Routing

App Routing

Send a single application out of a different door. Any match — app, category, SNI, domain, user, or geography — can leave through any egress: a second WAN, an encrypted tunnel, or a plain interface.

GAany egress

HOW IT WORKS

Walk through a single flow

1A policy carries an egress directive naming a route target. The target is a WAN link, a WireGuard, OpenVPN or GRE tunnel, or an ordinary NIC.
2Classification finishes first: the flow already has its application, category, SNI, user, and geography attached before the routing decision is taken.
3A strategy-pattern transmit layer resolves the physical egress — direct interface, kernel routing table, or translated — and the tunnel adapters bind the socket to the tunnel the target names.
4Health probes score every candidate target every five seconds on loss, latency and jitter. The switch is atomic and hysteresis-aware, so a borderline link does not cause flap.

UNDER THE HOOD

Technical notes

Any egress, not just multi-WAN

Route targets are fully generic: interface plus type plus an optional protocol adapter. A VPN tunnel is a first-class target, not a special case bolted onto a multi-WAN selector.

The source address survives

Steered flows keep the client's real address end to end, so identity-aware policy and logging at the far end still see who originated the traffic.

Structured health surface

Health data is exposed in a machine-readable format for dashboards and third-party observability systems. Nothing is hidden; everything is inspectable.

Other capabilities that plug in here

Routing

Sub-10s SASE Failover

ICMP / HTTP / DNS probes, composite health score, atomic peer swap. Hysteresis-aware.

Routing

Encrypted Overlay on the Fast Path

Kernel driver patched so encrypted overlay peers can join the same fast path. Opt-in on bare-metal deployments; standard SASE still defaults to the kernel socket path.