Adding Enterprise Hubs with SD-WAN Capability or SD-WAN and LAN Capabilities

Site Information

Site Group

Select a site group to which you want to assign the site.

WAN Capabilities

SD-WAN capability is selected by default. You cannot clear the selection.

Configuration

Secondary Provider Hub

Select the secondary provider hub site (in case of multihoming) to which you want to connect the enterprise hub site.

When the primary provider hub is down, the enterprise hub connects to the secondary provider hub and the on-premise spoke sites to which that provider hub site is associated.

Threshold for Tunnel Creation

Specify the threshold for the number of sessions (flows) closed (in a two-minute duration) between the enterprise hub and a destination site. When the number of sessions closed exceeds the specified threshold, a tunnel is created between the enterprise hub and the destination site.

The default value is 5.

For example, if you specify the Create Threshold as 5, dynamic VPN tunnels are created if the number of sessions closed between the enterprise hub and destination site exceeds 5 in 2 minutes.

Address and Contact Information

City

Enter the name of the city where the site is located.

ZIP/Postal Code

Enter the postal code for the site.

Contact Name

Enter the name of the contact person for the site.

Phone

Enter the phone number of the contact person for the site.

Click Next to continue.

Name Server IP List

Specify one or more IPv4 addresses of the DNS server. To enter more than one DNS server address, type the address, press Enter, and then type the next address, and so on..

DNS servers are used to resolve hostnames into IP addresses.

Select Timezone

Select the time zone of the site.

Device Profile

Device Template

Select a device template for the selected device series.

The device template contains information for configuring a device.

Serial Number

Note: Primary Serial Number and Secondary Serial Number fields appear when a template for dual CPE is selected.

Enter the serial number of the CPE device.

Boot image

Select the boot image from the drop-down list if you want to upgrade the image for the CPE device.

The boot image is the latest build image uploaded to the image management system. The boot image is used to upgrade the device when the CSO starts the ZTP process.

If the boot image is not provided, then the device skips the procedure to upgrade the device image. The boot image is populated based on the device template that you have selected while creating a site. See Uploading a Device Image.

WAN Links

Link Type

Select whether the link would be an MPLS link or Internet link.

Address Assignment

Select the method of assigning an IP address to the WAN link—DHCP or STATIC.

If you select STATIC, you must provide the IP address prefix and the gateway address for the WAN link.

Gateway IP Address

If you configured the address assignment method as STATIC, enter the IP address of the gateway of the WAN service provider.

Provider

Enter the name of the service provider providing the WAN service.

Enable Local Breakout

Click the toggle button to enable local breakout on the WAN link. By default, local breakout is disabled.

Note:

• If you enable this option, the WAN link can be used for local breakout. The decision of whether traffic breaks out locally from the site depends on the breakout profile that is referenced in the SD-WAN policy intent.

• If you do not enable local breakout on at least one WAN link for a single CPE connection plan and at least two WAN links for a dual CPE connection plan, then local breakout is disabled for the site.

Autocreate Source NAT Rule

If the WAN link is enabled for local breakout, you can click the toggle button to automatically create an interface-based source NAT rule on the WAN link. The automatically-created source NAT rule is implicitly defined and applied to the site and is not visible on the NAT Policies page.

By default, this field is disabled.

Note: If this option is enabled for a WAN interface W1 during the site addition workflow, a series of NAT source rules are automatically created. Each automatically created NAT rule is from a zone to the WAN interface, with a translation of type interface. Each pair of [zone - interface] represents a rule-set.

For example, the following zone to W1 interface rule-set might be created:

Zone1 --> W1: Translation=Interface

Zone2 --> W1: Translation=Interface

Zone3 --> W1: Translation=Interface

To manually override any of these rules, you can create a NAT rule within a particular rule-set. For example, to use a source NAT pool instead of an interface for translation, create a NAT rule within this particular rule-set, that includes the relevant zone and WAN interface as the source and destination. For example:

Zone1 --> W1 : Translation=Pool-2

The manually created NAT rule is placed at a higher priority than the corresponding automatically created NAT rule.

You can also add other fields (such as addresses, ports, protocols, and so on) as part of the source or destination endpoints. For example:

Zone1, Port 56578 --> W1: Translation=Pool-2

Use For Fullmesh

Click the toggle button to specify whether the WAN link can be a part of a full mesh topology.

