Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

PDF

SLA

Updated: April 24, 2026

Want to summarize with AI?

Log in

Explains SLA classes, their parameters, configuration limits, and updated default threshold behavior in Cisco Catalyst SD-WAN.

A service-level agreement (SLA) class is a policy construct that

  • Defines maximum jitter, latency, packet loss, or their combination for data plane tunnels,

  • Drives actions in application-aware routing, and

  • Applies to tunnels formed by local and remote TLOC pairs.

You can define only four unique SLA classes in an application-aware route policy and configure up to eight SLA classes on devices in later releases. Earlier releases supports only four SLA configuration.

SLA components

SLA comprises of the following parameters:

Table 1. SLA Components

Description

Command

Value or range

Maximum acceptable packet jitter on the data plane tunnel

jitter milliseconds

1–1000 milliseconds

Maximum acceptable packet latency on the data plane tunnel.

latency milliseconds

1–1000 milliseconds

Maximum acceptable packet loss on the data plane tunnel.

loss percentage

1–100 percent

Threshold values for SLA class lists

Starting with Cisco IOS XE Catalyst SD-WAN Release 17.15.1a, the threshold values for SLA class lists are adjusted, as detailed in the table below. These changes may affect your network traffic behavior upon upgrading.

Table 2. Threshold values for SLA class lists

SLA Class

Loss %

Latency (ms)

Jitter (ms)

Voice-And-Video

2

300

60

Transactional Data

1

200

200

Bulk data

5

500

500

Default

5

500

500

From Cisco Catalyst SD-WAN Manager Release 20.12.x, the threshold values for default SLA classes are not configurable.

SLA-preferred colors

From Cisco IOS XE Catalyst SD-WAN Release 17.6.1a, when you configure both application-aware routing policy and data policy, and if the data flow matches the app-route and data policy sequences, the following expected behaviors occur:

  • If the preferred colors in application-aware routing meet the SLA requirements and overlap with the data policy, the common preferred colors are chosen over others for forwarding. (Prior to Cisco IOS XE Catalyst SD-WAN Release 17.6.1a, the data policy-preferred colors were forwarded and the application-aware routing policy preferences were ignored.)

  • If preferred colors in application-aware routing do not meet the SLA, but some colors overlap with the data policy and meet the SLA in application-aware routing, those colors take precedence and are chosen for forwarding.

  • If no tunnels or colors meet the SLA in application-aware routing, the data policy takes precedence for forwarding. If the data policy specifies preferred colors, those colors are selected; otherwise, load balancing occurs across all colors in the data policy.

SLA classes

This feature enhancement increases the number of SLA classes supported on Cisco SD-WAN Controller and SD-WAN Edge devices. With the increased SLA class support, you can align SLA classes with IP Virtual Private Networks (IP-VPNs) on Multi-Protocol Label Switching (MPLS) networks to transport traffic to a global network.

The SLA enhancement supports multitenancy by allowing different SLA classes to be pushed to different tenants. The multitenancy feature requires the Cisco SD-WAN Controller to support more than eight SLA classes. To allocate SLA classes to different tenants, the global limit for policies must be 64.

You cannot configure the default SLA. The default SLA is configured in all the devices to forward traffic when no user-defined SLA is met.

Maximum SLA classes supported on Cisco IOS XE Catalyst SD-WAN devices

From Cisco IOS XE Catalyst SD-WAN Release 17.6.1a and Cisco vManage Release 20.6.1, you can configure more than six SLA classes per policy on Cisco IOS XE Catalyst SD-WAN devices.

Cisco IOS XE Catalyst SD-WAN devices need 16 GB RAM or more to support upto 16 SLA classes.

Table 3. Maximum SLA classes supported on Cisco IOS XE Catalyst SD-WAN devices

Supported platforms and models

User-configurable SLA classes prior to Cisco IOS XE Catalyst SD-WAN Release 17.6.1a (+1 default SLA class)

User-configurable SLA classes from Cisco IOS XE Catalyst SD-WAN Release 17.6.1a (+1 default SLA class)

ASR 1001 HX -16GB

6

15

ASR 1002 X -16GB

6

15

ASR 1002 HX -16GB

6

15

ASR 1001 X -16GB

6

15

ISR 4451 X

6

7

ISR 4431

6

7

Catalyst 8300 Edge Platforms

NA

7

Catalyst 8500 Edge platforms -16GB

NA

15

Any other Cisco IOS XE Catalyst SD-WAN devices

6

6

Classification of tunnels into SLA classes

Classifying tunnels into one or more SLA classes for application-aware routing consists of three main parts.

