Route Policies Tab
Configuration > Templates & Policies > Policies > Route Policies
TheRoute Policiesreport displays the route policy entries that exist on the appliance(s).
This includes the appliance-based defaults, entries applied manually (via the Appliance Manager or CLI), and entries that result from applying an Orchestrator Route Policies template, or applying Business Intent Overlays (if you are deploying an SD-WAN).
Each appliance’s default behavior is to auto-optimize all IP traffic, automatically directing flows to the appropriate tunnel.Auto-optimizationstrategies reduce the need to create explicit route map entries for optimization. The three strategies provided areTCP-basedauto-opt,IP-basedauto-opt, andsubnet sharing. By default, all three are enabled on theTemplatestab, underSystem.
The Route Policy only requires entries for flows that are to be:
Sent pass-through (shaped or unshaped)
Dropped
Configured for a specific high-availability deployment
Routed based on application, VLAN, DSCP, or ACL (Access Control List)
You might also want to create a Route Policy entry when multiple tunnels exist to the remotepeer, and you want the appliance to dynamically select the best path based on one of these criteria:
Load balancing
Lowest loss
Lowest latency
Specified tunnel
Manage these instances on theTemplatestab, or select theEditicon to manage Routing policies directly for a particular appliance.
If you are deploying an SD-WAN network and setting up Internet breakout from the branch, you must create manual route policy entries for sanctioned SaaS applications or Guest WiFi.
Priority
If you are using Orchestrator templates to add rules, Orchestrator will delete all entries from1000 – 9999之前applying its policies.
You can create rules with higher priority than Orchestrator rules (1 – 999) and rules with lower priority (10000 – 19999and25000 – 65534).
NOTE:The priority range from20000to24999被预留给Orchestrator.
When adding a rule, the priority is incremented by 10 from the previous rule. The priority can be changed, but this default behavior helps to ensure you can insert new rules without having to change subsequent priorities.
Match Criteria
These are universal across all policy maps—Route,QoS,Optimization,NAT(Network Address Translation), andSecurity.
If you expect to use the same match criteria in different maps, you can create anACL(Access Control List), which is a named, reusable set of rules. For efficiency, create them inConfiguration > Templates & Policies > ACLs > Access Lists, and apply them across appliances.
The available parameters areApplication,Address Map(for sorting by country, IP address owner, or SaaS application),Domain,Geo Location,Interface,Protocol,DSCP,IP/Subnet,Port, andTraffic Behavior.
To specify different criteria for inbound versus outbound traffic, select theSource:Destcheck box.
Source or Destination
An IP address can specify a subnet; for example, 10.10.10.0/24 (IPv4) or fe80::204:23ff:fed8:4ba2/64 (IPv6).
To allowany IP address, use 0.0.0.0/0 (IPv4) or ::/0 (IPv6).
Ports are available only for the protocolstcp,udp, andtcp/udp.
To allowany port, use0.
Wildcard-based Prefix Matching
When using a range or a wildcard, the IPv4 address must be specified in the 4-octet format, separated by the dot notation. For example,A.B.C.D.
Range is specified using a dash. For example,128-129.
Wildcard is specified as an asterisk (*).
Range and Wildcard can both be used in the same address, but an octet can only contain one or the other. For example,10.136-137.*.64-95.
A wildcard can only be used to define an entire octet. For example,10.13*.*.64-95is not supported. The correct way to specify this range is10.130-139.*.64-94.
The same rules apply to IPv6 addressing.
CIDR notation and (Range or Wildcard) are mutually exclusive in the same address. For example, use either192.168.0.0/24or192.168.0.1-127.
These prefix-matching rules only apply to the following policies: Router, QoS, Optimization, NAT, Security, and ACLs.