Adding Cloud Spoke Sites for SD-WAN Deployment

Site Name

Enter a unique name for the site. Enter a unique string of alphanumeric characters and special character (-). The maximum length is 15 characters.

Example: aws-cloud-spoke

Site Capabilities

Configuration

Advanced Configuration

NTP Server

Enter the fully qualified domain names (FQDNs) or IP addresses of one or more NTP servers. Example: ntp.example.net The site must have DNS reachability to resolve the FQDN during site configuration.

Cloud Information

VPC ID

Enter the VPC ID from the AWS account.

Procedure

1. Log in to your AWS account.
2. Search for the VPC service.
3. Click the VPC dashboard.
4. Select a VPC ID.

Ensure that the VPC is connected to an Internet gateway.

Procedure

1. Log in to your AWS account.
2. Search for the VPC service.
3. Click the Internet Gateway dashboard.
4. Check whether the VPC state is attached.

Example: vpc-6d810314

IP Prefix

Enter the management IP prefix. The first four IP addresses in the subnet are reserved by AWS. For example, IP addresses x.x.x.0/x through x.x.x.3/x are always reserved by AWS. Hence, provide an IP address prefix other than the reserved IP address prefix.

Example: 105.0.1.5/24

Activation Code

Enter the activation code of the primary device that your service provider supplied for the device. If you do not want to specify an activation code, on the Template Settings page, disable the ACTIVATION_CODE_ENABLED field and save the changes.

WAN_0 (ge-0/0/0)

WAN_1 (ge-0/0/1)

Select the check boxes to configure the WAN links. You can configure up to two WAN links per site that support SD-WAN.

Egres Bandwidth

Enter the maximum bandwidth (in Mbps) to be allowed for a specific WAN link.

Static IP Prefix

If you configure the address assignment method as STATIC, enter the private IPv4 address of the WAN link from the subnet. For example, if the IPv4 CIDR address is 105.0.2.0/24 for a WAN interface in the AWS account, then enter any IP address within the subnet. The first four IP addresses in the subnet are reserved by AWS. Hence, provide an IP prefix other than the reserved IP prefix.

Example: 105.0.2.12/24

Elastic IP

Elastic IP address is a public, static IPv4 address designed for dynamic cloud computing. The public IP address is mapped to the private subnet IP using one-to-one NAT. You must allocate the IP addresses based on the number of WAN links that are enabled. For example, If two WAN links are enabled, then you must allocate two elastic IP addresses.

Example: 34.213.255.184

Provider

Enter the name of the service provider (SP).

Enable Local Breakout

Click the toggle button to enable or disable (default) local breakout on the WAN link.

• If you enable this option, the WAN link can be used for local breakout. The decision of whether traffic breaks out locally from the site depends on the breakout profile that is referenced in the SD-WAN policy intent.

• If you do not enable local breakout on at least one WAN link for a single CPE connection plan and at least two WAN links for a dual CPE connection plan, then local breakout is disabled for the site.

Autocreate Source NAT Rule

If the WAN link is enabled for local breakout, you can click the toggle button to automatically create an interface-based source NAT rule on the WAN link. The automatically-created source NAT rule is implicitly defined and applied to the site and is not visible on the NAT Policies page.

By default, this field is disabled.

Note: If this option is enabled for a WAN interface W1 during the site addition workflow, a series of NAT source rules are automatically created. Each automatically created NAT rule is from a zone to the WAN interface, with a translation of type interface. Each pair of [zone - interface] represents a rule-set.

For example, the following zone to W1 interface rule-set might be created:

Zone1 --> W1: Translation=Interface

Zone2 --> W1: Translation=Interface

Zone3 --> W1: Translation=Interface

To manually override any of these rules, you can create a NAT rule within a particular rule-set. For example, to use a source NAT pool instead of an interface for translation, create a NAT rule within this particular rule-set, that includes the relevant zone and WAN interface as the source and destination. For example:

Zone1 --> W1 : Translation=Pool-2

The manually created NAT rule is placed at a higher priority than the corresponding automatically created NAT rule.

You can also add other fields (such as addresses, ports, protocols, and so on) as part of the source or destination endpoints. For example:

Zone1, Port 56578 --> W1: Translation=Pool-2

Use for OAM Traffic

If you have specified that the WAN link is connected to a hub, click the toggle button to enable sending the OAM traffic over the WAN link.

This WAN link is then used to establish the OAM tunnel.

Overlay Peer Device

Displays the peer hub device to which the site is connected.

Backup Link

Select a backup link through which traffic can be routed when the primary links are unavailable. You cannot select the default link as the backup link. Note that you cannot assign the backup link for exclusive breakout traffic (the Use only for breakout traffic option). If local breakout is enabled for the site, the breakout traffic is also routed through the backup link when the breakout link is not available.

When a primary link comes back online, CSO monitors the performance on the primary link and when the primary link meets the SLA requirements, the traffic is switched back to the primary link. However, note that the SLA data is not monitored for the backup link.

Management Connectivity

Add at least one LAN segment.

Add LAN Segment

Department

Select a department to which the LAN segment is to be assigned.

Alternatively, click the Create Department link to create a new department and assign the LAN segment to it. See Adding a Department for details.

You group LAN segments as departments for ease of management and for applying policies at the department-level.

CPE Ports

Click the toggle button to include or exclude the CPE in the LAN segment. When you include the CPE in the LAN segment:

• CPE ports that you can include in the LAN segment are listed.

  Select the ports from the Available column and click the right-arrow to move the ports to the Selected column.

• The Switch Ports field is disabled. CSO automatically assigns LAN ports on the switch device and creates the same LAN segment on the switch.

If you exclude the CPE from the LAN segment, you must specify the switch ports that connect with the LAN in the Switch Ports field. CSO automatically assigns LAN ports on the CPE device and creates the same LAN segment on the CPE device.

Note: You can select only one port if the CPE is an SRX Series device.