Add Enterprise Hub Sites

Site Name

Enter a unique name for the site. The name can contain alphanumeric characters and hyphens (-), and cannot exceed 32 characters.

Site Capabilities

Configuration

Secondary Provider Hub

If you previously added provider hub sites (DATA or OAM and DATA capability) for the tenant and want provider hub redundancy, select another provider hub as the secondary provider hub.

Threshold for Tunnel Creation

Specify the threshold for the number of sessions (flows) closed (in a two-minute duration) between the enterprise hub site and a destination site. When the number of sessions closed exceeds the specified threshold, a tunnel is created between the enterprise hub site and the destination site.

For example, if you specify a threshold as 7, dynamic mesh tunnels are created if the number of sessions closed (in two minutes) between the enterprise hub site and destination site exceeds 7.

Address and Contact Information

Enter the address and contact information in the fields provided. Although it is not mandatory, providing an address lets you visualize where the site is located on a geographical map on the Monitor Overview page.

Name Server IP List

If needed, specify the IPv4 addresses of one or more DNS servers.

Select Timezone

Select a time zone for the site.

[Device Template]

Ensure that you select the correct device template from the carousel; the template depends on the device that you are using as the enterprise hub.

For example, for an SRX4100 device, select SRX4x00 as SD-WAN CPE (or a modified version of that template) as the device template.

Serial Number

If you want CSO to proceed with the site activation immediately after you complete the site addition workflow, enter the serial number. If the serial number that you entered is already present in the system, CSO displays an error message. If the serial number is not present, then CSO displays a green check mark.

If you want CSO to only model the site, leave this field blank. If you don’t enter a serial number, you must manually activate the site later.

Boot Image

If you want to upgrade the enterprise hub device with the latest supported Junos OS version, select the boot image from the list. The boot image is used to upgrade the device when CSO starts the zero touch provisioning (ZTP) process.

If you don't specify a boot image, which is the default option (Use Image on Device) in the list, then the CSO skips the procedure to upgrade the device during ZTP.

WAN_0 (WAN-Interface-Name)

The first WAN link is enabled by default.

Fields marked with an asterisk (*) must be configured to proceed.

Egress Bandwidth

Enter the maximum egress bandwidth (in megabits per second [Mbps]) that is allowed for the WAN link.

Static IP Prefix

Enter the IPv4 address prefix of the WAN link; for example, 192.0.2.8/24.

Public IP Address

Note: You should provide a public IP address only if the static IP prefix is a private IP address and 1:1 NAT is configured.

Enter the public IPv4 address for the link, if needed.

Provider

Enter the name of the WAN link’s service provider.

Enable Local Breakout

Click the toggle button to enable the WAN link to be used for local breakout. The toggle button is disabled by default, which means that the WAN link cannot be used for local breakout.

Local breakout is an SD-WAN feature that enables Internet links to break out traffic directly from a site. For example, if you want to provide guests who visit your enterprise with Internet access, you can use local breakout to break out guest traffic locally from the site directly to the Internet.

Note: If you enable local breakout, this only means that the WAN link can be used for local breakout. To enable traffic to break out from the site, you must also configure a breakout profile, reference that profile in an SD-WAN policy intent, and deploy the SD-WAN policy.

If you enable local breakout, additional fields appear.

Autocreate Source NAT Rule

This field is displayed only if local breakout is enabled for the WAN link.

When you enable local breakout on a link, this setting is enabled by default, which triggers automatic creation of source NAT rules for the site.

You can click the toggle button to disable the automatic creation of source NAT rules. If you disable this field, then you must manually add a source NAT rule for local breakout and deploy the NAT policy on the site.

Note: If NAT is not enforced by a separate device in your network (for example, an Internet gateway firewall), then we recommend that you enable this setting because it allows CSO to automatically create a NAT policy for the site.

Table 5 explains how source NAT rules are automatically created on the WAN link. The automatically-created source NAT rules are implicitly defined and applied to the site and is not visible on the NAT Policies page.

Note: You can manually override automatically created NAT rules, by creating a NAT rule, which is placed at a higher priority than the automatically created NAT rule

IP Addresses

For pool-based NAT, enter one or more IP addresses, subnets, or an IP address range. Separate multiple IP addresses by using commas and use a hyphen to denote a range; for example, 192.0.2.1-192.0.2.50.

Note: No NAT is performed for tenant-owned public IP addresses that were added during the tenant addition workflow.

BGP Underlay Options

Note: BGP underlay routing is typically used by service providers, and can be configured only if local breakout is enabled for the WAN link.

Click the toggle button to enable BGP underlay routing.

