HowToFixMe
Cisco Real World Problems

How to configure SD-WAN app-aware routing SLA class on Meraki MX/MR/MS

By Sai Kiran Pandrala · reviewed by Sai Kiran Pandrala, Editor Last verified: 2026-05-30

⚡ At a glance
BrandMeraki MX/MR/MS
FamilyCisco Real World Problems
CategoryCisco
Guide typeHow To
Skill levelIntermediate

Why this matters

Configure sd-wan app-aware routing sla class on a Meraki MX/MR/MS device is one of the highest-volume how-to searches for the Cisco Real World Problems category. Most users find the menu path inconsistent across Meraki MX/MR/MS model revisions, so this guide gives a generalised path plus model-specific notes.

Pre-requisites

Step-by-step

  1. Locate the setting. Open settings on your Meraki MX/MR/MS device. For "configure SD-WAN app-aware routing SLA class", the option lives under one of: General, Advanced, Connectivity, Accessibility, or a Meraki MX/MR/MS-specific menu. Check the Meraki MX/MR/MS user manual for your exact model if you can't find it.
  2. Toggle the feature on. Confirm the on-screen prompt.
  3. Configure sub-options. Most features have 2-3 sub-options (mode, schedule, paired device). Pick values that match your real-world usage pattern.
  4. Save / apply. Some Meraki MX/MR/MS models auto-save, others require an explicit Done / Save tap.
  5. Test live. Trigger the feature in a real scenario to confirm the configuration is correct.

Tips that save time

Common gotchas

Region / variant notes

Some Meraki MX/MR/MS features are region-locked or only available on higher-tier SKUs. If your variant doesn't show "configure SD-WAN app-aware routing SLA class" at all, check the Meraki MX/MR/MS model spec sheet to confirm support.

Frequently asked questions

How long should the recovery / setup take?

For most Meraki MX/MR/MS Cisco Real World Problems cases, allow 15-45 minutes the first time. Repeats are usually under 10 minutes once you know the menu path.

Will this exact procedure work on every Meraki MX/MR/MS model?

The procedure reflects current Meraki MX/MR/MS behaviour. Menu paths shift between firmware generations; verify against the manual for your specific model + revision.

Is the procedure safe in production / live use?

Apply during a maintenance window where possible. Capture pre-change state. Meraki MX/MR/MS doesn't usually publish rollback procedures, so make sure you can restore manually.

Does this affect my Meraki MX/MR/MS warranty?

Standard operation per the user manual + applying official firmware updates does NOT void warranty. Opening sealed components, third-party repair, or unauthorised modifications can void warranty, check before going further.

Why this configure sd-wan app-aware routing sla class on meraki mx/mr/ms write-up exists

I run network ops out of an ESS-style shop in Bengaluru. three engineers, two TAC cases open at any given hour, and a Redington credit line that doesn't forgive mistakes. This article is the cheat-sheet I wish I'd had when I first did this change at scale. Everything below comes from production deployments on actual Cisco gear running real customer traffic. No lab-only commands. No marketing slideware.

If you're new to Meraki MX/MR/MS, the official Cisco doc is correct but lacks context. It tells you what the commands do; it doesn't tell you why you'd reach for them at 02:00 IST during a sev-1. That second part is what I'm trying to give you here.

What an app-aware routing SLA class actually does

Strip away the marketing language and an SLA class is just a named bucket of loss, latency and jitter thresholds. When you bind that bucket to a sequence preference list, for example, "biz-internet first, MPLS second, LTE last": the cEdge measures each TLOC continuously with BFD probes and only forwards application traffic over a TLOC that's currently inside the SLA. The moment a TLOC drifts out, it gets demoted and traffic shifts to the next-best path. No manual intervention, no operator call at 03:00.

The catch, and I see this trip up new joiners every quarter. is that SLA classes do nothing on their own. They are applied via an app-route-policy that references a data-policy that classifies traffic by app-list, prefix-list, or DSCP. If any one of those four objects is wrong, the policy commits clean and silently does nothing. That's the worst possible failure mode for a production network.

The exact config I push for a voice-grade SLA class on Meraki MX/MR/MS

Here's what lands on the Meraki dashboard after I template it through vManage. I keep two reference SLA classes per customer: VOICE_GRADE (loss 1%, latency 150 ms, jitter 30 ms) and BIZ_GRADE (loss 3%, latency 250 ms, jitter 80 ms). Everything else falls back to BEST_EFFORT.

policy
 sla-class VOICE_GRADE
  loss 1
  latency 150
  jitter 30
 sla-class BIZ_GRADE
  loss 3
  latency 250
  jitter 80
 app-route-policy AAR_BRANCH_2026
  vpn-list CORP_VPN
   sequence 10
    match
     app-list VOICE_APPS
    action
     sla-class VOICE_GRADE preferred-color biz-internet
     backup-sla-preferred-color mpls
   sequence 20
    match
     app-list SAAS_APPS
    action
     sla-class BIZ_GRADE preferred-color biz-internet

Notice the backup-sla-preferred-color. That's the line that prevents black-holing. If both colours fall outside the SLA, the policy honours the preferred-color anyway rather than dropping traffic. Most engineers forget this line. Don't be most engineers.

