Adding an On-Premise Spoke Site with SD-WAN Capability

Site Name

Enter a unique name for the site. You can use alphanumeric characters and hyphen (-); the maximum length is 10 characters.

Site Capabilities

LAN Capabilities

You need not select this option because you are creating an on-premise spoke site with only SD-WAN capability.

Primary Provider Hub

Select the primary hub site to which this spoke site must connect.

Primary Enterprise Hub

Select the enterprise hub with which you want to connect the spoke site. If you specify an enterprise hub, then the initial site-to-site traffic as well as the central breakout (backhaul) traffic (if applicable) is sent through the enterprise hub instead of the hub site.

On-Demand Mesh Threshold

Threshold for Tunnel Deletion

Enter the number of sessions closed between the connected sites in a duration of 15 minutes below which full mesh is deleted between the two sites.

The default value is 8.

For example, if you specify the number of sessions closed as 8, dynamic mesh tunnels are deleted if the number of sessions closed is lesser than or equal to 8.

Street Address

Enter the street address of the site.

State/Province

Select the state or province where the site is located.

Country

Select the country where the site is located.

Click the Validate button to verify the address.

• The site address verification successful message is displayed if the address is verified.

  You can click the View location on a map link to see the address location.

• If the address cannot be verified, the Site address could not be validated message is displayed .

Email

Enter the e-mail address of the contact person for the site.

Advanced Configuration

NTP Server

Specify the fully qualified domain names (FQDNs) or IP addresses of one or more NTP servers.

Example: ntp.example.net

The site must have DNS reachability to resolve the FQDN during site configuration.

Device Series

Select the device series to which the CPE belongs—SRX, NFX150, or NFX250.

Based on the device series that you select, the supported device templates (containing information for configuring devices) are listed.

Select a device template for the selected device series.

Device Model

For NFX150 devices, select the device model number.

Device Redundancy

For dual CPE device templates, displays Enabled indicating that redundancy is enabled. You cannot modify this field.

Secondary Serial Number

For a dual CPE device, enter the serial number of the secondary CPE device. The serial number is case sensitive.

Activation Code

If the automatic activation of the device is disabled, enter the activation code to manually activate the device. The activation code is provided by the administrator who adds the site.

Secondary Activation Code

For a dual CPE device, if the automatic activation of the device is disabled, enter the activation code to manually activate the secondary CPE device.

WAN Links

Link Type

Select whether the link would be an MPLS link or Internet link.

Egress Bandwidth

Enter the maximum bandwidth, in Mbps, allowed on the WAN link.

Range: 1 through 10,000.

Static IP Prefix

If you configured the address assignment method as STATIC, enter the IP address prefix of the WAN link.

WAN Link (Primary or Secondary)

For dual CPE device templates, displays whether the WAN link is a primary link or a secondary link. You cannot modify this field.

Provider

Enter the name of the service provider (SP) providing the WAN service.

Only alphanumeric characters and '_', '@', '.', '/', '#', '&', '+' and '-' are allowed. The maximum number of characters allowed in 15.

Enable Local Breakout

Click the toggle button to enable local breakout on the WAN link. By default, local breakout is disabled.

Note:

• If you enable this option, the WAN link can be used for local breakout. The decision of whether traffic breaks out locally from the site depends on the breakout profile that is referenced in the SD-WAN policy intent.

• If you do not enable local breakout on at least one WAN link for a single CPE connection plan and at least two WAN links for a dual CPE connection plan, then local breakout is disabled for the site.

Autocreate Source NAT Rule

Click the toggle button to enable or disable the automatic creation of source NAT rules. By default, this field is enabled when local breakout is enabled on the WAN link.

Table 55 explains how source NAT rules are automatically created on the WAN link. The automatically-created source NAT rules are implicitly defined and applied to the site and is not visible on the NAT Policies page.

Note: You can manually override automatically created NAT rules, by creating a NAT rule within a particular rule-set. For example, to use a source NAT pool instead of an interface for translation, create a NAT rule within this particular rule-set, that includes the relevant department zone and WAN interface as the source and destination. For example:

Dept-Zone1 --> W1 : Translation=Pool-2

The manually created NAT rule is placed at a higher priority than the corresponding automatically created NAT rule.

You can also add other fields (such as addresses, ports, protocols, and so on) as part of the source or destination endpoints. For example:

Dept-Zone1, Port 56578 --> W1: Translation=Pool-2

IP Addresses

For pool-based NAT, enter one or more IP addresses, subnets, or an IP address range. Separate multiple IP addresses by using commas and use a hyphen to denote a range; for example, 192.0.2.1-192.0.2.50.

BGP Underlay Options

Note: This setting can be configured only if the address assignment is static and local breakout is enabled.

Click the toggle button to enable BGP underlay routing.

When you enable BGP underlay routing, route advertisements to the primary PE node and, if configured, the secondary PE node occur as follows:

• CSO advertises the WAN interface subnet.

• If you configured pool-based translation, CSO advertises the NAT address pool.

Note: If underlay BGP is enabled for a WAN link, then the routes learnt from BGP are installed for local breakout; CSO does not generate the static default route.

Secondary Neighbor

If you want to provide PE resiliency, you can configure a secondary PE node.

Enter the IP address of the secondary PE node.

Note: If the primary PE node goes down, then the secondary PE is used as the next hop. When the primary PE comes back up, the route next hops are changed to the primary PE.

Authentication

Select the BGP route authentication method to be used:

• None—Indicates that no authentication should be used. This is the default.

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

Advertise Public LAN Prefixes

Click the toggle button to enable the advertisement of public LAN prefixes. This field is disabled by default.

If the tenant has a public IP address pool configured and you enable the advertisement of public LAN prefixes, then for LAN segments that are created with a subnet that falls under the tenant public IP address pool, CSO advertises the LAN subnet to the BGP underlay.

Note: When public LAN advertisement is enabled for the WAN link, public LAN prefixes are advertised through the BGP underlay towards MPLS or the Internet. If a site has two versions of the route installed for the same LAN prefix in the overlay and underlay, the overlay routes are always preferred over underlay.

Mesh Overlay Link Type

When Use for Fullmesh field is enabled, select the type of mesh overlay link—GRE and GRE_IPSEC.

If the link type is Internet, by default, the value for mesh overlay link type is GRE_IPSEC.

If the link type is MPLS, select one of the following options:

• GRE-IPSEC

• GRE

Connects to Hubs

Click the toggle button to specify that the WAN link of the site connects to a hub.

Note:

• For sites with a single CPE, you must enable at least one WAN link to connect to the hub so that OAM traffic can be transmitted.

• For sites with a dual CPE, you must enable at least one WAN link per device to connect to the hub so that OAM traffic can be transmitted.

Overlay Tunnel Type

This field is displayed when the Connects to Hubs field is enabled and only a one provider hub (primary) is specified.

Select the mesh overlay tunnel type (GRE and GRE_IPSEC) of the tunnel to the hub.

MPLS links can have both GRE and GRE_IPSEC as the overlay link type where as Internet links can have only GRE_IPSEC as the overlay link type.

Overlay Peer Interface

This field is displayed when the Connects to Hubs field is enabled and only a one provider hub (primary) is specified.

Select the interface name of the hub device to which the WAN link of the site is connected.

Overlay Peer Device 1

This field is displayed when the Connects to Hubs field is enabled and both primary and secondary hubs are specified.

Displays the primary peer hub device to which the site is connected.

Overlay Tunnel Type 2

This field is displayed when the Connects to Hubs field is enabled and both primary and secondary hubs are specified.

Select the mesh overlay tunnel type (GRE and GRE_IPSEC) for the tunnel to the secondary hub.

MPLS links can have both GRE and GRE_IPSEC as the overlay link type where as Internet links can have only GRE_IPSEC as the overlay link type.

Overlay Peer Interface 2

This field is displayed when the Connects to Hubs field is enabled and both primary and secondary hubs are specified.

Select the interface name of the secondary hub device to which the WAN link of the site is connected.

Default Link

Select one or more links that will be used for routing traffic in the absence of matching SD-WAN policy intents. A site can have multiple default links to the hub site.

Default links are used primarily for overlay traffic but can also be used for local breakout traffic. However, a default link cannot be used exclusively for local breakout traffic. If you do not specify a default link, then equal-cost multipath (ECMP) is used to choose the link on which to route traffic.

WAN_1 WAN-Interface-Name

Click the toggle button to enable or disable the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed. Refer to the fields described for WAN_0 WAN-Interface-Name for an explanation of the fields

WAN_3 WAN-Interface-Name

Click the toggle button to enable or disable the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed. Refer to the fields described for WAN_0 WAN-Interface-Name for an explanation of the fields

IP Prefix

Enter an IPv4 address prefix for the loopback interface on the CPE device.

The IP address prefix must be a /32 IP address prefix and must be unique across the entire management network. If you do not specify an IPv4 address prefix, CSO automatically assigns the IP prefix from the reserved pool 100.124.0.0/14.

• For NFX150 and NFX250 devices, if the USE_SINGLE_SSH_TO_NFX parameter is disabled in the device template, then enter the IP address prefix as /29 or lower based on the number of VNFs.

• For all other devices, enter the IP address prefix as /32.

Add LAN Segment

You must add at least one LAN segment for the on-premise site. To add a LAN segment:

Procedure

1. Click the + icon.

   The Add LAN Segment page appears.

2. Complete the configuration settings according to the guidelines provided inTable 56.
3. Click Save.

   The LAN segment is added and you are returned to the Add Site for Tenant-Name page.

Disabled

Not applicable (No NAT)

None.

Enabled

Pool-Based—CSO automatically creates pool-based NAT rules.

NAT source rules are automatically created, with each rule from a department zone to the WAN NAT pool with a translation of type pool.

For example, a source NAT rule from department zone to NAT pool might be created:

Dept-Zone1 --> W1 : Translation=Pool-1

Dept-Zone2 --> W1 : Translation=Pool-1

Name

Enter a name for the LAN segment.

The name for a LAN segment should be a unique string of alphanumeric characters and some special characters (. -). No spaces are allowed and the maximum length allowed is 15 characters.

VLAN ID

Enter the VLAN ID for the LAN segment.

Range: 2 through 4093.

Protocol

For dynamically routed LAN segments, select the routing protocol (BGP or OSPF) to be used by the data center department to learn routes from the data center.

Gateway Address/Mask

Enter a valid gateway IP address and mask for the LAN segment. This address will be the default gateway for endpoints in this LAN segment.

For example: 192.0.2.8/24.

Additional fields related to DHCP

Address Range High

Enter the ending IP address in the range of IP addresses that can be allocated by the DHCP server to the LAN segment.

Name Server

Specify one or more IPv4 addresses of the DNS server.

To enter more than one DNS server address, type the address, press Enter, and then type the next address.

Note: DNS servers are used to resolve hostnames into IP addresses.

Switch Ports

Note: This field is displayed only when LAN capability is selected for the enterprise hub.

If you disable the CPE ports field, select ports on the switch to be part of the LAN segment. The Switch ports and CPE ports are mutually exclusive.

Select the ports from the Available column and click the right-arrow to move the ports to the Selected column.

Authentication

Select the BGP route authentication method to be used:

• None—Indicates that no authentication should be used. This is the default.

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

Peer AS Number

Enter the autonomous system (AS) number of the BGP neighbor.

OSPF Configuration

Note: This section is displayed only for dynamic routed LAN segments with OSPF specified as the protocol.

Authentication

Select the OSPF route authentication method to be used:

• Password—Indicates that password-based authentication should be used. If you choose this option, you must specify the password. (This is the default).

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

• None—Indicates that no authentication should be used.

Confirm Password

Retype the password for confirmation purposes.

Auth Key

If you specified that MD5 should be used for authentication, enter an MD5 authentication key, which is used to verify the authenticity of OSPF packets.