Add an On-Premise Spoke Site with SD-WAN and LAN Capabilities

Site Information

Site Group

Select a site group to which you want to assign the site.

WAN Capabilities

Select SD-WAN to include SD-WAN capabilities in the spoke site.

Configuration

Secondary Provider Hub

Select the secondary hub site to which this site must connect.

This site connects to the secondary data hub site when the primary data hub is down.

Secondary Enterprise Hub

Select the secondary enterprise hub for this spoke site.

The spoke site connects with secondary enterprise hub when the primary enterprise hub is down.

Threshold for Tunnel Creation

Specify the threshold for the number of sessions (flows) closed (in a two-minute duration) between the on-premise spoke site and a destination site. When the number of sessions closed exceeds the specified threshold, a tunnel is created between the on-premise spoke site and the destination site.

The default value is 5.

For example, if you specify the number of sessions as 5, dynamic mesh tunnels are created if the number of sessions closed between two spoke sites in 2 minutes exceeds 5.

Address and Contact Information

City

Enter the city where the site is located.

ZIP/Postal Code

Enter the postal code for the site.

Contact Name

Enter the name of the contact person for the site.

Phone

Enter the phone number of the contact person for the site.

Name Server IP List

Specify one or more IPv4 addresses of the DNS server. To enter more than one DNS server address, type the address, press Enter, and then type the next address, and so on..

DNS servers are used to resolve hostnames into IP addresses.

Select Timezone

Select the time zone of the site.

Device Template

Device Information

Auto Activate

Click the toggle button to enable or disable automatic activation of the CPE device.

When you enable this field, zero-touch provisioning (ZTP) of the CPE device is automatically triggered after the site is added to CSO.

The device template that you select determines whether this option is enabled or disabled by default.

Boot Image

Select the boot image from the drop-down list if you want to upgrade the image for the CPE device.

The boot image is the latest build image uploaded to the image management system. The boot image is used to upgrade the device when the CSO starts the ZTP process.

If the boot image is not provided, then the device skips the procedure to upgrade the device image. The boot image is populated based on the device template that you have selected while creating a site. See Uploading a Device Image.

WAN_0 WAN-Interface-Name

This field is enabled by default.

Enter parameters related to WAN_0. Fields marked with an asterisk (*) must be configured to proceed.

Access Type (NFX150, NFX250, and SRX300 line of Services Gateways)

If you select Internet as the link type, select the access type for the underlay link—Ethernet, LTE, ADSL, or VDSL.

You can select the LTE, ADSL, or VDSL access type only for one WAN link.

Note:

• You cannot configure an access type (LTE, ADSL, and VDSL) if you are using the Dual SRX and Dual NFX device templates. By default, Ethernet is configured as the access type for the underlay link.

• As of Release 5.2.0, CSO supports only LTE, VDSL, and ADSL access types on SRX300 line of Services Gateways. SRX300 does not support ADSL access type.

Address Assignment

Select the method of assigning an IP address to the WAN link—DHCP or STATIC.

• If you select DHCP, the IP address is provided by using the DHCP server of the service provider of the WAN link.

• If you select STATIC, you must provide the IP address prefix and the gateway address for the WAN link.

Gateway IP Address

If you configured the address assignment method as STATIC, enter the IP address of the gateway of the WAN service provider.

Provider

Enter the name of the service provider who is responsible for providing the WAN link.

Enable Local Breakout

Click the toggle button to enable local breakout on the WAN link. By default, local breakout is disabled.

Note:

• If you enable this option, the WAN link can be used for local breakout. The decision of whether traffic breaks out locally from the site depends on the breakout profile that is referenced in the SD-WAN policy intent.

• If you do not enable local breakout on at least one WAN link for a single CPE connection plan and at least two WAN links for a dual CPE connection plan, then local breakout is disabled for the site.

Autocreate Source NAT Rule

Click the toggle button to enable or disable the automatic creation of source NAT rules. By default, this field is enabled when local breakout is enabled on the WAN link.

Table 58 explains how source NAT rules are automatically created on the WAN link. The automatically-created source NAT rules are implicitly defined and applied to the site and is not visible on the NAT Policies page.

Note: You can manually override automatically created NAT rules, by creating a NAT rule within a particular rule-set. For example, to use a source NAT pool instead of an interface for translation, create a NAT rule within this particular rule-set, that includes the relevant department zone and WAN interface as the source and destination. For example:

Dept-Zone1 --> W1 : Translation=Pool-2

The manually created NAT rule is placed at a higher priority than the corresponding automatically created NAT rule.

You can also add other fields (such as addresses, ports, protocols, and so on) as part of the source or destination endpoints. For example:

Dept-Zone1, Port 56578 --> W1: Translation=Pool-2

IP Addresses

For pool-based NAT, enter one or more IP addresses, subnets, or an IP address range. Separate multiple IP addresses by using commas and use a hyphen to denote a range; for example, 192.0.2.1-192.0.2.50.

BGP Underlay Options

Note: This setting can be configured only if the address assignment is static and local breakout is enabled.

Click the toggle button to enable BGP underlay routing.

When you enable BGP underlay routing, route advertisements to the primary PE node and, if configured, the secondary PE node occur as follows:

• CSO advertises the WAN interface subnet.

• If you configured pool-based translation, CSO advertises the NAT address pool.

Note: If underlay BGP is enabled for a WAN link, then the routes learnt from BGP are installed for local breakout; CSO does not generate the static default route.

Secondary Neighbor

If you want to provide PE resiliency, you can configure a secondary PE node.

Enter the IP address of the secondary PE node.

Note: If the primary PE node goes down, then the secondary PE is used as the next hop. When the primary PE comes back up, the route next hops are changed to the primary PE.