  • Measure loss, latency, and jitter information for the tunnel.

  • Calculate the average loss, latency, and jitter for the tunnel.

  • Determine the SLA classification of the tunnel.

Measure loss, latency, and jitter

Application-aware routing uses BFD Hello packets to measure loss, latency, and jitter on overlay network tunnels, ensuring tunnel liveness.

When a data plane tunnel in the overlay network is established, a BFD session automatically starts on the tunnel. In the overlay network, each tunnel uses a color to identify a specific link between a local TLOC and a remote TLOC. The BFD session monitors the liveness of the tunnel by periodically sending Hello packets to detect whether the link is operational. Application-aware routing uses the BFD Hello packets to measure the loss, latency, and jitter on the links.

By default, the BFD Hello packet interval is 1 second. You can configure this interval with the bfd color interval command. You can configure the BFD Hello packet interval per tunnel.

Calculate average loss, latency, and jitter

Application-aware routing uses BFD polling to collect packet latency, loss, jitter, and other statistics for each tunnel.

Tunnel polling and metrics collection

BFD periodically polls all tunnels on Cisco IOS XE Catalyst SD-WAN devices to collect packet latency, loss, jitter, and other statistics for application-aware routing. At each poll interval, application-aware routing calculates the average loss, latency, and jitter for each tunnel and then calculates or recalculates each tunnel’s SLA. Each poll interval is also called a “bucket.”

Poll interval behavior and configuration

By default, the poll interval is 10 minutes. With the default BFD Hello packet interval set to 1 second, application-aware routing uses information from about 600 BFD Hello packets in one poll interval to calculate tunnel loss, latency, and jitter. The poll interval is user-configurable using the bfd app-route poll-interva l command. Application-aware routing configures the poll interval per Cisco IOS XE Catalyst SD-WAN device, and it applies to all tunnels originating on the device.

Reducing the poll interval without reducing the BFD Hello packet interval may affect the quality of the loss, latency, and jitter calculations. For example, if you set the poll interval to 10 seconds and keep the BFD Hello packet interval at 1 second, the system uses only 10 Hello packets to calculate tunnel loss, latency, and jitter.

Sliding window of poll intervals

Application-aware routing preserves the loss, latency, and jitter information from each poll interval for six poll intervals. At the seventh poll interval, the system discards the earliest polling interval and stores the latest information. In this way, application-aware routing maintains a sliding window of tunnel loss, latency, and jitter information.

The number of poll intervals (6) is not user-configurable. Each poll interval is identified by an index number (0 through 5) in the output of the show app-route statistics command.

Configure SLA

Configure SLA class using policy groups

Use these steps to configure SLA Class using policy groups.

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Policy Groups > Application Priority & SLA.

2.

Create or edit an existing application priority and SLA policy and select Advanced Mode.
3.

From the left pane, click SLA Class, and then click Add SLA Class.

4.

Define the SLA class parameters.

  • In the Loss field, enter the maximum packet loss on the connection, a value from 0 through 100 percent.

  • In the Latency field, enter the maximum packet latency on the connection, a value from 1 through 1,000 milliseconds.

  • In the Jitter field, enter the maximum jitter on the connection, a value from 1 through 1,000 milliseconds.

5.

Choose the required app probe class from the App Probe Class drop-down list.

6.

(Optional) Check the Fallback Best Tunnel check box to enable the best tunnel criteria.

This optional field is available from Cisco IOS XE Catalyst SD-WAN Release 17.5.1a to pick the best path or color from the available colors when a SLA is not met. When this option is selected, you can choose the required criteria from the drop-down. The criteria are a combination of one or more of loss, latency, and jitter values.

Configure SLA class using classic policies

Use these steps to configure an SLA class using classic policies to set thresholds for loss, latency, and jitter, enabling application-aware routing and optimal path selection in your SD-WAN deployment.

