Add Enterprise Hubs with SD-WAN Capability or SD-WAN and LAN Capabilities

Site Information

Site Group

Select a site group to which you want to assign the site.

WAN Capabilities

SD-WAN capability is selected by default. You cannot clear the selection.

Configuration

Secondary Provider Hub

Select the secondary provider hub site (in case of multihoming) to which you want to connect the enterprise hub site.

When the primary provider hub is down, the enterprise hub connects to the secondary provider hub and the on-premise spoke sites to which that provider hub site is associated.

Threshold for Tunnel Creation

Specify the threshold for the number of sessions (flows) closed (in a two-minute duration) between the enterprise hub and a destination site. When the number of sessions closed exceeds the specified threshold, a tunnel is created between the enterprise hub and the destination site.

The default value is 5.

For example, if you specify the Create Threshold as 5, dynamic mesh tunnels are created if the number of sessions closed between the enterprise hub and destination site exceeds 5 in 2 minutes.

Address and Contact Information

City

Enter the name of the city where the site is located.

ZIP/Postal Code

Enter the postal code for the site.

Contact Name

Enter the name of the contact person for the site.

Phone

Enter the phone number of the contact person for the site.

Click Next to continue.

Name Server IP List

Specify one or more IPv4 addresses of the DNS server. To enter more than one DNS server address, type the address, press Enter, and then type the next address, and so on..

DNS servers are used to resolve hostnames into IP addresses.

Select Timezone

Select the time zone of the site.

Device Template

Device Information

Note: Some fields in this section are displayed only if you select a dual CPE device template.

Device Redundancy

For dual CPE device templates, displays Enabled indicating that redundancy is enabled. You cannot modify this field.

Secondary Serial Number

For a dual CPE device, enter the serial number of the secondary CPE device. The serial number is case sensitive.

Activation Code

For a single CPE device, if the automatic activation of the device is disabled, enter the activation code to manually activate the device.

Secondary Activation Code

For a dual CPE device, if the automatic activation of the device is disabled, enter the activation code to manually activate the secondary CPE device.

WAN Links

Link Type

Select whether the link would be an MPLS link or Internet link.

Address Assignment

Displays the method of assigning an IP address to the WAN link (STATIC).

You must provide the IP address prefix and the gateway address for the WAN link.

Gateway IP Address

Enter the IP address of the gateway of the WAN service provider.

WAN Link (Primary or Secondary)

For dual CPE device templates, displays whether the WAN link is a primary link or a secondary link. You cannot modify this field.

Provider

Enter the name of the service provider providing the WAN service.

Enable Local Breakout

Click the toggle button to enable local breakout on the WAN link. By default, local breakout is disabled.

Note:

• If you enable this option, the WAN link can be used for local breakout. The decision of whether traffic breaks out locally from the site depends on the breakout profile that is referenced in the SD-WAN policy intent.

• If you do not enable local breakout on at least one WAN link for a single CPE connection plan and at least two WAN links for a dual CPE connection plan, then local breakout is disabled for the site.

Autocreate Source NAT Rule

Click the toggle button to enable or disable the automatic creation of source NAT rules. By default, this field is enabled when local breakout is enabled on the WAN link.

Table 2 explains how source NAT rules are automatically created on the WAN link. The automatically-created source NAT rules are implicitly defined and applied to the site and is not visible on the NAT Policies page.

Note: You can manually override automatically created NAT rules, by creating a NAT rule within a particular rule-set. For example, to use a source NAT pool instead of an interface for translation, create a NAT rule within this particular rule-set, that includes the relevant department zone and WAN interface as the source and destination. For example:

Dept-Zone1 --> W1 : Translation=Pool-2

The manually created NAT rule is placed at a higher priority than the corresponding automatically created NAT rule.

You can also add other fields (such as addresses, ports, protocols, and so on) as part of the source or destination endpoints. For example:

Dept-Zone1, Port 56578 --> W1: Translation=Pool-2

IP Addresses

For pool-based NAT, enter one or more IP addresses, subnets, or an IP address range. Separate multiple IP addresses by using commas and use a hyphen to denote a range; for example, 192.0.2.1-192.0.2.50.

BGP Underlay Options

Note: This setting can be configured only if the address assignment is static and local breakout is enabled.

Click the toggle button to enable BGP underlay routing.

When you enable BGP underlay routing, route advertisements to the primary PE node and, if configured, the secondary PE node occur as follows:

• CSO advertises the WAN interface subnet.

• If you configured pool-based translation, CSO advertises the NAT address pool.

Note: If underlay BGP is enabled for a WAN link, then the routes learnt from BGP are installed for local breakout; CSO does not generate the static default route.

Secondary Neighbor

If you want to provide PE resiliency, you can configure a secondary PE node.

Enter the IP address of the secondary PE node.

Note: If the primary PE node goes down, then the secondary PE is used as the next hop. When the primary PE comes back up, the route next hops are changed to the primary PE.

Local AS Number

Enter the local AS number for the WAN link. When you configure this parameter, the local AS number is used for eBGP peering instead of the global AS number configured for the device.

Note: The local AS number must be different from the global AS and eBGP peer AS numbers.

