Routing

App Routing

Send a single application out of a different door. Any match — app, category, SNI, domain, user, or geography — can leave through any egress: a second WAN, an encrypted tunnel, or a plain interface.

GAany egress

HOW IT WORKS

Walk through a single flow

1A policy carries an egress directive naming a route target. The target is any interface the box owns — a WAN link, a WireGuard, OpenVPN, IPsec, or GRE tunnel, or an ordinary NIC.
2Classification finishes first: the flow already has its application, category, SNI, user, and geography attached before the routing decision is taken.
3A strategy-pattern transmit layer resolves the physical egress — direct interface, kernel routing table, or translated — and the tunnel adapters bind the socket to the tunnel the target names.
4Health probes score every candidate target on a sub-second cadence. Failover is atomic and hysteresis-aware, so a borderline link does not cause flap.

UNDER THE HOOD

Technical notes

Any egress, not just multi-WAN

Route targets are fully generic: interface plus type plus an optional protocol adapter. A VPN tunnel is a first-class target, not a special case bolted onto a multi-WAN selector.

The source address survives

Steered flows keep the client's real address end to end, so identity-aware policy and logging at the far end still see who originated the traffic.

Structured health surface

Health data is exposed in a machine-readable format for dashboards and third-party observability systems. Nothing is hidden; everything is inspectable.

Other capabilities that plug in here

Routing

Sub-10s SASE Failover

ICMP / HTTP / DNS probes, composite health score, atomic peer swap. Hysteresis-aware.

Routing

Encrypted Overlay on the Fast Path

Kernel driver patched so encrypted overlay peers can join the same fast path. Opt-in on bare-metal deployments; standard SASE still defaults to the kernel socket path.