD sends Hello packets periodically to test the liveness of a data plane tunnel and to check for faults on the tunnel. These Hello packets provide a measurement of packet loss and packet latency on the tunnel. The Cisco IOS XE Catalyst SD-WAN device records the packet loss and latency statistics over a sliding window of time. BFD keeps track of the six most recent sliding windows of statistics, placing each set of statistics in a separate bucket. If you configure an application-aware routing policy for the device, it is these statistics that the router uses to determine whether a data plane tunnel's performance matches the requirements of the policy's SLA.

Sliding window operation and statistics

• For each sliding window time period, application-aware routing receives 600 BFD Hello packets (BFD Hello interval × polling interval: 1 second × 600 seconds = 600 Hello packets). These packets measure packet loss and latency on the data plane tunnels.

• Application-aware routing retains the statistics for 1 hour (polling interval × multiplier: 10 minutes × 6 = 60 minutes).

• Application-aware routing places the statistics in six separate buckets, indexed 0 through 5. Bucket 0 contains the latest statistics, and bucket 5 contains the oldest. Every 10 minutes, the system places the newest statistics in bucket 0, discards the statistics in bucket 5, and moves the remaining statistics to the next bucket.

• Every 60 minutes (every hour), application-aware routing acts on the loss and latency statistics. It calculates the mean loss and latency across all buckets in all sliding windows and compares the result with the specified SLAs for the tunnel. If the calculated value satisfies the SLA, application-aware routing takes no action. If the value does not satisfy the SLA, application-aware routing calculates a new tunnel.

• Application-aware routing uses the values in all six buckets to calculate the mean loss and latency for a data tunnel because the multiplier is 6. Although application-aware routing always retains six buckets of data, the multiplier determines how many buckets it uses to calculate the loss and latency. For example, if the multiplier is 3, it uses buckets 0, 1, and 2.

Adjusting parameters for faster detection

These default values take action only every hour, so they work well for a stable network. To capture network failures more quickly and allow application-aware routing to calculate new tunnels more often, adjust the values of these three parameters.

For example, if you change the polling interval to 1 minute (60,000 milliseconds), application-aware routing reviews tunnel performance characteristics every minute, but it performs loss and latency calculations based on only 60 Hello packets. If application-aware routing determines that it needs a new tunnel, it may take more than 1 minute to reset the tunnel.

• To display the next-hop information for an IP packet that a device sends out a service side interface, use the show policy service-path command.

• To view the similar information for packets that the router sends out a WAN transport tunnel interface, use the show policy tunnel-path command.

• To display statistics for each data plane tunnel, use the show sdwan app-route stats command:

  Device# show sdwan app-route stats 
  
                                                                                                           TX    RX    
                                      SRC    DST    MEAN  MEAN            TOTAL          AVERAGE  AVERAGE  DATA  DATA  
  SRC IP       DST IP          PROTO  PORT   PORT   LOSS  LATENCY  INDEX  PACKETS  LOSS  LATENCY  JITTER   PKTS  PKTS  
  ---------------------------------------------------------------------------------------------------------------------
  192.0.2.1  192.0.2.254  ipsec  12346  12346  0     22       0      596      0     21       2        0     0     
                                                                   1      596      0     21       2        0     0     
                                                                   2      596      0     21       2        0     0     
                                                                   3      597      1     21       2        0     0     
                                                                   4      596      0     21       2        0     0     
                                                                   5      596      0     29       4        0     0     
  192.0.2.1  192.0.2.254  ipsec  12346  12346  0     24       0      596      0     24      3       0        0     
                                                                   1      596      0     25       3        0     0     
                                                                   2      596      0     25       3        0     0     
                                                                   3      596      0     24       3        0     0     
                                                                   4      596      0     24       3        0     0     
                                                                   5      596      0     24       3        0     0     
  192.0.2.1  192.0.2.254  ipsec  12346  34083     0   21      0      596      0     21      3       0        0       
                                                                   1      596      0     22       3        0     0     
                                                                   2      596      0     22       3        0     0     
                                                                   3      596      0     21       3        0     0     
                                                                   4      596      0     21       3        0     0     
                                                                   5      596      0     21       3        0     0     
  
  192.0.2.1  192.0.2.254  ipsec  12346  36464   0     23       0     596      0     23      3       0        0     
                                                                   1      596      0     23       3        0     0     
                                                                   2      596      0     24       3        0     0     
                                                                   3      596      0     23       4        0     0     
                                                                   4      596      0     23       4        0     0     
                                                                   5      596      0     23       4        0     0 
  ...

To configure application visibility on the router, use:

device(config)#  policy app-visibility 

To monitor the applications, use the show app dpi applications and show app dpi supported-applications commands on the device.