Auth Key

If you specified that MD5 should be used for authentication, specify an MD5 authentication key (password), which is used to verify the authenticity of BGP packets.

Use For Fullmesh

Click the toggle button to specify whether the WAN link can be a part of a full mesh topology.

A site can have all WAN links enabled for meshing.

Note: You must enable at least one WAN link for full mesh.

Mesh Tag

When the Use for Fullmesh field is enabled, select one or more mesh tags to be associated with the WAN link for creating tunnels.

Matching mesh tags is one of the criteria used to form tunnels between sites that support meshing.

For more information about mesh tags, see Mesh Tags Overview“.

Use for OAM Traffic

If you have specified that the WAN link is connected to a hub, click the toggle button to enable sending the OAM traffic over the WAN link.

This WAN link is then used to establish the OAM tunnel.

Overlay Peer Interface

This field is displayed when the Connects to Hubs field is enabled and only a one provider hub (primary) is specified.

Select the interface name of the hub device to which the WAN link of the site is connected.

Overlay Peer Device 1

This field is displayed when the Connects to Hubs field is enabled and both primary and secondary hubs are specified.

Displays the primary peer hub device to which the site is connected.

Overlay Tunnel Type 2

This field is displayed when the Connects to Hubs field is enabled and both primary and secondary hubs are specified.

Select the mesh overlay tunnel type (GRE and GRE_IPSEC) for the tunnel to the secondary hub.

MPLS links can have both GRE and GRE_IPSEC as the overlay link type where as Internet links can have only GRE_IPSEC as the overlay link type.

Overlay Peer Interface 2

This field is displayed when the Connects to Hubs field is enabled and both primary and secondary hubs are specified.

Select the interface name of the secondary hub device to which the WAN link of the site is connected.

Default Link

Select one or more links that will be used for routing traffic in the absence of matching SD-WAN policy intents. A site can have multiple default links to the hub site.

Default links are used primarily for overlay traffic but can also be used for local breakout traffic. However, a default link cannot be used exclusively for local breakout traffic. If you do not specify a default link, then equal-cost multipath (ECMP) is used to choose the link on which to route traffic.

WAN_1 (WAN-Interface-Name)

Click the toggle button to enable or disable (default) the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed.

Refer to the fields described for WAN_0 (WAN-Interface-Name) for an explanation of the fields

WAN_3 (WAN-Interface-Name)

Click the toggle button to enable or disable (default) the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed.

Refer to the fields described for WAN_0 (WAN-Interface-Name) for an explanation of the fields

IP Prefix

Enter an IPv4 address prefix for the loopback interface on the CPE device. The IP address prefix must be a /32 IP address prefix and must be unique across the entire management network. If you do not specify an IPv4 address prefix, CSO automatically assigns the IP prefix from the reserved pool 100.124.0.0/14.

Configuration Templates List

Select one or more configuration templates from the list. This list is filtered based on the device that you select.

Configuration templates are stage-2 templates that are added by your OpCo administrators or SP administrators or Tenant administrators.

Note: You must set the parameters of the configuration templates that you have selected before you move to the LAN section.

1. After you select one or more configuration templates, click Set Parameters.

   The Device Configurations page appears. This page consists of two tabs—Configure and Summary

2. In the Configure tab fill in the attributes for each of the configuration templates.

   (Optional) View the CLI commands in the Summary tab.

3. Click OK.

   You have added and set the parameters for the configuration templates that are part of the site template that you are creating.

Enabled

Interface-Based (Default)—CSO creates interface-based NAT rules.

Source NAT rules are automatically created, with each rule from a department zone to the WAN interface, with a translation of type interface. Each pair of [zone - interface] represents a rule-set.

For example, the following department zone to (WAN link) W1 interface rule-set might be created:

Dept-Zone1 --> W1: Translation=Interface

Dept-Zone2 --> W1: Translation=Interface

Dept-Zone3 --> W1: Translation=Interface

Switch Devices

Displays the switches that you have added to the site.

• To add a switch, click the + icon on the top right corner of the Switch Devices table.

  The Add New Switch page appears. See Table 4 for details.

• To edit details of a switch, select the switch and click the Edit icon on the top right corner of the Switch Devices table. The Edit Switch Details page appears, displaying the same parameters that you configured while adding a switch.

  Modify the parameters as needed and Click OK. The changes that you made for the switch are saved and the updated parameters appear on the Switch Devices table.

• To delete one or more switches, select the switches and click the Delete icon on the top right corner of the Switch Devices table.

• To manage the configuration of one or more switches added to the site, select the switches from the list and click Configuration.

  The Switch Configuration page appears. See Table 5 for details.

Device Name

Enter a unique name for the switch.

You can use alphanumeric characters and hyphen (-). The maximum length allowed is 15 characters.

Device Model

Select the model for the switch you specified in the Device Type field.

The models vary in the number and type of ports the switch contains. For example, If you selected EX3400, select a model such as EX3400-24P, EX3400-48P, EX3400-24T among others.

Trunk Ports

Select at least two trunk ports on the CPE device to connect with the switch.

The trunk ports are used for carrying the following:

• LAN traffic between the switch and the CPE.

