SAAS breakout

SAAS apps can be configured via the SAAS apps page. This is a selection from the nDPI apps. The user is given the flexibility to determine which app can be trusted or not. Once configured any application designated as a SAAS app, when detected is sent via the SAAS breakout gateway.

Internet breakout and SAAS breakout can share the same interfaces. SAAS breakout can be created only using interfaces designated as WAN.

*Please note nDPI detection can happen for the first packet or later in the flow, but deciding a gateway or interface can happen only if the application determination can be made from the first packet. As nDPI is only for internet applications maintaining the flow is very important so as to not break the NAT connections. First packet application detection can only have from an IP database. For example a TLS application flow can be detected after about 11 packets. So here packet redirection will not work even though the app was detected later on.

Deployment Methods

Local Internet breakout in a standalone deployment

Local Internet breakout with Shared WAN Interfaces for Branch Traffic to DC / Branch

Separate WAN Interfaces for Internet and Tunnel Traffic

Internet breakout via DC, with local SAAS Breakout on shared WAN interfaces

Internet breakout via DC, with local SAAS Breakout on separate WAN interfaces

Configuration Parameters

Add a Load Balancer gateway

Edit a Load Balancer gateway

View the branch subnets configured for a single branch

View the Load Balancer gateways

Configure the Load Balancer

Spillover or Dynamic Rebalancing Configuration

Configure SAAS apps

Tunnel Breakout Configuration

Advanced

For troubleshooting purposes, when failures or routing updates are not being acted upon, the Load Balancer link monitor can be restarted. Please note that this operation will result in a momentary loss of branch and internet connecitivity from the LAN. This is an alternative to rebooting the Edge Controller itself

Use Cases:

To classify and steer traffic over dedicated links.

Known Limitations:

• Editing the remote LAN is not supported
• The number of gateways supported depends on the underlying hardware