Procedure

1.

From the Cisco SD-WAN Manager menu, select Configuration > Policies.

Centralized Policy is displayed by default.
2.

Click Add Policy.
3.

In the create groups of interest page, from the left pane, click SLA Class, and then click New SLA Class List.
4.

In the SLA Class List Name field, enter a name for the SLA class list.
5.

Define the SLA class parameters:

  1. In the Loss field, enter the maximum packet loss on the connection, a value from 0 through 100 percent.

  2. In the Latency field, enter the maximum packet latency on the connection, a value from 1 through 1,000 milliseconds.

  3. In the Jitter field, enter the maximum jitter on the connection, a value from 1 through 1,000 milliseconds.

  4. Choose the required app probe class from the App Probe Class drop-down list.
6.

(Optional) Check the Fallback Best Tunnel check box to enable the best tunnel criteria.

This optional field is available from Cisco IOS XE Catalyst SD-WAN Release 17.5.1a to pick the best path or color from the available colors when a SLA is not met. When this option is selected, you can choose the required criteria from the drop-down. The criteria are a combination of one or more of loss, latency, and jitter values.
7.

Select the Criteria from the drop-down. The available criteria are:

  • None

  • Latency

  • Loss

  • Jitter

  • Latency, Loss

  • Latency, Jitter

  • Loss, Latency

  • Loss, Jitter

  • Jitter, Latency

  • Jitter, Loss

  • Latency, Loss, Jitter

  • Latency, Jitter, Loss

  • Loss, Latency, Jitter

  • Loss, Jitter, Latency

  • Jitter, Latency, Loss

  • Jitter, Loss, Latency
8.

(Optional) Enter the Loss Variance (%), Latency Variance (ms), and the Jitter Variance (ms) for the selected criteria.

For more information, see Configure Variance for Best Tunnel Path.
9.

Click Add.

Configure traffic rules

Configure traffic rules using classic policies

Use this task to define or modify traffic rules for application-aware routing in Cisco SD-WAN environments.

Procedure

1.

Click Application Aware Routing.
2.

From the Add Policy drop-down list, choose Create New.
3.

Click Sequence Type.

A policy sequence containing the text string App Route is added in the left pane.

  1. Double-click the App Route text string and enter a name for the policy sequence.

    You can copy, delete, or rename a policy sequence.

    The name you enter is displayed both in the Sequence Type list in the left pane and in the right pane.

  2. In the right pane, click Sequence Rule.

    The Match/Actions dialog box opens, and Match is selected by default.

    The available policy match conditions appear below the dialog box.
4.

In the Protocol drop-down list, choose one of the following options:

  • IPv4

  • IPv6

  • Both

Depending on which protocol you choose, the Match or Actions conditions may be different.
5.

Click and choose one or more Match conditions. Set the values as described in the following table:

Table 4. Match conditions

Match Condition

Procedure

None (match all packets)

Do not specify any match conditions.

Application/Application Family List

Click Application/Application Family List and choose an application list.

This match condition is available for IPv6 traffic from Cisco IOS XE Release 17.9.1a and Cisco vManage Release 20.9.1.

Cloud Saas Application List

Cisco SD-WAN Manager provides a list of several cloud applications that Cisco Catalyst SD-WAN Cloud OnRamp for SaaS can use to determine the best path selection for each SaaS application.

For more information on Cisco Catalyst SD-WAN Cloud OnRamp for SaaS, see the Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide, Cisco IOS XE Release 17.x.

Note

Cloud Saas Application List displays as a match condition if you specify IPv4 as the Protocol option.

In the drop-down list, choose a SaaS application from the drop-down list.

DNS Application List

In the drop-down list, select an application family.

This match condition is available for IPv6 traffic from Cisco IOS XE Release 17.9.1a and Cisco vManage Release 20.9.1.

Destination Data Prefix

To match a list of destination prefixes, choose the list from the drop-down list.

To match an individual destination prefix, type the prefix in the Destination dialog box.

Destination Region

You can use Destination Region in a Cisco Catalyst SD-WAN network using Cisco Catalyst SD-WAN Multi-Region Fabric.

