Monitor Your WAN Edge Devices

From the left menu, select WAN Edges > WAN Edges to view basic device monitoring information. Notice the organization name at the top of the portal. This is the largest container and represents your entire organization. Beneath the organization name, you can see your site devices in either a List format or a graphical Topology format.

The tiles across the top provide high-level information:

• Config Success—Percentage of online WAN edges with successful configuration.
• Version Compliance—Percentage of WAN edges that have the same software version per model.
• WAN Edge Uptime—Percentage of time a WAN edge was up during the past seven days, averaged across all WAN edges.

• Potential Anomalies—Percentage of WAN Edges that currently have no potential anomalies detected by Marvis.

  • If none of the WAN Edges have potential anomalies, the percentage is 100%.

  • If some WAN Edges have anomalies, the value decreases in proportion to how many are affected. For example, if a site has 10 WAN Edges and 2 of them have anomalies, the percentage is 80%.

  If the percentage is less than 100%, you can click Potential Anomalies to view the WAN Edges that have anomalies. Each affected WAN Edge has a Troubleshoot button that opens the conversational assistant with a pre-filled prompt (for example, “Troubleshoot <device> for last 7 days”), enabling you to view the detected anomalies without manually starting a troubleshooting session.

The WAN Edge list view contains columns with device detail information, as shown in Table 1.

Table 1: WAN Edges List View (Columns)

Fields	Description
Name	Name of the WAN Edge device
Status	Connected or disconnected
MAC	MAC address
IP Address	IP address
Model	Juniper Networks® SRX Series Firewall or Juniper® Session Smart™ Router model.
Version	SRX or SSR Software Version
Topology	Hub or Spoke
Insights	Provides a direct link to the WAN Edge Insights page.

The Topology format presents the same information as the List view when you hover over the device name. Hover your mouse or click on the device name to get more detailed information in the topology view.

On both the List and Topology view, selecting your WAN edge device brings you to its Device Information page. The Device Information page provides different categories of monitoring information for your WAN edge device.

The first thing you’ll notice on the Device Information Page are details about the WAN Edge device you selected. The information includes a graphical front view of the device ports and baseline status information such as CPU and memory utilization.

For each Gigabit Ethernet interface, you’ll find link information. Hover your mouse over an interface to see more information.

Table 2: Link Information for Gigabit Ethernet Interface

Fields	Description
Speed	Rated speed
PoE Operation Status	Enabled or disabled
Power Draw (SRX Only)	Measured PoE power draw
Duplex	Full or half
STP	True or false
BPS	Bits/second
Profile	The name of the Port profile assigned to the port
Port Mode	The mode of the port profile configuration (Trunk, Access, Port Network, or VoIP Network)
VLAN	VLAN tag
Description	Interface description

The CPU, Memory, and other status icons indicate how your device behaves. Hover over each status icon for deeper insights. The status icons you see depend on if the WAN Edge device you are looking at is an SRX or SSR.

Advanced Security information is listed below the device ports with a check mark or an X, indicating whether URL filtering, intrusion detection and prevention (IDP), AppSecure (for application visibility), and other security features are active on this device. In Figure 8, AppSecure is active with the green check mark.

Below the Advanced security section, you’ll find generalized platform-related data for your WAN edge device in the Properties section, including:

Table 3: WAN Edge Platform-Related Details

Field	Description
Insights	Provides a direct link to WAN Edge Insights.
Location	Provides floorplan information.
MAC Address	MAC Address for the WAN Edge device.
Model	Indicates the SSR or SRX model.
Version	Version of SSR or SRX Software the device is running.
Template	The WAN Edge template applied to the device.
Hub Profile	The Hub Profile applied to the device.

Statistics displays action information about your platform.

Table 4: WAN Edge Device Statistics

Field	Description
Status	Connected/Disconnected
IP Address	The IP address of the WAN edge device
Uptime	Day/Hour/Min uptime information
Last Seen	Last login
Last Config	Last Commit
Last Disconnect Reason	Reason for the most recent disconnection for the device.
WAN Edge Photos	Photos of the WAN edge device

If you configured DHCP servers on the WAN router itself, there will also be a DHCP Statistics section with information about the leased IPs. This section presents IP information related to dynamic distributed IP addresses.