A site can have a maximum of three links enabled for meshing.

Mesh Tag

When the Use for Fullmesh field is enabled, enter the tag to be associated with the WAN link for creating tunnels. You can assign only one tag to the link.

Matching mesh tags is one of the criteria used to form tunnels between sites that support meshing.

• For an on-premise spoke site, you can select one mesh tag.

• For an enterprise hub you can select one or more mesh tags.

For more information about mesh tags, see Mesh Tags Overview“.

Use for OAM Traffic

If you have specified that the WAN link is connected to a hub, click the toggle button to enable sending the OAM traffic over the WAN link.

This WAN link is then used to establish the OAM tunnel.

Overlay Peer Device

Displays the peer hub device to which the site is connected.

Backup Link

Select a backup link through which traffic can be routed when the primary (other) links are unavailable. You can select any link other than the default links or links that are configured exclusively for local breakout traffic.

When a primary link comes back online, CSO monitors the performance on the primary link and when the primary link meets the SLA requirements, the traffic is switched back to the primary link. However, SLA data is not monitored for the backup link.

Data VLAN ID

Enter a VLAN ID for the WAN link.

Range: 2 through 4093.

WAN_2

Click the toggle button to enable or disable (default) the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed. Refer to the fields described for WAN_0 for an explanation of the fields

Management Connectivity

Refer to Table 58 for configuring LAN segments.

Device Profile

Device Type

Select the type of switch—EX2300, EX3400, and EX4300.

CPE Settings

Switch Management Subnet

Specify the subnet that the DHCP can use to assign IP addresses. The DHCP server runs on the following ports:

• Trunk ports to provide DHCP information to all devices connected to the switch and to the in-band management port, switch management port, and LAN ports on the CPE.

• Out-of-band management port on the CPE to provide DHCP information to the management port on the switch.

• LAN ports on the CPE to provide information to the devices connected to the CPE LAN ports.

Serial Number

Specify the serial number of the switch.

Activation code

When the Auto activate field is disabled, enter the activation code to be used for manually activating the switch. .

For information about manually activating a switch, see Manually Activating a Switch.

LAN Segments

Displays the LAN segment that you configure on the switch.

To add a LAN segment, click the + icon on the top, right corner of the LAN table. The Add LAN Segment page appears. See Table 58.

Type

Select the type of LAN segment:

• Directly Connected (default)—Indicates that the LAN segment is directly connected to the site.

• Dynamic Routed—Indicates that the LAN segment is not directly connected to the site and is reachable by using a dynamic route. If you select this option, you must specify the dynamic routing information.

Department

Select a department to which the LAN segment is assigned.

Alternatively, click the Create Department link to create a new department and assign the LAN segment to it. See Adding a Department for details.

You can group LAN segments as departments for ease of management and for applying policies at the department-level. For LAN segments that are dynamically routed, you can assign only a data center department.

Gateway Address/Mask

Enter a valid gateway IP address and mask for the LAN segment. This address will be the default gateway for endpoints in this LAN segment.

For example: 192.0.2.8/24.

Additional Fields

Address Range High

Enter the ending IP address in the range of IP addresses that can be allocated by the DHCP server to the LAN segment.

Name Server

Specify one or more IPv4 addresses of the DNS server.

To enter more than one DNS server address, type the address, press Enter, and then type the next address.

Note: DNS servers are used to resolve hostnames into IP addresses.

Switch Ports

Note: This field is displayed only when LAN capability is selected for the enterprise hub.

If you disable the CPE ports field, select ports on the switch to be part of the LAN segment. The Switch ports and CPE ports are mutually exclusive.

Select the ports from the Available column and click the right-arrow to move the ports to the Selected column.

Authentication

Select the BGP route authentication method to be used:

• None—Indicates that no authentication should be used. This is the default.

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

Peer AS Number

Enter the autonomous system (AS) number BGP neighbor.

OSPF Configuration

Authentication

Select the OSPF route authentication method to be used:

• Password—Indicates that password-based authentication should be used. If you choose this option, you must specify the password. (This is the default).

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

• None—Indicates that no authentication should be used.

Confirm Password

Retype the password for confirmation purposes.

Auth Key

If you specified that MD5 should be used for authentication, enter an MD5 authentication key, which is used to verify the authenticity of OSPF packets.