If Teams is critical for you then you should move it from real-time to critical.
As with overriding (interfering is a better word) BIO rules through route policies, you can place Teams in a different QoS class than what is in the BIO definition. This is done much in the same way as a route policy. In a template add a QoS policy element and create a rule to match Teams and add the preferred class, i.e. Class 1, which is the default class for Real time. That will move the Teams traffic into the Real time QoS class despite being handled by the Critical BIO.
Original Message:
Sent: May 05, 2025 12:46 PM
From: anibalonnis
Subject: Blocking traffic on satellite fallback links
Hello Jan-Willem,
And thanks for your answer. We already have a similar setup, with critical BIO having satellite links as backup. However, what we define as critical does not match what we want to keep in case all main lines go down -e.g. we might want to keep Teams active, but that is not part of our critical BIO.
I can see we could create another BIO which comes above everything else and apply this policy-I am not sure we want to have the same QoS settings applied to all such traffic though, not even the same lines as default path, but this sounds like the right direction.
Thanks again for the advice,
Original Message:
Sent: 5/1/2025 4:10:00 AM
From: Jan-Willem Keinke
Subject: RE: Blocking traffic on satellite fallback links
Hi Anibal,
In the case of two links and two edgeconnect appliances, I am assuming you have an EdgeHA setup where each appliance has a physical connection to only one of the two links. In such a setup, the active appliance will have a logical connection to the 2nd link that is physically connected to the standby unit. Lets give that the label "SAT" here and the link connected to the primary unit "INET1"
In your BIO setup configure the Critical BIO (one of the default BIO's) so that traffic uses INET1 as primary and SAT as backup. All other BIO's should only have INET1 as transport and no backup configured. Make sure you set that up on the SD-WAN and Breakout tabs of the BIO configuration
If your INET1 or primary Edgeconnect goes down, traffic in the Critical BIO will use SAT as the outbound link. Traffic for other BIO's will be dropped.
Avoid configuring Route Policies yourself (not talking about IP routing here!) as Route Polices are the underlying mechanisms for BIO's and can interfere with what is more elegantly done via BIO's
Original Message:
Sent: Apr 30, 2025 01:35 PM
From: anibalonnis
Subject: Blocking traffic on satellite fallback links
Hello Herman,
Thanks for your answer. We already have an SDWAN-based network using Edge Connect appliances, with a mix of smaller and larger appliances (EC-M-H, EC-XS, EC-XL-H, EC-1014 and a few others). Current version is 9.4.3.2_99572.
Assuming 2 SilverPeaks with one line each -one main, one backup only to be used if the primary one fails- I can more or less configure floating routes in the 2nd box and filter traffic with an ACL to avoid unnecessary traffic going through. But I am not sure how to do it if we have two lines in a single box.
//Anibal
Original Message:
Sent: 4/30/2025 2:37:00 AM
From: Herman Robers
Subject: RE: Blocking traffic on satellite fallback links
What is the technology that you have deployed for your SD-WAN? Is the EdgeConnect (Silver Peak)? Or Central/ArubaOS SD-Branch? Or something else? Or are you looking what to deploy?
If you are looking what to deploy, it may be best to work with your local HPE Aruba Networking account team to discuss the options and find the best option for you.
If you have made the technology decision already, please share the equipment, version, etc.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
Original Message:
Sent: Apr 29, 2025 04:30 PM
From: anibalonnis
Subject: Blocking traffic on satellite fallback links
Hello,
we are deploying satellite links as a last resort in case all other links fail. Our BIOS fallback to these in case the main links go down.
However, since satellite links have a data cap, we don't really want to send all traffic over them -only some critical apps.
Our intention is to use a route map to drop unwanted traffic, but the ACL matching traffic for each BIOS is probably not the best place as traffic will always be allowed -before the fallback to backup lines.
Has anyone configured a similar setup before? The goal is to have some lines as backup but limit the traffic that might go over them.
Thanks,
//Anibal