When you enable BGP underlay routing, route advertisements to the primary Provider Edge (PE) node and, if configured, the secondary PE node occur as follows:

• CSO advertises the WAN interface subnet.

• If you configured pool-based translation, CSO advertises the NAT address pool.

Note: If underlay BGP is enabled for a WAN link, then the routes learnt from BGP are installed for local breakout; CSO does not generate the static default route.

Secondary Neighbor

If you want to provide PE resiliency, you can configure a secondary PE node.

Enter the IP address of the secondary PE node.

Note: If the primary PE node goes down, then the secondary PE is used as the next hop. When the primary PE comes back up, the route next hops are changed to the primary PE.

Local AS Number

Enter the local AS number for the WAN link. When you configure this parameter, the local AS number is used for eBGP peering instead of the global AS number configured for the device.

Auth Key

If you specified that MD5 should be used for authentication, specify an MD5 authentication key (password), which is used to verify the authenticity of BGP packets.

Use for Fullmesh

Click the toggle button to enable the WAN link to be part of a full mesh topology.

A site can have all WAN links enabled for meshing.

Note: You must enable at least one WAN link for full mesh.

Configure the two additional fields that appear:

Mesh Tag

Select one or more mesh tags for the WAN link.

Note: The tunnels between the enterprise hub site and the on-premise spoke site are added based on matching mesh tags. So, if you want meshing to take place between a WAN link on the enterprise hub and a WAN link on the on-premise spoke site, the mesh tags must be the same for both sites.

For more information about mesh tags, see Mesh Tags Overview in the CSO Customer Portal User Guide (available on the CSO Documentation page).

Connects to Hubs

Click the toggle button to specify that the WAN link of the site connects to a hub.

Note:

• For sites with a single CPE, you must enable at least one WAN link to connect to the hub so that OAM traffic can be transmitted.

• For sites with a dual CPE, you must enable at least one WAN link per device to connect to the hub so that OAM traffic can be transmitted.

Backup Link

Select a backup link through which traffic can be routed when the primary (other) links are unavailable. You can select any link other than the default links or links that are configured exclusively for local breakout traffic.

When a primary link comes back online, CSO monitors the performance on the primary link and when the primary link meets the SLA requirements, the traffic is switched back to the primary link. However, SLA data is not monitored for the backup link.

WAN_1 (WAN-Interface-Name)

Click the toggle button to enable or disable (default) the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed.

Refer to the fields described for WAN_0 (WAN-Interface-Name) for an explanation of the fields

WAN_3 (WAN-Interface-Name)

Click the toggle button to enable or disable (default) the WAN link.

When you enable the WAN link, fields related to the WAN link appear. Fields marked with an asterisk (*) must be configured to proceed.

Refer to the fields described for WAN_0 (WAN-Interface-Name) for an explanation of the fields

Additional Configuration

If you want to deploy additional configuration during the ZTP process, you can select one or more configuration templates and set the parameters for each template.

Type

Note: This field is displayed only for LAN segments associated with enterprise hub sites.

Select the type of LAN segment:

• Directly Connected—Indicates that the LAN segment is directly connected to the site. This is the default setting.

• Dynamic Routed—Indicates that the LAN segment is not directly connected to the site and is reachable by using a dynamic route. If you select this option, you must specify the dynamic routing information.

Department

Select a department to which the LAN segment is assigned.

Alternatively, click Create Department to add a new department and configure the fields required to add a department.

You can group LAN segments as departments for ease of management and for applying policies at the department-level. For LAN segments that are dynamically routed, you can assign only a data center department.

Advertise LAN Prefix

For dynamically routed LAN segments, click the toggle button to advertise the LAN prefix of the SD-WAN spoke sites to the data center through the data center department associated with the enterprise hub.

By default, this field is disabled.

Note:

• Route advertisements from the data center to SD-WAN spoke sites take place irrespective of whether this field is enabled or disabled.

• You must avoid overlapping IP addresses between the LAN network of the SD-WAN spoke sites and the data center network.

DHCP

For directly connected LAN segments, click the toggle button to enable DHCP (default).

You can enable DHCP if you want to assign IP addresses by using a DHCP server or disable DHCP if you want to assign a static IP address to the LAN segment.

Note: If you enable DHCP, additional fields appear on the page.

Address Range Low

Enter the starting IP address in the range of IP addresses that can be allocated by the DHCP server to the LAN segment.

Maximum Lease Time

Specify the maximum duration (in seconds) for which a client can request for and hold a lease on the DHCP server.

Default: 1440

Range: 0 through 4,294,967,295 seconds.

