SD-WAN Solutions Resources

Prisma SDWAN Provide Security and Smooth failover or traffic with Application-level monitoring and match SLA

Good question, because "same-IP failover" gets used loosely and not every vendor implements it the same way. Here's the mechanism, at least for how we do it at Bigleaf: your public IP address isn't assigned by your ISP at all — it's issued from our own gateway infrastructure. All of your traffic gets tunneled from your site to the nearest Bigleaf gateway, and that's where it actually connects to the broader internet. Because the IP lives on our side of that tunnel rather than being tied to whichever ISP circuit is currently active, switching circuits during a failure or degradation event doesn't change the IP at all — the tunnel just gets rerouted to a healthier circuit underneath it. From the perspective of a VoIP call, a VPN tunnel, or a cloud app session, nothing happened. On the BGP question specifically: you're right that some vendors' version of this does require you to run your own BGP setup — advertising your own address space, dealing with ISP cooperation, maintaining it going forward. That's real infrastructure and real ongoing complexity, and it's fair to be skeptical of anyone who glosses over that. Our approach is meant to function as an alternative to that, not a repackaging of it — the IP block comes from our infrastructure, so there's no BGP session for you to stand up or maintain, and it applies automatically to whatever's running over the tunnel rather than needing per-application policy configuration. Worth being precise about scope, too: this only covers traffic that's actually running through the tunnel to our gateways. It's not something you bolt onto an existing multi-WAN router as a feature flag — it's a function of the architecture, which is exactly why it's worth actually testing rather than taking as a spec-sheet claim on either side. In practice, this ends up mattering for more than VoIP — VPN tunnels, Microsoft 365 sessions, POS and payment processing connections, and anything else that treats a mid-session IP change as a dropped connection all benefit the same way. Happy to go deeper on any specific failure scenario if it's useful for your evaluation. A couple of resources if you want the longer version: Same-IP Address Failover — the mechanism explained in more depth, including a comparison against dual-WAN and carrier SD-WAN approaches. https://www.bigleaf.net/same-ip-address-failover/ Bigleaf vs. Failover — a closer look at why standard failover setups drop sessions in the first place. https://www.bigleaf.net/blog/bigleaf-vs-failover/

Good question, because "same-IP failover" gets used loosely and not every vendor implements it the same way. Here's the mechanism, at least for how we do it at Bigleaf: your public IP address isn't assigned by your ISP at all — it's issued from our own gateway infrastructure. All of your traffic gets tunneled from your site to the nearest Bigleaf gateway, and that's where it actually connects to the broader internet. Because the IP lives on our side of that tunnel rather than being tied to whichever ISP circuit is currently active, switching circuits during a failure or degradation event doesn't change the IP at all — the tunnel just gets rerouted to a healthier circuit underneath it. From the perspective of a VoIP call, a VPN tunnel, or a cloud app session, nothing happened. On the BGP question specifically: you're right that some vendors' version of this does require you to run your own BGP setup — advertising your own address space, dealing with ISP cooperation, maintaining it going forward. That's real infrastructure and real ongoing complexity, and it's fair to be skeptical of anyone who glosses over that. Our approach is meant to function as an alternative to that, not a repackaging of it — the IP block comes from our infrastructure, so there's no BGP session for you to stand up or maintain, and it applies automatically to whatever's running over the tunnel rather than needing per-application policy configuration. Worth being precise about scope, too: this only covers traffic that's actually running through the tunnel to our gateways. It's not something you bolt onto an existing multi-WAN router as a feature flag — it's a function of the architecture, which is exactly why it's worth actually testing rather than taking as a spec-sheet claim on either side. In practice, this ends up mattering for more than VoIP — VPN tunnels, Microsoft 365 sessions, POS and payment processing connections, and anything else that treats a mid-session IP change as a dropped connection all benefit the same way. Happy to go deeper on any specific failure scenario if it's useful for your evaluation. A couple of resources if you want the longer version: Same-IP Address Failover — the mechanism explained in more depth, including a comparison against dual-WAN and carrier SD-WAN approaches. https://www.bigleaf.net/same-ip-address-failover/ Bigleaf vs. Failover — a closer look at why standard failover setups drop sessions in the first place. https://www.bigleaf.net/blog/bigleaf-vs-failover/