Adding a Site Template
You can add a site template for an on-premise spoke site. A site template can be added with one WAN capability (SD-WAN or Next Gen Firewall), LAN capability, or both WAN and LAN capabilities.
To add a site template:
- Select Resources > Templates > Site Templates.
The Site Templates page appears.
- Click the + icon.
The Add Site Template page appears.
- Complete the configuration according to the guidelines
in Table 1.
The fields that are displayed in the Add Site Template page are based on the LAN and WAN capabilities that you choose. The last column of Table 1 indicates the capabilities for which a field is applicable.
Fields marked with * are mandatory.
- Click OK.
The site template is added and listed in the Site Templates page. You can use the site template to add multiple on-premise spoke sites.
Table 1: Fields on the Add Site Template Page
Specify a unique name for the site template that can contain alphanumeric characters and hyphens (-); the maximum length is 32 characters.
Enter a description for the site template; the maximum length is 512 characters.
Select a site group to which you want to assign the template. Example: sdwan-spoke
Select one of the following WAN capabilities to include LAN capabilities for the site template:
Select LAN to include LAN capabilities for the site template.
Primary Provider Hub
Select the provide hub site (or primary provider hub site in case of multihoming) to which the spoke site must connect.
Secondary Provider Hub
Select the secondary provider hub site to which this site must connect.
This site connects to the secondary provider hub site when the primary provider hub is down.
Primary Enterprise Hub
Select the primary enterprise hub with which you want to connect the spoke site. If you specify a enterprise hub, then the initial site-to-site traffic as well as the central breakout (backhaul) traffic (if applicable) is sent through the enterprise hub instead of the hub site.
Secondary Enterprise Hub
Select the secondary enterprise hub for this spoke site.
The spoke site connects with secondary enterprise hub when the primary enterprise hub is down.
Enter the maximum number of sessions closed between the connected sites in a duration of two minutes at which full mesh is created between the two sites.
The default value is 5.
For example, if you specify the number of sessions as 5, dynamic mesh tunnels are created if the number of sessions closed between two spoke sites in 2 minutes exceeds 5.
Enter the number of sessions closed between the connected sites in a duration of 15 minutes below which full mesh is deleted between the two sites.
The default value is 2.
For example, if you specify the number of sessions closed as 2, dynamic mesh tunnels are deleted if the number of sessions closed is lesser than or equal to 2.
Address and Contact Information
Enter the street address of the site.
Enter the city where the site is located.
Select the state or province where the site is located.
Enter the postal code for the site.
Select the country where the site is located. Click the Validate button to verify the address. The site address verification successful message is displayed if the address is correct. You can click the View location on a map link to see the address location.
If you enter the wrong address and click the Validate button to verify the address, the Site address could not be validated message is displayed .
Enter the name of the contact person at the site.
Enter the e-mail address of the contact person at the site.
Enter the phone number for the site.
Domain Name Server (DNS)
Specify one or more IPv4 addresses of the DNS server. To enter more than one DNS server address, type the address, press Enter, and then type the next address, and so on..
DNS servers are used to resolve hostnames into IP addresses.
Specify the fully qualified domain names (FQDNs) or IP addresses of one or more NTP servers.
The site must have DNS reachability to resolve the FQDN during site configuration.
Select the time zone in which the site is located from the drop-down list.
Select the device series to which the CPE belongs (SRX, NFX150, or NFX250) and select a device template for the selected device series.
The device template contains information for configuring a device.
For NFX150 devices, select a device model from the list. Device models are listed based on the connection plan that you select.
Click the toggle button to enable or disable automatic activation of the CPE when the CPE is detected by CSO ( management status of the device is Device_Detected).
When you enable this field, zero-touch provisioning of the device is automatically triggered after the site with the CPE is added to CSO.
Click the toggle button to use the preconfigured settings for the firewall device. The preconfigured settings are as follows:
Next Gen Firewall
Select the boot image from the drop-down list if you want to upgrade the image for the CPE device.
The boot image is the latest build image uploaded to the image management system. The boot image is used to upgrade the device when the CSO starts the ZTP process.
If the boot image is not provided, then the device skips the procedure to upgrade the device image. The boot image (NFX or SRX) is populated based on the device template that you have selected while adding a site. See Uploading a Device Image.
In-band Management Port
Select the port that you want to configure as management interface and connect it to the management device. You can configure any of the ge-0/0/x ports, where x ranges from 0 to 14, as in-band management interfaces.
Next Gen Firewall
Select the firewall policy that you want to deploy. The firewall policy list is populated from the Configuration > Firewall > Firewall Policy page.
