Optimization Policies Tab

Configuration > Templates & Policies > Policies > Optimization Policies

The Optimization Policies tab displays the Optimization policy entries that exist on the appliances. This includes the appliance-based defaults, entries applied manually (via the Appliance Manager or CLI), and entries that result from applying an Orchestrator Optimization Policy template or Business Intent Overlay.

Use the Templates tab to create and manage Optimization policies, or click the edit icon to manage Optimization policies directly for a particular appliance.

Priority

If you are using Orchestrator templates to add rules, Orchestrator will delete all entries from 1000 – 9999 before applying its policies.
You can create rules with higher priority than Orchestrator rules (1 – 999) and rules with lower priority (10000 – 19999 and 25000 – 65534).

NOTE: The priority range from 20000 to 24999 is reserved for Orchestrator.
When adding a rule, the priority is incremented by 10 from the previous rule. The priority can be changed, but this default behavior helps to ensure you can insert new rules without having to change subsequent priorities.

Match Criteria

These are universal across all policy maps—Route, QoS, Optimization, NAT (Network Address Translation), and Security.
If you expect to use the same match criteria in different maps, you can create an ACL (Access Control List), which is a named, reusable set of rules. For efficiency, create them in Configuration > Templates & Policies > ACLs > Access Lists, and apply them across appliances.
The available parameters are Application, Address Map (for sorting by country, IP address owner, or SaaS application), Domain, Geo Location, Interface, Protocol, DSCP, IP/Subnet, Port, Traffic Behavior Overlay, Fabric or Internet, and User Role (the User Role as specified in the authentication exchange with the ClearPass RADIUS server).

NOTE: User Role options include the RADIUS User Role, User Name, User Group, User Device, or User MAC. Configuring User Role match criteria enables an EdgeConnect to automatically assign traffic steering and firewall zone policies.
To specify different criteria for inbound versus outbound traffic, select the Source:Dest check box.

NOTE: Source and destination role-based policies can be configured when both source and destination users are in the same network.

Source or Destination

An IP address can specify a subnet; for example, 10.10.10.0/24 (IPv4) or fe80::204:23ff:fed8:4ba2/64 (IPv6).
To allow any IP address, use 0.0.0.0/0 (IPv4) or ::/0 (IPv6).
Ports are available only for the protocols tcp, udp, and tcp/udp.
To allow any port, use 0.

Wildcard-based Prefix Matching Rules

Even when using a range or a wildcard, the IPv4 address must be specified in the 4-octet format, separated by the dot notation. For example, A.B.C.D.
Range is specified using a single dash. For example, 128-129.
Wildcard is specified as an asterisk (*).
Range and Wildcard can both be used in the same address, but an octet can only contain one or the other. For example, 10.136-137.*.64-95.
A wildcard can only be used to define an entire octet. For example, 10.13*.*.64-95 is not supported. Use 10.130-139.*.64-95 to specify this range.
The same rules apply to IPv6 addressing.
CIDR notation and (Range or Wildcard) are mutually exclusive in the same address. For example, 192.168.0.1-127/24 is not supported. Use either 192.168.0.0/24 or 192.168.0.1-127.
These prefix-matching rules apply to the following policies only: Route, QoS, Optimization, NAT, Security, and ACLs.

Set Actions

Set Action	Description
Network Memory	Addresses limited bandwidth. This technology uses advanced fingerprinting algorithms to examine all incoming and outgoing WAN traffic. Network Memory localizes information and transmits only modifications between locations. Maximize Reduction – Optimizes for maximum data reduction at the potential cost of slightly lower throughput and/or some increase in latency. It is appropriate for bulk data transfers such as file transfers and FTP, where bandwidth savings are the primary concern. Minimize Latency – Ensures that Network Memory processing adds no latency. This might come at the cost of lower data reduction. It is appropriate for extremely latency-sensitive interactive or transactional traffic. It is also appropriate when the primary objective is to fully utilize the WAN pipe to increase the LAN-side throughput, as opposed to conserving WAN bandwidth. Balanced – Is the default setting. It dynamically balances latency and data reduction objectives and is the best choice for most traffic types. Disabled – Turns off Network Memory.
IP Header Compression	Process of compressing excess protocol headers before transmitting them on a link and uncompressing them to their original state at the other end. It is possible to compress the protocol headers due to the redundancy in header fields of the same packet, as well as in consecutive packets of a packet stream.
Payload Compression	Uses algorithms to identify relatively short byte sequences that are repeated frequently. These are then replaced with shorter segments of code to reduce the size of transmitted data. Simple algorithms can find repeated bytes within a single packet; more sophisticated algorithms can find duplication across packets and even across flows.
TCP Acceleration	Uses techniques such as selective acknowledgments, window scaling, and maximum segment size adjustment to mitigate poor performance on high-latency links. NOTE: The slow LAN alert goes off when the loss has fallen below 80% of the specified value configured in the TCP Accel Options dialog box. For more information, see TCP Acceleration Options.
Protocol Acceleration	Provides explicit configuration for optimizing SSL, SRDF, Citrix, and iSCSI protocols. In a network environment, it is possible that not every appliance has the same optimization configurations enabled. Therefore, the site that initiates the flow (the client) determines the state of the protocol-specific optimization.

TCP Acceleration Options

TCP acceleration uses techniques such as selective acknowledgment, window scaling, and message segment size adjustment to compensate for poor performance on high latency links.

This feature has a set of advanced options with default values.

CAUTION: Because changing these settings can affect service, it is recommended that you do not modify these without direction from Support.

TCP Acceleration Options

Option	Description
Adjust MSS to Tunnel MTU	Limits the TCP MSS (Maximum Segment Size) advertised by the end hosts in the SYN segment to a value derived from the Tunnel MTU (Maximum Transmission Unit). This is TCP MSS = Tunnel MTU – Tunnel Packet Overhead. This feature is enabled by default so that the maximum value of the end host MSS is always coupled to the Tunnel MSS. If the end host MSS is smaller than the tunnel MSS, the end host MSS is used instead. A use case for disabling this feature is when the end host uses Jumbo frames.
Auto Reset Flows	NOTE: Whether this feature is enabled or not, the default behavior when a tunnel goes Down is to automatically reset the flows. If enabled, it resets all TCP flows that are not accelerated, but should be (based on policy and on internal criteria like a Tunnel Up event). The internal criteria can also include: Resetting all TCP accelerated flows on a Tunnel Down event. Resetting TCP acceleration is enabled. SYN packet was not seen (so this flow was either part of WCCP redirection or it already existed when the appliance was inserted in the data path).
Enable TCP SYN option exchange	Controls whether or not the proprietary TCP SYN option is forwarded on the LAN side. Enabled by default, this feature detects if there are more than two EdgeConnect appliances in the flow’s data path, and optimizes accordingly. Disable this feature if there is a LAN-side firewall or a third-party appliance that would drop a SYN packet when it encounters an unfamiliar TCP option.
End to End FIN Handling	This feature helps to fine tune TCP behavior during a connection’s graceful shutdown event. When this feature is ON (Default), TCP on the local appliance synchronizes this graceful shutdown of the local LAN side with the LAN side of the remote appliance. When this feature is OFF (Default TCP), no such synchronization happens and the two LAN segments at the ends gracefully shut down, independently.
IP Block Listing	If selected, and if the appliance does not receive a TCP SYN-ACK from the remote end within five seconds, the flow proceeds without acceleration and the destination IP address is blocked for one minute.
Keep Alive Timer	Allows changing the Keep Alive timer for the TCP connections. Probe Interval – Time interval in seconds between two consecutive Keep Alive probes. Probe Count – Maximum number of Keep Alive probes to send. First Timeout (Idle) – Time interval until the first Keep Alive timeout.
LAN Side Window Scale Factor Clamp	This setting allows the appliance to present an artificially lowered Window Scale Factor (WSF) to the end host. This reduces the need for memory in scenarios in which there are many out-of-order packets being received from the LAN side. These out-of-order packets cause much buffer utilization and maintenance.
Per-Flow Buffer	(Max LAN to WAN Buffer and Max WAN to LAN Buffer) This setting clamps the maximum buffer space that can be allocated to a flow, in each direction.
Persist timer Timeout	Allows the TCP to terminate connections that are in Persist timeout stage after the configured number of seconds.
Preserve Packet Boundaries	Preserves the packet boundaries end-to-end. If this feature is disabled, the appliances in the path can coalesce consecutive packets of a flow to use bandwidth more efficiently. It is enabled by default so that applications requiring packet boundaries to match do not fail.
Route Policy Override	Tries to override asymmetric route policy settings. It emulates auto-opt behavior by using the same tunnel for the returning SYN+ACK as it did for the original SYN packet. Disable this feature if the asymmetric route policy setting is necessary to correctly route packets. In this case, you might need to configure flow redirection to ensure optimization of TCP flows.
Slow LAN Defense	Resets all flows that consume a disproportionate amount of buffer and have a very slow throughput on the LAN side. Owing to a few slower end hosts or a lossy LAN, these flows affect the performance of all other flows so that no flows see the customary throughput improvement gained through TCP acceleration. This feature is enabled by default. The number relates indirectly to the amount of time the system waits before resetting such slow flows.
Slow LAN Window Penalty	This setting (OFF by default) penalizes flows that are slow to send data on the LAN side by artificially reducing their TCP receive window. This causes less data to be received and helps to reach a balance with the data sending rate on the LAN side.
WAN Congestion Control	Selects the internal Congestion Control parameter: Optimized – This is the default setting. This mode offers optimized performance in almost all scenarios. Standard – In some unique cases, it might be necessary to downgrade to Standard performance to better interoperate with other flows on the WAN link. Aggressive – Provides aggressive performance and should be used with caution. Recommended mostly for Data Replication scenarios.
WAN Window Scale	This is the WAN-side TCP Window scale factor that is used internally for WAN-side traffic. This is independent of the WAN-side factor advertised by the end hosts.

Optimization Policies Edit Row

Use the Templates tab to create and manage Optimization policies, or click the edit icon to directly manage Optimization policies for a particular appliance.