CPE Ports

Select the ports (on the CPE device) that you want to include as part of the LAN segment.

Authentication

Select the BGP route authentication method to be used:

• None—Indicates that no authentication should be used. This is the default.

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

Peer AS Number

Enter the autonomous system (AS) number of the BGP neighbor.

By default, CSO uses the AS number 64512; the AS number can be modified during the installation of the CSO on-premises version. If the AS number of the data center’s router is different from CSO’s AS number, an external BGP (eBGP) peering session is established. If the AS number is the same, an internal BGP (iBGP) peering session is established.

OSPF Configuration

This section is displayed only for dynamic routed LAN segments with OSPF specified as the protocol.

Authentication

Select the OSPF route authentication method to be used:

• Password—Indicates that password-based authentication should be used. If you choose this option, you must specify the password. (This is the default).

• Use MD5—Indicates that MD5 is to be used for authentication. If you choose this option, you must specify an authentication key.

• None—Indicates that no authentication should be used.

Confirm Password

Retype the password for confirmation purposes.

Auth Key

If you specified that MD5 should be used for authentication, enter an MD5 authentication key, which is used to verify the authenticity of OSPF packets.

Prestage Device—Depending on the type of device used, you might need to copy the configuration that is generated by CSO and commit the configuration on the device. For such devices, CSO can move to the next step (detecting the device) only after the configuration is committed successfully on the device.

1. On the Devices page (Resources > Devices), select the device and click Stage1 Config.

   The configuration to be copied appears in a separate page.

2. Click Copy to copy the configuration to the clipboard
3. Log in to the device by using SSH and enter Junos OS configuration mode.
4. Paste the configuration that you copied and commit the configuration.

This step typically goes through without problems. However, if you encounter a problem, log in to the device (using a console or a management interface), access the CLI, and verify that the stage-1 configuration was committed on the device.

Bootstrap Device—This task comprises the following sub-tasks:

1. A secure OAM tunnel (using IPsec) from the device to the OAM hub is established.

2. An outbound SSH connection from the device is established with CSO.

3. An Internal BGP (iBGP) peering between the device and the virtual route reflector (VRR) is established.

4. The device sends a Bootstrap Complete message to CSO, which CSO receives and marks the bootstrap as completed.

The device is now managed by CSO.

This task typically takes a few minutes to finish. If the status shows as Pending after about 10 minutes, try the troubleshooting steps.

1. Verify whether the stage-1 configuration was deployed on the device by executing the show configuration | display set | match outbound-ssh | match 7804 command.

   If the resulting output is similar to the following sample output, it means that the stage-1 configuration was deployed successfully.

   set system services outbound-ssh client 
   
   CSO-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 
   
   192.0.2.100 port 7804

2. Check if the secure OAM tunnels are up by executing the following commands:

   • show security ike sa command. If the State field in the output doesn't display UP, it means that port 500 is blocked. Ensure that you open 500 and retry the activation job (from the Jobs page).

   • show security ipsec sa command. If the State field in the output doesn't display UP, it means that port 4500 is blocked. Open port 4500, and retry the activation job (from the Jobs page).

3. Verify whether the device has established BGP peering with the VRR by executing the show bgp summary command.

   If the State field in the output displays Establ, it means that BGP peering is established successfully.

4. Verify whether the secure OAM session is established by executing the show security flow session destination-port 7804 command.

   If the resulting output is similar to the following output, it means that the secure OAM session was established successfully.

   Session ID: 430000098, Policy name: default-policy-00/2, Timeout: 1778, Valid
     In: 192.0.2.10/15190 --> 192.0.2.20/23;tcp, If: ge-7/1/0.0, Pkts: 109, Bytes: 5874, CP Session ID: 430000093
     Out: 192.0.2.20/23 --> 192.0.2.10/15190;tcp, If: ge-7/1/1.0, Pkts: 64, Bytes: 4015, CP Session ID: 430000093
   Total sessions: 1

Enabled

Interface-Based (Default)—CSO creates interface-based NAT rules.

Source NAT rules are automatically created, with each rule from a department zone to the WAN interface, with a translation of type interface. Each pair of [zone - interface] represents a rule-set.

For example, the following department zone to (WAN link) W1 interface rule-set might be created:

Dept-Zone1 --> W1: Translation=Interface

Dept-Zone2 --> W1: Translation=Interface

Dept-Zone3 --> W1: Translation=Interface

When traffic from a spoke site breaks out at an enterprise hub, a source NAT rule is automatically created at the enterprise hub from the department routing group (also referred to as VRF group) to the WAN interface.

Dept-vrf-group --> W1: Translation=Interface