Select the NAT policy that you want to deploy to the standalone firewall site. The NAT policy list is populated from the Configuration > NAT > NAT Policies page.
Click the toggle button to enable or disable this WAN link. By default, the WAN_0 link is enabled.
When you enable a WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed.
Select the underlay network type (MPLS or Internet) of the WAN link that is connected to the on-premise spoke site.
Enter the maximum bandwidth (in mega bits per second [Mbps]) to be allowed for the WAN link. Range: 1 through 10,000
Select the method for IP address assignment. The options available are:
Enter the name of the service provider who is responsible for providing the WAN link.
Enter the cost per month (in the specified currency) of the subscribed bandwidth.
Range: 1 through 10,000
Enable Local Breakout
Click the toggle button to enable local breakout on the WAN link. By default, local breakout is disabled.
Use For Fullmesh
Click the toggle button to specify that the WAN link is part of a fullmesh topology.
Connects To Hubs
Click the toggle button to specify that the WAN link of the site connects to a hub.
Select a backup link through which traffic can be routed when the primary (other) links are unavailable.
Select one or more links to be used for routing traffic in the absence of matching SD-WAN policy intents.
Data VLAN Id
Enter the VLAN ID that is associated with the data link. A data VLAN identifier is an integer.
Range: 0 through 65,535
Click the toggle button to enable or disable this WAN link. By default, the WAN 1 link is disabled.
Refer to the fields described for WAN 0 for an explanation of the fields.
Click the toggle button to enable or disable this WAN link. By default, the WAN 2 link is disabled.
Refer to the fields described for WAN 0 for an explanation of the fields
Click the toggle button to enable or disable this WAN link. By default, the WAN 3 link is disabled.
Refer to the fields described for WAN 0 for an explanation of the fields
Configuration Templates List
Select one or more configuration templates from the list. This list is filtered based on the device that you select.
Configuration templates are stage-2 templates that are added by your OpCo administrators or SP administrators or Tenant administrators.
Note: You must set the parameters of the configuration templates that you have selected before you move to the LAN section.
To set the parameters for the selected configuration templates:
Displays the list of switches that you have added to the site.
Displays the VLANs and their IDs that you configure on the switch.
Table 2: Fields on the Create LAN Segment Page
Create LAN Segment
Enter a name for the LAN segment.
The name for a LAN segment should be a unique string of alphanumeric characters and some special characters (. -). No spaces are allowed and the maximum length is 15 characters.
Enter the VLAN ID for the LAN segment.
Range: 2 through 4093.
Select a department to which the LAN segment is to be assigned.
Alternatively, click the Create Department link to create a new department and assign the LAN segment to it. See Adding a Department for details.
You group LAN segments as departments for ease of management and for applying policies at the department-level.
Enter a valid gateway IP address and mask for the LAN segment; for example, 192.0.2.8/24.
For directly connected LAN segments, click the toggle button to enable DHCP. DHCP is disabled by default.
You enable DHCP if you want to assign IP addresses by using a DHCP server. You disable DHCP if you want to assign a static IP address to the LAN segment.
Click the toggle button to include or exclude the CPE in the LAN segment. When you include the CPE in the LAN segment:
Table 3 describes the tabs on the Switch Configuration page.
The Access Profiles tab and Port Profiles tab are available only if you have added a physical switch or a preprovisioned Virtual Chassis, and the selected switches are of the same device type and model. If you have added an autoprovisioned Virtual Chassis, only the Configuration Templates tab is available. The Port Profiles tab is unavailable because, in the case of autoprovisioning, port profiles can be configured only after provisioning the Virtual Chassis. The Access Profiles tab is unavailable because the access profile requires a RADIUS authentication server to be added to it. The parameters related to communication between the RADIUS server and the supplicant are defined in the authentication profile , which is, in turn, referenced by the port profile.
Table 3: Tabs on the Switch Configuration page
Displays the list of access profiles available in CSO. The list is populated from the Access Profiles page (Configuration > SD-LAN > Access Profiles).
You can also click the Search icon to search for a specific access profile in the list.
For details of the fields displayed on the Access Profiles table, see About the Access Profiles Page.
Optional: You can select an access profile from the list to assign it to the switch.
Displays the list of interfaces (ports) available in CSO.
You can also click the Search icon to search for a specific port in the list.
Optional: To assign port profiles and VLAN IDs to the ports:
Displays the list of configuration templates. This list is filtered based on the device that you select.
Configuration templates are predefined stage-2 templates that are added by your OpCo administrators or SP administrators.
To add configuration templates and set the parameters for the selected configuration templates: