Configuring the B01 Branch Office ip|engine

B01 is configured in full router mode and is connected to the Data Center through one tunnel over the Internet. Another tunnel connects B01 to B02.

Identifying the ip|engine

After the B01 ip|engine with the 'SN234567' Serial Number (and its Model/Version information) has been automatically provisioned in the SD-WAN Orchestrator from the ZTP Server, as indicated via the sign, it appears under the 'Not Configured' tab of the Network -> Configuration window.

Proceed as follows to identify and further configure the ip|engine.

In the Network -> Configuration window, click

to edit the ip|engine.

In the Deployment Mode panel, select the Router option and hit the

icon to enable the related panels and functions of the interface.

In the General panel, enter the Name of the ip|engine as well as the name of the related Site (B01).

The button at the right of the Site Name enables you to display the Site subnets.

Select the Auto option of the Local AS parameter. The related field is automatically populated with a number selected by the Orchestrator from the AS Number Range you have specified in the Overlay Routing panel of the Advanced Configuration window.

This parameter is used in the B01 WAN for tunnel mapping between this Site and the other Sites it will be connected to (Data Center and B02).

Through the Role field, define the ip|engine as a Spoke since it identifies a Branch Office ip|engine (generates tunnel requests). Tunnels are always built from the spokes to the hub.

Since NATted DTI traffic is enabled on the WAN1 interface, select the Syslog Server you defined in "Advanced Configuration" to enable log export.

WAN Optimization is activated by default on this ip|engine if the matching license is available.

Configuring the LAN

As a second step, configure the B01 ip|engine LAN which includes one physical interface. Refer to "Use Case 1" diagram where the LAN information is displayed in blue.

Click the Interfaces tab.

Enter the ip|engine Management IP address (10.1.1.2), Prefix Length (24).

The Management IP address is used for communicating with other ip|engines, the ZTP Server and the Orchestrator.

Use the default Auto Generated option (creation window only) to let the system allocate LAN addresses automatically to the Routers (Router X IP = Management IP + X) linked to the WANs in Router mode that you will configure for this ip|engine. Also refer to "IP Address allocation".

In this example, only Router 1 IP address will be automatically defined as it corresponds to WAN1.

Do not enter any VLAN ID. Note that the grey values appearing in some fields of the interface are only given as examples and are not taken into account in the configuration.

Since there is no router in the B01 LAN for exchanging routing tables, there is no additional subnet or sub-interface to define for configuring BGP peering or OSPF adjancencies.

Leave the Speed parameter to Auto to let the system define the speed of the interface, or you can force the speed to 100FD or 1000FD. The full duplex speed is expressed in megabits per second.

The following window displays the validated settings.

Configuring the WAN

As a third step, configure the WAN linked to the B01 ip|engine: Internet. Refer to "Use Case 1" diagram where WAN1 (Internet) details are displayed in orange.

Activate the WAN through the

icon. You may now enter field data.

Define this interface in Router mode.

With the DHCP parameter activated by default, the interface IP Address, Prefix Length and Default Gateway are dynamically allocated (by the DHCP server of the Internet Access Router) to the interface, since this WAN interface is connected to the Internet.

As you already defined the 'Internet' type of Transport Network for the Data Center WAN2, select it from the stack.

When configuring a WAN for the first time, type the name of the network you are connected to, 'Internet' in the current example. Clearly identify each name through customization. Once a Transport Network type has been defined, you can select it from the stack when configuring subsequent WANs.

This interface is automatically eligible to DTI (Inherited ON) because you globally activated this policy for the 'Internet' Transport Network (refer to Advanced Configuration -> Transport Network Settings). You may also manage DTI individually for this Internet L3 interface by checking the ON or OFF options.

Directly derived from the activated Eligible DTI option, keep the Enable NAT mode activated. This is a source-NAT where the LAN Management IP address (10.1.1.2) is replaced with the 192.168.1.2 WAN1 IP address. This NAT only applies to the traffic sent over the Internet. The traffic to the Data Center and to other Sites is transferred through the IPsec tunnels.

If you deactivate the Enable NAT mode which controls the firewall, incoming connections from the WAN are allowed to go to the LAN.

The Preference parameter is not available for a Spoke ip|engine.

In the Access Bandwidth fields, define the up and down throughput (in kilobits per second) allocated to the WAN: 5000.

Enter the MTU value which corresponds to the maximum number of bytes loaded in the Payload. The default value is 1500.

Leave the Speed parameter to Auto to let the system define the speed of the interface, or you can force the speed to 100FD or 1000FD. The full duplex speed is expressed in megabits per second.

The Internal Tunnels stack of values contains the WAN interfaces of the remote sites connected to the same network as the B01 WAN1 interface. These interfaces are automatically detected by the Orchestrator. In "Use Case 1", the system offers 'B02-WAN3' you can add as additional connection to create a tunnel between B01 and B02.

The Preference parameter is meaningless in this Use Case because there is only one Data Center ip|engine.

The External Gateways panel is used to connect this WAN interface to a Web Security Gateway. Refer to "Use Case 9".

Define Local Port Forwarding by selecting the TCP Protocol, typing 8080 as External Port, 10.1.1.12 as the Local IP Address and 80 which is the generally used Local Port for HTTP traffic.

Validate your input by hitting the Create button. The Overlay IP address is generated by the system.

If the ip|engine already exists and you modify any data, click the Update button.

Also see how to configure:

traffic redirection to an external gateway

traffic redirection to a web security gateway

traffic redirection to EdgeSentry