Aruba SD-WAN. John Schaap 25 October #ArubaAirheads

Transcription

1 Aruba SD-WAN John Schaap 25 October 2018

2 Aruba Distributed Architectures SD-WAN MicroBranch (IAP-VPN) On the road (VIA) Enterprise DC 2

3 SD-WAN solution Overview 3

4 Overview Architecture Active DataCenter Backup DataCenter Aruba Cloud Platform Internet Probe Responder HTTPS Websocket IPsec Broadband MPLS Management Traffic PQM/HCM Probes Branch Corp Traffic Guest Traffic 4

5 WAN Health Check Monitor DC ICMP Probes measure Internet reachability. Recommended: pqm.arubanetworks.com DPD probes monitor tunnel status If HCM reports uplink down No src-natted traffic No communication with Aruba Central If DPD reports tunnel down Tunnels are torn down ADSL MPLS IPsec DPD Probes ICMP Probes Branch 5

6 Step 1: Build a secure overlay 6

7 Automatic tunnel establishment IPsec Corp Data Traffic Subnet A Subnet B Subnet A Subnet B Internet Traffic 7

8 Auto Hub & Spoke 1 Bring UP tunnels 2 Advertise branch subnets 3 Add routes to tunnels Branch subnets advertised upstream Corp routes pointing to the tunnel IPsec Corp Data Traffic Subnet A Subnet B Subnet A Subnet B Internet Traffic 8

9 Single DC L2 HA Using static routes Routes pointing branch subnets through VRRP between VPNCs VRRP VRRP Branch subnets advertised upstream via cfgset (ike ext) Corp routes pointing to the tunnel IPsec Corp Data Traffic Subnet A Subnet B Subnet A Subnet B Internet Traffic 9

10 Auto Hub & Spoke L2 HA Redistribute into OSPF 1 VRRP between 2 VPNCs 2 Track uplink interface/vlan VRRP 3 Preempt? use with caution (and delay) Branch subnets advertised upstream Corp routes pointing to the tunnel IPsec Corp Data Traffic Subnet A Subnet B Subnet A Subnet B Internet Traffic 10

11 Multiple hubs L2 and L3 can be combined Redistribute into OSPF Cost 20 Redistribute into OSPF Cost 10 Branch subnets advertised upstream to both DCs Corp routes to DC B Cost 20 Corp routes to DC A Cost 10 Subnet A Subnet B Subnet A Subnet B 11

12 Regional Hubs Active DataCenter Backup DataCenter 1 2 More specific route to regional DC Routes only redistributed locally or exported with high cost Regional DC Broadband MPLS Branch 12

13 Cloud Services integration Active DataCenter Backup DataCenter Set tunnel to Zscaler (site-to-site) Create PBR policy to force traffic through ZScaler Route advertisement not needed. Zscaler pins the session to the link it came from. AV/AM IPS SSL Decryption Sandboxing Broadband MPLS Branch 13

14 Step 2: Uplink load-balacing 14

15 Split-Tunnel Local peel off Data Center Only for reference Config is GUI-based! ip route route tun-vpnc1-mpls 10 ip route route tun-vpnc1-adsl 10! ip default-gateway mpls-gw ip default-gateway adsl-gw! ADSL MPLS Equal cost routes pointing to both interfaces Branch 15

16 Full-Tunnel Data Center Only for reference Config is GUI-based ip nexthop-list full-tunnel ipsec-map vpnc1-adsl priority 100 ipsec-map vpnc1-mpls priority 100 ipsec-map vpnc2-adsl priority 50 ipsec-map vpnc2-mpls priority 50! ip access-list route full-tunnel alias local-net alias local-net any forward any any any route next-hop-list full-tunnel! user-role POS access-list session POS access-list route full-tunnel ADSL Next-Hop list with both tunnels MPLS Branch 16

17 Local-breakout Only for reference Config is GUI-based Internet ip nexthop-list local-breakout ip dhcp vlan 4093 priority 100 ip dhcp vlan 4094 priority 100!! ip access-list route local-breakout alias local-net alias local-net any forward any any any route next-hop-list local-breakout! user-role guest access-list session guest access-list route local-breakout Next-Hop list with all or a subset of uplinks ADSL LTE Branch 17

18 Not so fast: DC Architectures 18

19 Datacenter Topologies Single Armed VPNC 1 Traffic comes into VPNC from tunnel A Datacenter 2 Reverse pinning - Traffic goes back through the original tunnel DMZ Reverse pinning ISP 1 ISP 2 19

20 Detail about Reverse-pinning (applies to all topologies) Datacenter Branch-initiated traffic 1 Traffic comes into VPNC from tunnel A DMZ 2 Reverse pinning - Traffic goes back through the original tunnel DC-initiated traffic ISP 1 ISP 2 1 Traffic sourced from DC goes to the Branch 2 VPNC has equal cost multipath towards the branch 3 Branch sends return traffic based on configured policy 4 VPNC pins the session to the path chosen by the BGW 20

21 Step 3: Dynamic Path Selection 21

22 Path Quality Monitoring DC ICMP Probes measure latency and packet loss > Global probe responder service: pqm.arubanetworks.com UDP Probes (UDP 4500) measure latency, packet loss and jitter MOS is derived from these values Probes can be sent through the underlay or through the overlay ADSL MPLS IPsec UDP Probes ICMP Probes Branch 22

23 WAN Policies Choose SLA parameters Specify Interesting 1 to measure WAN Traffic 2 3 performance Configure path preference parameters 23

24 Demo VPNC MPLS INET BG1 MPLS INET 33

25 Thank You