Table 5: WAN Edge Device DHCP Statistics

Field	Description
Usage	The total percentage of Leased and Available IPs.
Pool Name	The name for given pool of addresses.
Leased IPs	The number of used IP addresses in each pool.
Total IPs	The total number of available IP addresses in each pool.

In the Application Visibility (SRX Only) section, you can enable application visibility for the device, which allows the Mist cloud to track and report applications that pass through the device. If the device has an App Track license, the license is used to collect data for monitoring applications and service levels.

Table 6: WAN Edge Device Application Visibility (SRX Only)

Field	Description
Device has an App Track license	Application Visibility is already enabled on the device.
Device does NOT have an App Track license	The device does not have an application security license.
Use site setting for App Track license	Application visibility is enabled under Organization > Admin > Site Configuration > WAN Edge Advanced Security.

The Speed Tests section (SSR Only) appears only if you have run speed tests on your SSR WAN Edge device. This Speed Tests tool is used to test the speed of the WAN links on your WAN Edge devices to ensure optimal performance. This section displays the results of any speed tests you have run on your SSR WAN Edge device.

Table 7: Speed Tests

Fields	Description
Run Start Time	The time the test was started.
Type	Who performed the test (User or Scheduled).
Progress	In Progress, Succeeded, or Failed.
Download	Download speed in megabits per second (Mbps).
Upload	Upload speed in megabits per second (Mbps).
Interface	The interface of the WAN Edge device that the speed test was performed on.
VLAN	Displays the VLAN ID number.

The Connectivity Tests (SRX Only) section is what displays if you have run connectivity tests on your SRX Series Firewalls to test WAN link performance. This section displays the results of any connectivity tests you have run.

Table 8: Connectivity Tests

Fields	Description
Run Start Time	The time the connectivity test was started.
Type	Who performed the test (User or Scheduled).
Test	The type of test (Example: Ping or Traceroute).
Progress	In Progress, Succeeded, or Failed.
Source Network	The source of the traffic.
App Policy	The application policy the traffic is following to reach its destination.
Application	The application that is trying to be accessed over the link (the destination of traffic).
Latency	The latency on the WAN link in milliseconds (ms).
Loss	The loss on the WAN link displayed in percentage.
Hops	Hop count
Details	Click the View link to see more detailed information about the connectivity test that was performed.

Topology Details displays Peer Path information. When two Session Smart Routers are peered together, they send traffic to one another using Secure Vector Routing (SVR). The peer paths constructed between SSR peers are what generates and constructs the Session Smart SD-WAN network overlay. SSR peers establish and maintain connectivity to one another using Bi-directional Forwarding Detection (BFD).

Table 9: Topology Details

Fields	Description
Interface Name	Name
Neighborhood	The neighborhood that this router and its peer belong to. In Session Smart networking, a Neighborhood is a connected Layer 3 network that constructs the peering connection between SSRs.
Topology Type	The topology type of the neighborhood that the peer SSRs belong to. The topology type allows the Session Smart Conductor to distribute configuration to the routers in the neighborhood.
Peer Name	The name of the peer SSR.
Status	Indicates in the peer path is up or down.
Uptime	Time live
Latency	The latency on the peer path.
Loss	The packet loss as a percentage.
Jitter	The jitter on the peer path.
MTU	Maximum Transmission Unit
Hop Count	How many hops (routers) a packet passes through before reaching its destination.

If you have Secure Edge Connectors configured, you will see the Secure Edge Connector Details section, which includes tunnel information from your WAN Edge connection to the Secure Edge cloud.

