Identifying which WAN interface particular traffic goes out

[SimonReach]

HI everyone, i've had a look around and googled and gone through guides and i can't seem to find the answer anywhere.

Our main site has 2 WAN connections now, a 200Mb link that most data uses, including all SDWAN traffic to the other sites that we have and VPN traffic from client VPNs coming in and also general internet and office usage.  The 2nd link is 50Mb and i set an SD-WAN policy in the "SD-WAN & Traffic Shaping" screen to put all VoIP and Video Conferencing traffic to prefer WAN2 with failing over if poor performance.

Now how do i confirm that is exactly what is happening, i'd love to be able to go into Traffic Analytics for WAN appliances, click the MS Teams Video application and for it to show me which WAN interface that traffic used but i can't.  I have done a packet capture for the "internet 2" interface and all the traffic is UDP traffic of between 87 and 236 bytes, meaning it does look like VoIP traffic, but i'd ideally like a clearer picture if possible?

[PhilipDAth]

Not the nicest answer, but you could do a packet capture of WAN2.

[Mark_S · Accepted solution]

Hi SimonReach,

Packet captures would be the best option available through dashboard directly.

Otherwise, I would suggest setting up Netflow as this will show the interface plus other information for the flows through the MX.

[cmr]

If the traffic is SD-WAN traffic you can go to the VPN status page and see the decisions down the bottom.  That will show you what is taking which route and why.

[GIdenJoe]

The SD-WAN rules will be followed immediately and you can follow those in the uplink decisions section on the VPN status page just like @cmr already mentioned.  You will need to have an idea what ports are involved to be able to filter that traffic on that page.

For internet bound traffic however you are a bit out of luck.  If you use a high bandwidth application you may see the graphic on the Uplink page on the Appliance status page.

Else you would need to indeed have sensors configured on a separate system for netflow statistics.

[SimonReach]

Thank you everyone for the suggestion, the packet capture was what i used and did prove what i needed to prove.