Choose one of the following options from the drop-down list:

  • Primary: Match traffic if the destination site is in the same primary region (also called access region) as the source.

  • Secondary: Match traffic if the destination site is not in the same primary region as the source but is within the same secondary region as the source. This traffic can reach the destination using a direct tunnel, as described for secondary regions.

  • Other: Match traffic if the destination site is not in the same primary region or secondary region as the source. This traffic requires a multi-hop path from the source to the destination.

For more information on how to configure Multi-Region Fabric, see the Cisco Catalyst SD-WAN Multi-Region Fabric (also Hierarchical SD-WAN) Configuration Guide.

Destination Port

Enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).

Traffic To

When creating a data policy or an application-aware policy for a border router for Multi-Region Fabric, you can use match criteria to match traffic flowing to the access region, the core region, or a service VPN.

DNS (to enable split DNS)

In the drop-down list, choose Request to process DNS requests for the DNS applications, and choose Response to process DNS responses for the applications.

DSCP

Type the DSCP value, a number from 0 through 63.

PLP

Choose Low or High. To set the PLP to High, apply a policer that includes the exceed remark option.

Protocol

Type the internet protocol number, a number from 0 through 255.

ICMP Message

For Protocol (IPv4), when you select a value as 1 in the Protocol field in the Match Conditions section, the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

For Protocol (IPv6), when you select a value as 58 in the Protocol field in the Match Conditions section, the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

Note

This field is available from Cisco IOS XE Release 17.4.1 or Cisco SD-WAN Release 20.4.1, and also Cisco vManage Release 20.4.1.

When Protocol is selected as Both, the ICMP Message or ICMPv6 Message field displays.

Source Data Prefix

To match a list of source prefixes, choose the list from the drop-down list.

To match an individual source prefix, enter the prefix in the Source field.

Source Port

Enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).
6.

Cliick Actions to select actions for the matched data traffic. Set the values as described in the following table:

Table 5. Actions
Action Procedure
Backup SLA Preferred Color

Set the policy action for a Backup SLA Preferred Color match condition. When no tunnel matches the SLA, direct the data traffic to a specific tunnel. Data traffic is sent out the configured tunnel if that tunnel interface is available. If that tunnel interface is not available, traffic is sent out to another available tunnel. You can specify one or more colors. The backup SLA preferred color is a loose matching condition, not a strict matching condition.
Counter

Set the policy action for a Counter match condition.

Click Counter.

In the Counter Name field, enter the name of the file in which to store packet counters.
Log

You can place a sampled set of packets that match the SLA class rule into system logging (syslog) files. In addition to logging the packet headers, a syslog message is generated the first time a packet header is logged and then every five minutes thereafter, as long as the flow is active.

Click Log to enable logging.
SLA Class List

Set the policy action for an SLA Class List match condition. For the SLA class, all matching data traffic is directed to a tunnel whose performance matches the SLA parameters defined in the class. The device first tries to send the traffic through a tunnel that matches the SLA. If a single tunnel matches the SLA, data traffic is sent through that tunnel. If two or more tunnels match, traffic is distributed among them. If no tunnel matches the SLA, data traffic is sent through one of the available tunnels.

Click SLA Class List.

In the SLA Class drop-down list, choose one or more SLA classes.

Optionally, when the Preferred Color is not selected, you can choose the preferered color group from the Preferred Color Group drop-down list. Select the preferred color group of the data plane tunnel or tunnels to prefer. You can configure up to three levels of priority based on the color or path preference. This field is available from Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco vManage Release 20.9.1.

Optionally, in the Preferred Color drop-down list, choose the color of the data plane tunnel or tunnels to prefer. Traffic is load-balanced across all the tunnels. If no tunnels match the SLA, data traffic is sent through any available tunnel. That is, color preference is a loose matching, not a strict matching.

Click Strict/Drop to perform strict matching of the SLA class. If no data plane tunnel is available that satisfies the SLA criteria, traffic is dropped.

Set a Remote Preferred Color in the AAR policy to control traffic routing based on the application list. You can add multiple remote preferred colors in the AAR policy.