Authentication

Select the BGP route authentication method to be used:

• None—Indicates that no authentication should be used. This is the default.

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

Advertise Public LAN Prefixes

Click the toggle button to enable the advertisement of public LAN prefixes. This field is disabled by default.

If the tenant has a public IP address pool configured and you enable the advertisement of public LAN prefixes, then for LAN segments that are created with a subnet that falls under the tenant public IP address pool, CSO advertises the LAN subnet to the BGP underlay.

Note: When public LAN advertisement is enabled for the WAN link, public LAN prefixes are advertised through the BGP underlay towards MPLS or the Internet. If a site has two versions of the route installed for the same LAN prefix in the overlay and underlay, the overlay routes are always preferred over underlay.

Mesh Overlay Link Type

When Use for Fullmesh field is enabled, select the type of mesh overlay link—GRE and GRE_IPSEC:

• If the link type is Internet, the value for mesh overlay link type is GRE_IPSEC.

• If the link type is MPLS, select one of the following options:

  • GRE-IPSEC

  • GRE

Connects to Hubs

Click the toggle button to specify that the WAN link of the site connects to a hub.

Note:

• For sites with a single CPE, you must enable at least one WAN link to connect to the hub so that OAM traffic can be transmitted.

• For sites with a dual CPE, you must enable at least one WAN link per device to connect to the hub so that OAM traffic can be transmitted.

Overlay Tunnel Type

Select the mesh overlay tunnel type—GRE and GRE_IPSEC.

MPLS links can have both GRE and GRE_IPSEC as the overlay link type where as Internet links can have only GRE_IPSEC as the overlay link type.

Overlay Peer Interface

Select the interface name of the hub device to which the WAN link of the site is connected.

Default Link

Select one or more links that will be used for routing traffic in the absence of matching SD-WAN policy intents. A site can have multiple default links to the hub site.

Default links are used primarily for overlay traffic but can also be used for local breakout traffic. However, a default link cannot be used exclusively for local breakout traffic. If you do not specify a default link, then equal-cost multipath (ECMP) is used to choose the link on which to route traffic.

WAN_1 WAN-Interface-Name

Click the toggle button to enable or disable the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed. Refer to the fields described for WAN_0 WAN-Interface-Name for an explanation of the fields

WAN_3 WAN-Interface-Name

Click the toggle button to enable or disable the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed. Refer to the fields described for WAN_0 WAN-Interface-Name for an explanation of the fields

IP Prefix

Enter an IPv4 address prefix for the loopback interface on the CPE device. The IP address prefix must be a /32 IP address prefix and must be unique across the entire management network. If you do not specify an IPv4 address prefix, CSO automatically assigns the IP prefix from the reserved pool 100.124.0.0/14.

Device Profile

Device Type

Select the type of switch—EX2300, EX3400, EX4300, EX4600, and EX4650.

CPE Settings

Switch Management Subnet

Specify the subnet that the DHCP server can use to assign IP addresses. The DHCP server runs on the following ports:

• Trunk ports to provide DHCP information to all devices connected to the switch and to the in-band management port, switch management port, and LAN ports on the CPE.

• Out-of-band management port on the CPE to provide DHCP information to the management port on the switch.

• LAN ports on the CPE to provide information to the devices connected to the CPE LAN ports.

Serial Number

Specify the serial number of the switch.

Activation code

When the Auto activate field is disabled, enter the activation code to be used for manually activating the switch.

For information, see Manually Activating a Switch.

LAN Segment

Displays the LAN segment that you configure on the switch.

To add a LAN segment, click the + icon on the top, right corner of the LAN table. The Add LAN Segment page appears. See Table 59.

Enabled

Interface-Based (Default)—CSO creates interface-based NAT rules.

Source NAT rules are automatically created, with each rule from a department zone to the WAN interface, with a translation of type interface. Each pair of [zone - interface] represents a rule-set.

For example, the following department zone to (WAN link) W1 interface rule-set might be created:

Dept-Zone1 --> W1: Translation=Interface

Dept-Zone2 --> W1: Translation=Interface

Dept-Zone3 --> W1: Translation=Interface

Name

Enter a name for the LAN segment.

The name for a LAN segment should be a unique string of alphanumeric characters and some special characters (. -). No spaces are allowed and the maximum length is 15 characters.

Department

Select a department to which the LAN segment is to be assigned.

Alternatively, click the Create Department link to create a new department and assign the LAN segment to it. See Adding a Department for details.

You group LAN segments as departments for ease of management and for applying policies at the department-level.

DHCP

For directly connected LAN segments, click the toggle button to enable DHCP. DHCP is disabled by default.

You enable DHCP if you want to assign IP addresses by using a DHCP sever. You disable DHCP if you want to assign a static IP address to the LAN segment.

Note: If you enable DHCP, fields related to DHCP-related parameters appear and must be configured.

Address Range Low

Enter the starting IP address in the range of IP addresses that can be allocated by the DHCP server to the LAN segment.

Maximum Lease Time

Specify the maximum duration (in seconds) for which a client can request for and hold a lease on a DHCP server.

Range: 0 through 4,294,967,295.

CPE Ports

Click the toggle button to include or exclude the CPE in the LAN segment. When you include the CPE in the LAN segment:

• CPE ports that you can include in the LAN segment are listed.

  Select the ports from the Available column and click the right-arrow to move the ports to the Selected column.

• The Switch Ports field is disabled. CSO automatically assigns LAN ports on the switch device and creates the same LAN segment on the switch.

If you exclude the CPE from the LAN segment, you must specify the switch ports that connect with the LAN in the Switch Ports field. CSO automatically assigns LAN ports on the CPE device and creates the same LAN segment on the CPE device.

Note: You can select only one port if the CPE is an SRX Series device.