SD-WAN Internet Policies Configuration

Dashboard Location: Security and SD-WAN > Configure > SD-WAN & Traffic Shaping > Internet Policies

SD-WAN Internet Policies configuration in Meraki appliances provides administrators with comprehensive traffic steering and performance optimization capabilities, enabling intelligent uplink selection, application-aware routing, performance-based failover, and quality of service management. This functionality supports enterprise WAN optimization, business-critical application prioritization, bandwidth management, and network resilience through automated traffic engineering and dynamic path selection based on real-time network conditions.

Example-1: The example below demonstrates SD-WAN internet policies configuration.

This configuration implements intelligent traffic routing and policy-based path selection for SD-WAN connectivity. The example includes application-aware routing, traffic steering rules, and internet breakout policies for optimized WAN performance.

This comprehensive SD-WAN configuration creates sophisticated traffic engineering policies using multiple rule types and performance criteria. The “name” parameter identifies each policy (policy 1, policy 2, policy 3), while “traffic_filters” employ three distinct approaches: “type: custom” for protocol-based filtering with specific port ranges (1-1024) and CIDR blocks, “type: majorApplication” for categorizing major application suites like Office 365 with detailed application metadata including “id”, “name”, and “type: major” classifications, and “type: application” for granular NBAR-based application identification targeting specific services like Rackspace Hosted Exchange and Hotmail with source network targeting (192.168.20.0/24).

Specifically, “policy 1” implements custom traffic classification by matching TCP protocol traffic originating from source ports 1-1024 (covering system and well-known service ports) with unrestricted source CIDR ranges, while allowing traffic to flow to any destination CIDR and port combination. This policy routes matching traffic through the preferred WAN1 uplink with automatic failover to secondary links when “poorPerformance” conditions are detected (such as elevated latency, jitter, or packet loss). The policy applies the builtin “VoIP” performance class, ensuring voice and real-time communication traffic receives priority treatment with optimized jitter buffers, latency guarantees, and packet loss protection.

Similarly, “policy 2” leverages majorApplication filtering to identify and prioritize Office 365 Suite traffic using UDP protocol with source port range 1-1024, applying custom “Radius” performance class for authentication traffic optimization.

Meanwhile, “policy 3” employs granular application-based filtering targeting specific email services (Rackspace Hosted Exchange and Hotmail) from the 192.168.20.0/24 subnet using NBAR (Network-Based Application Recognition) technology for precise application identification and traffic steering with builtin VoIP performance class treatment.

NBAR application IDs can be obtained via /networks/{networkId}/appliance/firewall/l7FirewallRules/applicationCategories API

meraki:
  domains:
    - name: !env domain
      administrator:
        name: !env org_admin
      organizations:
        - name: !env org
          networks:
            - name: !env network_name
              product_types:
                - appliance
                - camera
                - switch
                - wireless
                - cellularGateway
              appliance:
                sdwan_internet_policies:
                  - name: policy 1
                    traffic_filters:
                      - type: custom
                        value:
                          protocol: "tcp"
                          source:
                            port: "1-1024"
                            cidr: "any"
                          destination:
                            port: "any"
                            cidr: "any"
                    preferred_uplink: "wan1"
                    fail_over_criterion: "poorPerformance"
                    performance_class:
                      type: builtin
                      builtin_performance_class_name: VoIP
                  - name: policy 2
                    traffic_filters:
                      - type: majorApplication
                        value:
                          protocol: "udp"
                          source:
                            port: "1-1024"
                            cidr: "any"
                          destination:
                            applications:
                              - id: "meraki:layer7/application/1"
                                name: "Office 365 Suite"
                                type: "major"
                    preferred_uplink: "wan1"
                    fail_over_criterion: "poorPerformance"
                    performance_class:
                      type: custom
                      custom_performance_class_name: Radius
                  - name: policy 3
                    traffic_filters:
                      - type: application
                        value:
                          protocol: "any"
                          source:
                            cidr: "192.168.20.0/24"
                          destination:
                            applications:
                              - id: "meraki:layer7/application/7"
                                name: "Rackspace Hosted Exchange"
                                type: "nbar"
                              - id: "meraki:layer7/application/39"
                                name: "Hotmail"
                                type: "nbar"
                    preferred_uplink: "wan1"
                    fail_over_criterion: "poorPerformance"
                    performance_class:
                      type: builtin
                      builtin_performance_class_name: VoIP