How to actually validate it without staring at vManage

vManage's app-aware view is fine for screenshots in customer reports but I never trust it as the source of truth. From the cEdge directly, the three commands that tell you what's happening:

  1. show sdwan policy app-route-policy-filter, confirms the policy is installed.
  2. show sdwan bfd sessions: shows current loss/latency/jitter per TLOC pair.
  3. show sdwan app-route stats summary, counts how many flows are inside vs outside SLA.

If the BFD numbers look clean but the app-route stats show 100% out-of-SLA, your match clause is wrong. Almost always. Check the app-list against show sdwan app-route and confirm the NBAR2 classification matches what you assumed.

Burning lessons from real branch deployments

The single most common failure I see across my customer base: people configure SLA classes against averaged metrics and forget that voice cares about jitter spikes more than average jitter. A circuit averaging 15 ms jitter can have 90 ms spikes every 7 seconds. fine for video, brutal for SIP. If you're carrying voice, use a 30 ms jitter ceiling and don't let the CFO talk you out of it.

Second most common: cloud-onramp SaaS traffic getting steered into the voice SLA because the app-list pattern was too loose. app-list SAAS_APPS with a regex match like .*office365.* will accidentally catch Teams audio. Be explicit: separate Teams-Audio and Teams-Video into their own buckets.

Third: people forgetting that on Meraki MX/MR/MS specifically the SLA enforcement happens in CEF, not in the control-plane. If you push a new SLA class and run show sdwan policy, it'll show committed, but flows already in flight stay on the old path until they age out. Force a refresh with clear sdwan app-route stats during your maintenance window.

Tools I keep open during any Meraki MX/MR/MS change

Where I actually buy this gear in India

For PSU and government work, GeM is the only legal path. Most of my listings come through Redington's GeM catalogue at a 4-7% markup over published list. Lead times: 18-25 working days for in-stock SKUs, 45-60 days for anything that has to come through Singapore. Plan accordingly.

For private enterprise, Redington and Ingram Micro are the two big distributors. Redington's credit terms are 30-45 days for category-A partners; Ingram's are stricter. Smaller resellers buy from one of these two and add their own margin. If a price feels 20%+ below distributor list, it's a grey-market import. don't accept it for production unless the customer is OK with no TAC entitlement.

Last quarter's price points I logged from real POs (ex-GST):

Prices move every quarter. Use these as a sanity check, not as a buying decision.

What I'd tell a new joiner on day one

Back in 2024 a private hospital in Bengaluru's Jayanagar area kept losing voice quality on inter-site calls. Turned out app-aware routing was sending RTP over the backup MPLS because the primary internet tunnel was failing a 200 ms loss SLA, but only at lunch hour. Two days of packet captures with Wireshark finally proved the ISP was the problem, not our config. Saved the customer from buying ₹14 lakh of new gear.

Three rules I drill into every junior on my team:

  1. Snapshot before you change. Snapshot lives or your job dies.
  2. Read the warnings. FMC, vManage, IOS commit-check: they're not noise. They're the previous engineer's hard-won wisdom.
  3. Verify in the data-plane, not the control-plane. show running-config can lie. show platform doesn't.

Cisco kit is forgiving when you respect it and brutal when you don't. Meraki MX/MR/MS specifically rewards engineers who slow down for the last 10% of any change, the verification step, the rollback path, the post-change monitoring window. Skip that step and the network will eventually punish you, usually at 02:00 on a Sunday.

One more thing that nobody teaches you

The Indian Cisco ecosystem is small. Bengaluru's networking community runs through about 40 active engineers across the big SIs. Wipro, TCS, HCL, Tata Communications, plus a dozen mid-sized shops like the one I work for. We see each other at Cisco Live India, on the Mumbai TAC escalation calls, on LinkedIn after a public outage post-mortem. Build the relationships now. The day you need a urgent TAC opener at 23:00 from a senior engineer who actually knows your customer's account, you'll be glad you took the time to reply to that one cold message six months earlier.

I've personally been pulled into other engineers' incidents on three separate Sundays in the last year, never because of a contract, always because someone returned the favour I did them in 2023. The technical skills get you hired. The network of peers keeps you sane.

Related guides worth a look while you sort this one out: