About Endpoint Agent Tests

Secure Access endpoint tests powered by Cisco ThousandEyes simulate the user path to sites and applications using real traffic to gain insights into performance issues. When you onboard Experience Insights and install the ThousandEyes endpoint agent on end user devices, the agent goes where the user goes. This enables synthetic testing that closely matches end user experience.

To manage and configure your endpoint licenses, synthetic endpoint tests, and default network and collaboration app tests, log into Secure Access and navigate to Experience Insights > Endpoint tests.

The first table displays your ThousandEyes license usage. You can click on the All Account Groups drop-down list to select specific account groups to view their license usage.

Changing the All Account Groups drop-down list does not update the Endpoint tests table.

The number of tests you can run is based on your organization's ThousandEyes license type. The embedded license is assigned by default when you onboard Experience Insights.

You can run a combination of multiple scheduled and dynamic tests at a time. If you exceed the number of allowed tests, ThousandEyes uses a mechanism to determine which tests should run on a given agent. For information, see Assigning tests to an Endpoint Agent.

For more information about ThousandEyes licensing, see ThousandEyes Endpoint Agent Licensing.

The second table lists your running and disabled tests. In the table you can:

• Search by test name.

• Filter by test type: All test types, Network, or HTTP.

• View all ThousandEyes created tests and tests created in Experience Insights, or only view Experience Insights tests.

Click a test name to view Endpoint test results. For more information, see View HTTP Server Test Results and View Network Test Results.

Click Add new to configure a new synthetic test. For more information, see Create HTTP Server Tests and Create Network Tests.

Account Group: Shows all the account groups that the Endpoint tests are configured in. (This option appears only when you have multiple ThousandEyes account groups selected in Account Management.)

Select one or more table rows to delete, disable, or enable tests.

The third table lists the default network and collaboration app tests that you configured during Experience Insights onboarding. For more information, see Onboard Experience Insights and Configure Experience Insights.

Additional options are available in the ThousandEyes dashboard.

• You can configure alerts for specific tests. For more information, see Alerts.

• You can adjust test priority for each endpoint agent. For more information, see Test Priority.

• You can reallocate a license to another endpoint. For more information, see Assigning licenses to Agents.

• For more information about managing synthetic endpoint tests in ThousandEyes, see Managing Synthetic Tests.

A single synthetic test is limited to a maximum of 150,000 endpoint agents.

Endpoint tests sent to custom targets (whether public or private) require bandwidth. A high number of endpoint agents sending synthetic traffic to a custom target can generate network throughput high enough to negatively impact custom target performance.

Before selecting a custom target for a default endpoint test, we recommend using the traffic calculator to estimate peak throughput. Use that estimate to ensure your network and server have the capacity to handle peak throughput. You can also use mitigation strategies described below to attempt to reduce peak throughput.

Estimated peak throughput of test traffic is an estimate of the upper limit of bandwidth required in the event that the default test runs for all endpoint agents at at the same time. At the default test interval of 1 minute, actual test throughput will be at or near estimated peak throughput. At higher test intervals, actual test throughput may not be as high as estimated peak throughput, but this is not guaranteed.

Estimated peak throughput = A x N

• A = Agent throughput for a single test (in KB/s). Peak throughput is 1 KB/s per endpoint agent.
• N = Number of endpoint agents, assuming one synthetic test per agent to the same custom target. By default, all endpoint agents are included in the default test.

Consult with internal teams (IT, network, or firewall administrators) to compare the results to your network and server capacity to ensure that your systems can withstand the load.

Note

Estimated Peak Throughput Calculation Example

A = 1 KB/s

N = 1000 agents

Peak throughput: A x N = 1,000 KB/s (1 MB/s)

Follow these strategies to mitigate default test throughput that exceeds your available bandwidth.

• Change the default test target (RAVPN, Zero Trust Access, or SWG remote module) or custom target that is more capable of managing the load.
• Increasing the test interval may mitigate impact on your network. At the default test interval of 1 minute, actual throughput will be at or near estimated peak throughput. Increasing the interval will likely redistribute the tests over the longer interval.

  Note

  It is not possible to predict actual throughput at test intervals greater than 1 minute. In the worst case scenario, if all endpoint agent tests run at the same time (for example, at minute 30 of a 30-minute test interval), they would still generate actual throughput at or near estimated peak throughput.

• Increase the capacity of your backhauling infrastructure.
  • If using IPsec tunnels, provision traffic backhauling over your edge infrastructure that is capable of handling increased traffic load.
  • If using resource connectors, add additional connectors to resource connector groups to increase the ability to handle the traffic load.

If your system crashes or becomes unavailable due to high traffic sent to a custom target, do the following:

• For public targets: The SaaS provider may block traffic that is sent from Cisco IP addresses. The traffic may mimic the characteristics of a distributed denial-of-service (DDoS) attack, potentially disrupting legitimate user access by overloading system resources. Contact Cisco support.
• For private targets: Seek assistance from your IT or network administration team.

HTTP server tests measure the response time and generate the response code of a web server. They are compatible with VPN and ZTA destinations.

Network synthetic tests measure the network performance and path between an agent and its target destination. They are compatible with VPN destinations. The destination can be an IP address or a domain name.