Table 10: Secure Edge Connector Details

Fields	Description
Tunnel Name	Name
Peer Host	The IP address or hostname of the peer
Peer IP	IP address of the peer
Status	Connected/Disconnected
Node	Standalone/HA
RX Bytes	Volume of data, in bytes, received by the interface.
TX Bytes	Volume of data, in bytes, transmitted by the interface.
RX Packets	Packets received by the interface.
TX Packets	Packets transmitted by the interface.
Last Event	System events
Protocol	Transport protocol the tunnel is using (Example: IPsec or GRE).
Uptime	Time live
Priority	Primary/Secondary
WAN Port	The port the tunnel is using.
Last Seen	Last login

Scrolling down on the Device Information page, configuration information displays for your WAN Edge. Usually, WAN Edge devices inherit WAN Edge Templates or Hub Profiles. However, you can make changes at the device level to have the configuration be pushed to only that device. In this example, a "standalone" WAN Edge Template was used.

Table 11: WAN Edge Configuration: Standalone

Section	Description
Info	The name of the device and Notes about the device.
IP Configuration (Out of Band)	For each node of the device, select DHCP or Static for the IP address and enter a VLAN ID.
NTP	Time Servers IP/Hostnames (you can enter comma-separated IP addresses or hostnames).
IP Configuration (In Band)	For each node of the device, select DHCP or Static for the IP address and enter a VLAN ID.
DNS Settings	DNS Servers, DNS Suffix (SRX Only).
Syslog	Select the checkbox to enable Syslog (system logging).

The Secure Edge Connectors section is where you can configure providers for your Secure Service Edge (SSE) deployments. These connectors facilitate seamless integration for such deployments.

Scrolling past the configuration, you’ll find information for your connected WANs and LANs.

Table 12: WAN Details

Field	Description
Name	Selected WAN Interface Name
Interface	Supports one of these interfaces for aggregation: ge-0/0/1, ge-0/0/1-5, or reth0.
WAN Type	Ethernet, DSL (SRX Only), or LTE
IP Configuration	DHCP, Static, or PPPoE
Enabled	The blue checkmark indicates that the interface is enabled.
Overlay Hub Endpoints	SVR Peer connections to the Hub
Overlay Mesh Endpoints (SSR Only)	SVR Peer connections to the mesh

Table 13: LAN Details

Section	Description
IP Config	Network name, IP Address, Gateway Address (SSR Only).
DHCP Config	Enabled or Disabled. If Enabled, select a Network, then select Server or Relay as the DHCP config.
Custom VR	A virtual router that you can configure to be used in automatic route leaking.
LANs	Interface—Supports one of these interfaces for aggregation: ge-0/0/1, ge-0/0/1-5, or reth0. Networks—Networks that participate in the LAN. Untagged VLAN Network—Untagged VLAN networks that participate in the LAN (SRX only). Enabled—Check mark in the section on the device page indicates that the interface is enabled.

Scrolling down, you have sections for Traffic Steering, Application Policies, and Routing (OSPF, BGP, Routing Policies, and Static Routes).

The Traffic Steering and Application Policies sections show how you use the WAN Edge device to create rules for traffic to take so that you can assert path preference and routing behavior.

Note:

For SRX Series Firewalls deployed as a WAN Edge, the Application Policy and Traffic Steering path determine destination zones and must be assigned.

Traffic Steering enables you to define different paths that traffic can take to reach its destination. Traffic Steering policies allow you to specify the paths for traffic to traverse, as well as the strategies for utilizing those paths.

Table 14: Traffic Steering

Field	Description
Name	The name of the Traffic Steering policy.
Strategy	Ordered, Weighted, ECMP.
Paths	LAN, WAN, Secure Edge Connector.

Application Policies are security policies in the Juniper WAN Assurance design, where you define which network and users can access which applications, and you assign a traffic steering path which those networks or users will use to access the application or destination. These elements become matching criteria to allow access to or block access from applications or destinations.

In the Juniper Mist™ cloud portal, the Applications tab of the Application Policies section lets you configure a policy for traffic to or from the WAN Edge device.

Network/User setting determines the source zone. The Application/Destination and Traffic Steering settings determine the destination zone.

Note: Traffic Steering paths determine the destination zone in SRX Series Firewalls deployed as WAN Edges, so ensure that you assign Traffic Steering profiles to the Application Policies. See Order of Traffic Steering Rules.