• Management traffic for in-band management of the switch.

Switch Details

Serial Number

If you disabled the Virtual Chassis toggle button, specify the serial number of the physical switch.

To obtain the serial number, log in to the CLI of the switch in operational mode and enter show chassis hardware. Alternatively, you can view the serial number on the barcode sticker, which is on the rear-panel of the switch.

The serial number is a case-sensitive, alphanumeric string.

Boot Image

Select the boot image from the list if you want to upgrade the image for the switch.

The boot image is the latest device image that is uploaded to the image management system. The boot image is used to upgrade the device when the CSO starts the ZTP process.

If the boot image is not provided, then the device skips the automatic upgrade procedure. The boot image is populated based on the device template that you have selected while creating a site.

Note: This option is not available for a Virtual Chassis.

To provision a Virtual Chassis in CSO, you must manually upgrade the image to either JUNOS 18.4R2.7 or 18.4R3.3.

Activation code

If you disabled the Auto activate field, enter the activation code to be used for manually activating the switch

For information on manually activating a switch, see Manually Activating a Switch.

Port Profiles

Displays the list of interfaces (ports) available in CSO.

You can also click the Search icon to search for a specific port in the list.

Optional: To assign port profiles and VLAN IDs to the ports:

1. Select one or more ports and click Edit Configuration on the top right corner, above the Interface List table.

   The Edit Port Configuration page appears.

2. From the Port Profile list, select a port profile to be assigned to the port.

   Note: The port profile must already be created from the Port Profiles page (Configuration > SD-LAN > Port Profiles) for it to be listed here.

3. In the VLAN field, if the port is configured as a trunk port in the port profile, assign multiple VLANs by selecting the VLANs in the Available column and clicking the right-arrow to move them to the Selected column.

   If the port is configured as an access port in the port profile, you can assign only one VLAN.

4. From the Native VLAN list, select a VLAN that you want to configure as native. This option appears only if you select a Trunk port profile from the Port Profile list.
5. Click OK to complete the configuration. You are returned to the Add On-Premise Spoke Site page.

Type

Note: This field is displayed only for LAN segments associated with enterprise hub sites.

Select the type of LAN segment:

• Directly Connected (default)—Indicates that the LAN segment is directly connected to the site.

• Dynamic Routed—Indicates that the LAN segment is not directly connected to the site and is reachable by using a dynamic route. If you select this option, you must specify the dynamic routing information.

Department

Select a department to which the LAN segment is assigned.

Alternatively, click the Create Department link to create a new department and assign the LAN segment to it. See Adding a Department for details.

You can group LAN segments as departments for ease of management and for applying policies at the department-level. For LAN segments that are dynamically routed, you can assign only a data center department.

Advertise LAN Prefix

For dynamically routed LAN segments, click the toggle button to advertise the LAN prefix of the SD-WAN spoke site to the data center through the data center department associated with the enterprise hub.

By default, the Advertise LAN Prefix field is disabled.

Note: You must avoid overlapping IP addresses between the SD-WAN LAN network and the datacenter network.

DHCP

For directly connected LAN segments, click the toggle button to enable DHCP (default).

You can enable DHCP if you want to assign IP addresses by using a DHCP server or disable DHCP if you want to assign a static IP address to the LAN segment.

Note: If you enable DHCP, additional fields appear on the page.

Address Range Low

Enter the starting IP address in the range of IP addresses that can be allocated by the DHCP server to the LAN segment.

Maximum Lease Time

Specify the maximum duration (in seconds) for which a client can request for and hold a lease on the DHCP server.

Default: 1440

Range: 0 through 4,294,967,295 seconds.

CPE Ports

• For sites with LAN capability, click the toggle button to include or exclude the CPE in the LAN segment.

  • When you include the CPE in the LAN segment:

    • CPE ports that you can include in the LAN segment are listed.

      Select the ports from the Available column and click the right-arrow to move the ports to the Selected column.

    • The Switch Ports field is disabled. CSO automatically assigns LAN ports on the Switch device and creates the same LAN segment on the Switch.

  • If you click to exclude the CPE from the LAN segment, you must specify the switch ports that connect with the LAN in the Switch Ports field.

    CSO automatically assigns LAN ports on the CPE device and creates the same LAN segment on the CPE device.

    Note: You can select only one port if the CPE is a physical SRX Series device.

• For sites without LAN capability, the CPE Ports field is disabled and the CPE ports that you can include in the LAN segment are listed.

  Select the ports from the Available column and click the right-arrow to move the ports to the Selected column.

BGP Configuration

Note: This section is displayed only for dynamic routed LAN segments with BGP specified as the protocol.

Peer IP Address

Enter the IP address of the BGP neighbor.

Auth Key

If you specified that MD5 should be used for authentication, specify an MD5 authentication key (password), which is used to verify the authenticity of BGP packets.

OSPF Area ID

Specify the OSPF area identifier to be used for the dynamic route.

Password

Enter the password to be used to verify the authenticity of OSPF packets.

MD5 Auth Key ID

If you specified that MD5 should be used for authentication, enter the OSPF MD5 authentication key ID.

Range: 1 through 255.