Cisco SD-WAN: Architecture and Components

Cisco SD-WAN Architecture

• The vSmart component oversees the control plane of the overlay network.
• It establishes, adjusts, and maintains connections between WAN Edge devices.

Cisco IOS XE SD-WAN Hardware Platforms

• ISR4000 series and ASR1000 series hardware platforms support Cisco IOS XE SD-WAN images.

Control Plane Connection Protocol

• DTLS protocol is the default for control plane connections.

SD-WAN Device Functions:

• vSmart enforces control policies.
• vManage is a single pane of glass.
• vEdge establishes a secured data plane.
• vBond serves as the first point of authentication.

vBond Location

• The vBond component should be located in a public Internet address space.
• It also facilitates NAT traversal.

WAN Edge Platform

• The ISR 1101 platform supports LTE and Wi-Fi.

BFD Value

• The BFD value of 8 represents the number of BFD sessions.

WAN Edge Router Tunnel Formation

• When a WAN Edge router connects to the Cisco SD-WAN fabric, DTLS or TLS tunnels form with the vSmart controller.
• IPsec tunnels also form with other WAN Edge routers.

Smart Account Sync Alternatives

• If Smart Account Sync is not used, vManage is utilized to upload an authorized serial number file.

vBond Port

• Port 12346 is used for vBond under controller certificates when no alternate port is configured.

vSmart Controller Actions

• vSmart controller distributes route and policy information via OMP.
• It also distributes crypto key information among WAN Edge routers.

Orchestration Component

• vBond orchestrates the connection between a WAN Edge device and a vSmart controller.

AWS Cloud Feature

• Cloud OnRamp feature provisions WAN Edge routers automatically in Cisco SD-WAN within an AWS cloud.

Extending SD-WAN Branch to AWS

• Virtual WAN Edge devices are created through the AWS online software store.

Cisco WAN Edge Router Virtual Platforms

• Cisco UCS
• Cisco ENCS 5000 Series

Cisco SD-WAN Features

• The Cisco SD-WAN solution helps to improve customer experience and reduce overhead.
• Achieved through QoS, including application prioritization and meeting critical application SLAs.

Cloud onRamp Prerequisites on vManage

• Subscribe to the SD-WAN Edge router AMI in an AWS account.
• Attach a device template to the cloud WAN Edge router to be deployed in the AWS

Route and Policy Information

• vSmart Controller is responsible for distributing route and policy information via OMP.

Cisco NFV Infrastructure Building Blocks:

• Cisco UCS: Compute
• CEPH: Storage
• RH OpenStack: Management
• Gluster: Virtualized Infrastructure

Data Plane Resiliency

• BFD (Bidirectional Forwarding Detection)

IPsec Tunnel Configuration

• The configuration "vpn 1 service netsvc1 interface ipsec1 ipsec2 from-vsmart lists vpn-list 1 vpn 1" configures IPsec tunnels in active and standby.

Regionalized Service-Chaining

• Cloud OnRamp for Colocation optimizes cost and user experience with applications by allowing branch routers to analyze and steer traffic.

BFD (Bidirectional Forwarding Detection) Parameters

• BFD for Transport Tunnel includes color, hello interval, and PMTU discovery.
• BFD for Application-Aware Routing includes poll interval and multiplier.

Initial Communication Facilitator

• vBond Orchestrator facilitates the initial communication between WAN Edge devices to join the fabric.

TLOC Attribute

• The tag is an attribute of TLOC (Transport Location).

vBond Orchestrator

• Builds permanent connections with vSmart controllers.

Control Plane Information Exchange

• OMP (Overlay Management Protocol) is the routing protocol used to exchange control plane information between vSmart controllers and WAN Edge routers.

WAN Edge Requirement

• A requirement for a WAN Edge to reach vManage, vBond, and vSmart controllers in a data center is IGP (Interior Gateway Protocol).

Establishing BFD Neighbours

• An interface template which configures on tunnel interface, an MPLS colour and restrict to on will enable BFD for MPLS enabled circuits.

Secure Tunnel Type

• IPsec should be used to connect one WAN Edge router to other WAN Edge routers.

BFD Basic Configuration Default Value

• The default value for the poll interval in BFD basic configuration is 600,000 milliseconds.

Network Topology and Traffic Flow Decisions

• The control plane builds and maintains the network topology and makes decisions on traffic flows.

TLOC Definition

• A TLOC is defined as a unique collection of GRE or IPsec encapsulations, link color, and system IP address.

vBond System Configuration VPN 0

• The vBond system configuration under VPN 0 allows for a routable public IP address when the DNS name, hostname, or IP address of the vBond orchestrator are omitted.

Cloud-Based Controller Deployment Advantages

• Cloud-based Cisco SD-WAN controllers offer infrastructure as a service.
• They provide management of SLA (Service Level Agreement).

Image Formats

• The supported image formats for controller codes are .qcow2 and .ova.

Platforms SD-WAN architecture

• CSR 1000v
• vEdge Cloud

Manage Scalability

• Deploy multiple vManage controllers in a cluster.

SD-WAN Control Plane Storage

• vManage facilitates the storage of certificates and configurations for network components.

DCONFAIL DTLS Connection Failure

• The DCONFAIL DTLS connection failure message indicates a connectivity issue.

Verifying Certificate Validity

• To verify certificate validity on vEdge, the command is show control local-properties.

Analyzing Control Connection Issues

• 'connect' in the show control connections output means connection attempt is in progress

WAN Edge Router State

• The WAN Edge router can create control connections but not data tunnels when in the staging state.

Configuration Template Purpose

• vpn 0 in the configuration template is responsible for the transport of secure control traffic.

Routing Path Influence

• Use "control-policy" to create routing path in the network by using a group of prefixes.