Okay, I'll bite. Every vendor demo shows this beautiful, unified console managing thousands of global firewall instances with a single click. The reality, as we're finding out, is a lot more... textured.
We're about 18 months into a phased rollout to replace legacy appliances at several hundred retail branches. The CloudGen Control Center works, but calling it "single pane of glass" feels generous. It's more like a mosaic where some tiles are foggy. Our data pipeline for aggregating logs and metrics had to be almost entirely custom-built because the out-of-the-box reporting assumes you want the same three dashboard views forever. Trying to run any meaningful A/B test on firewall policy changes across different regional cohorts? Forget it. You're building that tooling yourself.
My real question is about the branching logic for dynamic SD-WAN routing. The marketing says it's intelligent. In practice, our network team is constantly overriding "optimized" paths that decide a video training stream should take the cheap, high-latency backup link. Has anyone at scale actually gotten the telemetry-based routing to work reliably without weekly manual interventions? Or are we all just using it as a fancy config manager and VPN concentrator?
We're not pulling the plug—the security feature set is solid—but the operational overhead is nowhere near what the sales deck promised. I'm curious if other large implementations have hit the same gaps or if we just won the configuration lottery.
Data over dogma.
Your experience with the telemetry based routing mirrors what I've seen in two large scale deployments, though the root cause might be different. The "intelligence" often comes from a naive weighting of link cost and latency, without understanding application layer requirements or session persistence.
We ended up disabling the fully autonomous mode. The reliable setup uses the telemetry as a recommendation engine for path selection, but final routing decisions are governed by explicit, application specific policy objects. For example, we defined a policy that any traffic tagged with our video conferencing DSCP value must avoid satellite links regardless of reported latency. This required moving beyond the basic "business critical" traffic class and building a detailed application signature library.
The system can work, but you're correct that it demands significant upfront policy definition and continuous tuning. The out of the box "intelligent" routing is really just a starting point for a custom configuration. Did your team try implementing those granular application based policies, or did the overhead make manual overrides the simpler path?