Use the Restrict to Remote Color to restrict the tunnel to preferred TLOCs. With Restrict to Remote Color option, the traffic drops when the SLA is not met with the preferred remote color.

Click Fallback to best path to select the best available tunnel to avoid a packet drop.

Note
The Fallback to best path option is available from Cisco IOS XE Catalyst SD-WAN Release 17.5.1a and Cisco SD-WAN Release 20.5.1.

You can select the Fallback to best path action only when the Fallback Best Tunnel option is enabled while defining a SLA class. If the Fallback Best Tunnel option is not enabled, then the following error message displays in Cisco SD-WAN Manager: 

SLA Class selected, does not have Fallback Best Tunnel enabled. 
Please change the SLA class or change to Strict/Drop.

Click Load Balance to load balance traffic across all the tunnels.

Cloud SLA

Cloud SLA enables traffic to use the best path selection with Cisco Catalyst SD-WAN Cloud OnRamp for SaaS.

Click Cloud SLA.
7.

Click Save Match and Actions.

Create additional sequence rules as desired. Drag and drop to re-arrange them.
8.

Click Save Application Aware Routing Policy.
9.

Click Next to move to Apply Policies to Sites and VPNs in the wizard.

Configure traffic class using policy groups

Use these steps to configure traffic Class using policy groups.

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Policy Groups > Application Priority & SLA.

2.

Create or edit an existing application priority and SLA policy and select Advanced Mode.
3.

Click Add Traffic Policy.

4.

Enter the name of the VPN and set the direction to Service.

5.

Click Add Rules.

6.

In the Protocol drop-down list, choose one of the following options:

  • IPv4

  • IPv6

  • Both

Depending on which protocol that you choose, the Match or Actions conditions may be different.
7.

Click and choose one or more Match conditions. Set the values as described in the following table:

Table 6. Match conditions

Match Condition

Procedure

None (match all packets)

Do not specify any match conditions.

Application/Application Family List

Click Application/Application Family List and choose an application list.

This match condition is available for IPv6 traffic from Cisco IOS XE Release 17.9.1a and Cisco vManage Release 20.9.1.

Cloud Saas Application List

Cisco SD-WAN Manager provides a list of several cloud applications that Cisco Catalyst SD-WAN Cloud OnRamp for SaaS can use to determine the best path selection for each SaaS application.

For more information on Cisco Catalyst SD-WAN Cloud OnRamp for SaaS, see the Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide, Cisco IOS XE Release 17.x.

Note

Cloud Saas Application List displays as a match condition if you specify IPv4 as the Protocol option.

In the drop-down list, choose a SaaS application from the drop-down list.

DNS Application List

In the drop-down list, select an application family.

This match condition is available for IPv6 traffic from Cisco IOS XE Release 17.9.1a and Cisco vManage Release 20.9.1.

Destination Data Prefix

To match a list of destination prefixes, choose the list from the drop-down list.

To match an individual destination prefix, type the prefix in the Destination dialog box.

Destination Region

You can use Destination Region in a Cisco Catalyst SD-WAN network using Cisco Catalyst SD-WAN Multi-Region Fabric.

Choose one of the following options from the drop-down list:

  • Primary: Match traffic if the destination site is in the same primary region (also called access region) as the source.

  • Secondary: Match traffic if the destination site is not in the same primary region as the source but is within the same secondary region as the source. This traffic can reach the destination using a direct tunnel, as described for secondary regions.

  • Other: Match traffic if the destination site is not in the same primary region or secondary region as the source. This traffic requires a multi-hop path from the source to the destination.

For more information on how to configure Multi-Region Fabric, see the Cisco Catalyst SD-WAN Multi-Region Fabric (also Hierarchical SD-WAN) Configuration Guide.

Destination Port

Enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).

Traffic To

When creating a data policy or an application-aware policy for a border router for Multi-Region Fabric, you can use match criteria to match traffic flowing to the access region, the core region, or a service VPN.

DNS (to enable split DNS)

In the drop-down list, choose Request to process DNS requests for the DNS applications, and choose Response to process DNS responses for the applications.

DSCP

Type the DSCP value, a number from 0 through 63.

PLP

Choose Low or High. To set the PLP to High, apply a policer that includes the exceed remark option.

Protocol

Type the internet protocol number, a number from 0 through 255.

ICMP Message

For Protocol (IPv4), when you select a value as 1 in the Protocol field in the Match Conditions section, the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

For Protocol (IPv6), when you select a value as 58 in the Protocol field in the Match Conditions section, the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

Note

This field is available from Cisco IOS XE Release 17.4.1 or Cisco SD-WAN Release 20.4.1, and also Cisco vManage Release 20.4.1.

When Protocol is selected as Both, the ICMP Message or ICMPv6 Message field displays.

Source Data Prefix

To match a list of source prefixes, choose the list from the drop-down list.

To match an individual source prefix, enter the prefix in the Source field.

Source Port

Enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).
8.

To select actions for the matched data traffic, click Actions. Set the values as described in the following table:

Table 7. Actions
Action Procedure
Backup SLA Preferred Color

Set the policy action for a Backup SLA Preferred Color match condition. When no tunnel matches the SLA, direct the data traffic to a specific tunnel. Data traffic is sent out the configured tunnel if that tunnel interface is available. If that tunnel interface is not available, traffic is sent out to another available tunnel. You can specify one or more colors. The backup SLA preferred color is a loose matching condition, not a strict matching condition.
Counter

Set the policy action for a Counter match condition.

Click Counter.

In the Counter Name field, enter the name of the file in which to store packet counters.
Log

You can place a sampled set of packets that match the SLA class rule into system logging (syslog) files. In addition to logging the packet headers, a syslog message is generated the first time a packet header is logged and then every five minutes thereafter, as long as the flow is active.

Click Log to enable logging.
SLA Class List

Set the policy action for an SLA Class List match condition. For the SLA class, all matching data traffic is directed to a tunnel whose performance matches the SLA parameters defined in the class. The device first tries to send the traffic through a tunnel that matches the SLA. If a single tunnel matches the SLA, data traffic is sent through that tunnel. If two or more tunnels match, traffic is distributed among them. If no tunnel matches the SLA, data traffic is sent through one of the available tunnels.

Click SLA Class List.

In the SLA Class drop-down list, choose one or more SLA classes.

Optionally, when the Preferred Color is not selected, you can choose the preferered color group from the Preferred Color Group drop-down list. Select the preferred color group of the data plane tunnel or tunnels to prefer. You can configure up to three levels of priority based on the color or path preference. This field is available from Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco vManage Release 20.9.1.

Optionally, in the Preferred Color drop-down list, choose the color of the data plane tunnel or tunnels to prefer. Traffic is load-balanced across all the tunnels. If no tunnels match the SLA, data traffic is sent through any available tunnel. That is, color preference is a loose matching, not a strict matching.

Click Strict/Drop to perform strict matching of the SLA class. If no data plane tunnel is available that satisfies the SLA criteria, traffic is dropped.

Set a Remote Preferred Color in the AAR policy to control traffic routing based on the application list. You can add multiple remote preferred colors in the AAR policy.

Use the Restrict to Remote Color to restrict the tunnel to preferred TLOCs. With Restrict to Remote Color option, the traffic drops when the SLA is not met with the preferred remote color.

Click Fallback to best path to select the best available tunnel to avoid a packet drop.

Note
The Fallback to best path option is available from Cisco IOS XE Catalyst SD-WAN Release 17.5.1a and Cisco SD-WAN Release 20.5.1.

You can select the Fallback to best path action only when the Fallback Best Tunnel option is enabled while defining a SLA class. If the Fallback Best Tunnel option is not enabled, then the following error message displays in Cisco SD-WAN Manager: 

SLA Class selected, does not have Fallback Best Tunnel enabled. 
Please change the SLA class or change to Strict/Drop.

Click Load Balance to load balance traffic across all the tunnels.

Cloud SLA

Cloud SLA enables traffic to use the best path selection with Cisco Catalyst SD-WAN Cloud OnRamp for SaaS.

Click Cloud SLA.
9.

Click Save Match and Actions.

Create additional sequence rules as desired. Drag and drop to re-arrange them.
10.

Click Save Application Aware Routing Policy.
11.

Click Next to move to Apply Policies to Sites and VPNs in the wizard.