Table 15: Application Policies

Field	Description
Number	Ordered Policy Number
Name	Application policy name
Org Imported	Indicates if the policy was pushed down from the Organization level to the Site.
Network/User (Matching Any)	The “source” of your traffic
Action	Allow or Block
Application/Destination (Matching Any)	The “destination” for your traffic.
IDP	Indicates IDP/URL filtering (requires separate license)
Enable Syslog (SSR Only)	Select the checkbox to enable system logging (SSR Only).
Advanced Security Services	Add Anti-Virus, SSL Proxy (SRX Only), Security Intel (SRX Only), Anti-Malware (SRX Only), DNS Tunnel Detection, Domain Generation Algorithm, IoT Device Policy, and HTTP Inspection.
Traffic Steering	Indicates the path for traffic to take to reach the destination.
Hit Count	Indicates the number of times an application policy rule has been triggered (matched) by traffic.

The Device in tab can be used for applications that require inbound ICMP traffic. Configure a policy to allow ICMP traffic from a remote network to the WAN Edge device. Under Network / User choose the remote network that is the source of the ICMP traffic, and then ICMP for the Destination

In the Device out tab, configure a policy for how traffic leaves the device. For example, you can set a traffic steering policy that states the device can only access the Mist cloud using a cellular network instead of your default link.

Scrolling down the page, use the OSPF Areas section to configure Open Shortest Path First (OSPF) on your WAN Edges, which is used to determine the best path for forwarding IP packets. OSPF segments a network to improve scalability and control the flow of routing information. See OSPF .

Table 16: Routing: OSPF Areas and OSPF Configuration

Field	Description
Area	The identification area that your OSPF network or WAN Edge device belongs to.
Type	This is the OSPF Area type. Select Default (Area 0), Stub, or Not So Stubby Area (NSSA).
Networks	The name of your OSPF network.
Enabled	Selecting this check box causes the Enable OSPF Areas button to become selectable. Then click the button to select the Area to enable.

You can configure Border Gateway Protocol (BGP) for your WAN Edge devices in the BGP section. You would configure BGP on your device by clicking Add BGP Group here.

Table 17: Routing: BGP

Field	Description
Name	BGP Name
Peering Network	The type of network being used for your BGP peering (WAN or LAN).
Type	Type of BGP Route (Internal or External).
Local AS	Autonomous System Number
Export	Export Route
Import	Import Route
Neighbors	Neighbor Route
Neighbor AS	Autonomous System Number for Neighbor Route

The Routing Policies section enables you to configure path preference and allows you to determine traffic behavior.

Table 18: Routing: Routing Policies

Field	Description
Name	The name of your routing policy.
Terms	These are the policy conditions such as prefix, routing protocol, and actions.

The Static Routes section allows you to manually define the routes that your WAN edge device will use.

Table 19: Routing: Static Routes

Field	Description
Name	The name of your static route.
Gateway	The gateway that your static route will use when routing traffic.

• WAN Edge Insights
• Applications
• WAN Edge Insights - Application Path Insights (BETA)
• WAN Edge Insights - WAN Edge Device Charts
• WAN Edge Insights - WAN Edge Ports

This section provides insights into the health of WAN peer and overlay paths. In Juniper Mist WAN Assurance, WAN edge devices use probes to monitor the performance of WAN paths between edge devices. These insights include live graphs of jitter, latency, loss, and mean opinion score (MOS).

Probe Stats with SRX Series Firewalls: The SRX Series Firewalls used as WAN edge devices in Juniper Mist™ WAN Assurance provide underlay path insights. Real-time performance monitoring (RPM) probes are configured in the underlay path to generate performance metrics such as latency, jitter, and loss. These probes send periodic ICMP echo requests to target addresses at set intervals and measure response times to calculate latency, jitter, and packet loss.

Probe Stats with SSR Series Routers: The Session Smart WAN edge devices deployed in Juniper Mist™ WAN Assurance provide liveness and overlay-path quality insights using Secure Vector Routing (SVR). SSR Series Routers use Bidirectional Forwarding Detection (BFD) on port 1280 to check liveness with downstream SSR Series Routers and to monitor jitter, latency, loss, and Mean opinion score (MOS). This insight is applicable only for SSR Series Routers. SSR Series Routers also use ICMP probes to monitor these metrics on the underlay paths.

