Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Adding an On-Premise Spoke Site with Hybrid WAN Capability


You add an on-premise spoke site with Hybrid WAN capability from the Site page. The Hybrid WAN sites can have a maximum of two WAN links. You cannot apply intent policies for Hybrid WAN sites.

To add an on-premise spoke site with Hybrid WAN capability:

  1. Select Resources > Site Management .

    The Sites page appears.

  2. Click Add and select Add On-Premise Spoke (Manual).

    The Add Site for Tenant-Name page appears.

  3. Complete the configuration settings in the General and WAN sections according to the guidelines provided in Table 1.
  4. Review the configuration and modify the settings, if needed, from the Summary tab.
  5. Click OK.

    You are returned to the Sites page and a message indicating that the site creation job was triggered is displayed. You can click the job ID link to view the progress of the job. After the job is completed successfully, a confirmation message is displayed and the site that you added is displayed on the Sites page.

Table 1: Fields on the Add Spoke Site Page




Site Information

Site Name

Enter a site name. You can use any number of alphanumeric characters, including special characters. The maximum length is 10 characters.

Site Group

Select a site group to which you want to assign the site.

Site Capabilities

WAN Capabilities

Select Hybrid WAN to include Hybrid WAN capability in the on-premise spoke site.

LAN Capabilities

This option is disabled for Hybrid WAN.

Address and Contact Information

Street Address

Enter the street address of the site.


Enter the city where the site is located.


Enter the state or province where the site is located.

ZIP/Postal Code

Enter the postal code for the locality of the site.


Select the country where the site is located.

Click the Validate button to verify the address.

  • The site address verification successful message is displayed if the address is verified.

    You can click the View location on a map link to see the address location.

  • If the address cannot be verified, the Site address could not be validated message is displayed .

Contact Name

Enter the name of a contact person for the site.


Enter the e-mail address of the contact person for the site.


Enter the phone number of the contact person for the site.

Advanced Configuration

Name Server IP List

Specify one or more IPv4 addresses of the DNS server. To enter more than one DNS server address, type the address, press Enter, and then type the next address, and so on..

DNS servers are used to resolve hostnames into IP addresses.

NTP Server

Specify the fully qualified domain names (FQDNs) or IP addresses of one or more NTP servers.


The site must have DNS reachability to resolve the FQDN during site configuration.

Select Timezone

Select the time zone of the site.

Device Profile

Device Series

Select the device series to which the CPE belongs—SRX, NFX150, or NFX250.

Device Template

Select a device template for the selected device series.

The device template contains information for configuring a device.

Device Information

Device Model

Select the device model for NFX150 device.

Serial Number

Enter the serial number of the CPE device.

The serial number is a 12-digit number present on the rear panel of the device. Serial numbers are case-sensitive.

Auto Activate

Click the toggle button to enable or disable automatic activation of the CPE device.

When you enable this field, zero-touch provisioning (ZTP) of the CPE device is automatically triggered after the site is added to CSO.

The device template that you select determines whether this option is enabled or disabled by default.

Activation Code

Enter the activation code of the CPE device that your service provider supplied. If you do not want to specify an activation code, then disable the ACTIVATION_CODE_ENABLED field in the device template and save the changes.

Boot image

Select the boot image from the drop-down list if you want to upgrade the image for the CPE device.

The boot image is the latest build image uploaded to the image management system. The boot image is used to upgrade the device when the CSO starts the ZTP process.

If the boot image is not provided, then the device skips the procedure to upgrade the device image. The boot image (NFX or SRX) is populated based on the device template that you have selected while creating a site. See Uploading a Device Image.

CPE Info

CPE AS Number

Specify the autonomous system(AS) number.

Access Info

Router Name

Specify the router name.

Router AS Number

Specify the AS number for the router.

Management Connectivity

OAM Traffic Information

Select this option if the management connectivity is initiated by Contrail Service Orchestration (CSO).


Enter an OAM VLAN ID for in-band management of the site. If you specify an OAM VLAN ID, then an in-band OAM traffic reaches the site through the selected OAM interface. The range is 0 through 65535.

IP Prefix

Enter an IPv4 address prefix for the loopback interface on the CPE device. The IP address prefix must be a /32 IP address prefix and must be unique across the entire management network. If you do not specify an IPv4 address prefix, CSO automatically assigns the IP prefix from the reserved pool

  • For NFX150 and NFX250 devices, if the USE_SINGLE_SSH_TO_NFX parameter is disabled in the device template, then enter the IP address prefix as /29 or lower based on the number of VNFs.

  • For all other devices, enter the IP address prefix as /32.

Gateway IP

If you configured the address assignment method as STATIC, enter the IP address of the gateway of the WAN service provider.

WAN links


Link Type

Select whether the link would be an MPLS link or Internet link.


Specify the identifier for the Layer 2 VLAN for the CPE device.

Local IP Prefix

Enter the local IP address prefix of the WAN link.

Remote IP Prefix

Enter the remote IP address prefix of the WAN link.


Refer to the fields described for WAN_0 for an explanation of the fields.

VRF Name

Specify the name of the virtual routing and forwarding (VRF) instance.

Ipsec Concentrator Name

Specify the name of the IPsec concentrator device.

Internet Gateway IP

If you specified that the device is an IPsec concentrator, then specify the IPv4 address of the Internet gateway.