This section consists of the following tabs:

• WAN Probes

  This tab shows live graphs of the following network performance metrics from configured real-time ICMP probes:

  • Latency chart displays round-trip time (RTT) values in milliseconds (ms) with the timestamps. It also shows the average WAN probe value. The chart highlights overall latency stability (for example, sudden spikes) on the WAN path.

  • Loss chart displays the overall packet loss as a percentage.

  • Jitter chart displays the difference between the maximum and minimum round-trip times (RTT) measured over the course of time.

  Figure 45: WAN Probes Statistics

• Worst 3 Overlay Paths

  This tab shows the three worst peer connections with the least metric values. The following network performance metrics are shown as live graphs:

  • Latency chart displays round-trip time (RTT) values in milliseconds (ms) with the timestamps. It also shows the average WAN probe value. The chart highlights overall latency stability (for example, sudden spikes) on the WAN path.

  • Loss chart displays the overall packet loss as a percentage.

  • Jitter chart displays the difference between the maximum and minimum round-trip times (RTT) measured over the course of time.

  • MOS chart displays the quality of the paths on a rating scale from 1 to 4. Higher rating indicates better path quality.

    Note: If a Secure Edge Connector is configured and the probe IP and source addresses are added, the above-mentioned live graphs show data related to the Secure Edge connector.

• Overlay Paths

  This tab shows the performance of the selected overlay path between the WAN edge devices. The following network performance metrics are shown as live graphs:

  • Latency chart displays round-trip time (RTT) values in milliseconds (ms) with the timestamps. It also shows the average WAN probe value. The chart highlights overall latency stability (for example, sudden spikes) on the WAN path.

  • Loss chart displays the overall packet loss as a percentage.

  • Jitter chart displays the difference between the maximum and minimum round-trip times (RTT) measured over the course of time.

  • MOS chart displays the quality of the paths on a rating scale from 1 to 4. Higher rating indicates better path quality.

    Note: If a Secure Edge Connector is configured and the probe IP and source addresses are added, the above-mentioned live graphs show data related to the Secure Edge connector.
    Figure 46: Overlay Paths Statistics

The final section of WAN Edge Insights page is Current WAN Edge Properties. Time range selections do not impact information in the Current Values pane.

In Juniper Mist, alerts present network and device issues that are ongoing. You can view alerts on the Juniper Mist portal by navigating to the left menu of the portal, then selecting Monitor > Alerts.

You can set up alerts and email updates for when certain ports on a WAN Edge device go online or offline. To configure alerts for specific ports, you need to label these ports in the LAN or WAN settings of a WAN Edge device.

To configure the alerts and notifications for specific ports, you must:

• Change the WAN or LAN settings to label the specified ports in the WAN Edge template or at device-level configuration page.
  1. In the Juniper Mist portal, select Organization > WAN > WAN Edge Templates and select the WAN or LAN configuration that you want to update (or add a new configuration).

     To configure this at the device-level, select WAN Edges > WAN Edges from the left menu, then select the WAN or LAN configuration of the selected device.

  2. In the Interface field, enter the port or ports, and then select the Enable “Up/Down Port” Alert Type checkbox.
     Figure 48: Marking LAN Port or WAN Interface as Critical Interface

     Repeat these steps for all critical ports. Click Save when you are done with each port.

• Configure alerts and e-mail notifications for the specified ports on the Alerts page.
  1. Go to Monitor > Alerts > Alerts Configuration and use the following check-boxes to enable alerts for the selected port:

     • Critical WAN Edge Port Up

     • Critical WAN Edge Port Down

     Figure 49: Alerts Configuration for Critical Ports

     See Alert Configuration for details.

     When you enable alerts and notifications:

     • You receive an e-mail notification whenever a port transitions from one state to another.
     • You can delay alerts about when the WAN Edge gateway goes offline to prevent repeated alerts in the case of connectivity flaps by clicking the pencil icon and setting a time threshold.
     • You can view the status in the Monitor > Alerts page. Figure 50 shows an example of the critical port status on the Juniper Mist Alerts dashboard.
       Figure 50: Critical WAN Edge Port Status