Control Policy Example 2: Dynamic On-Demand Tunnels

When you configure a site to use dynamic tunnels, the on-demand functionality is enabled. In this mode of operation, Cisco SD-WAN Edge routers do not bring up direct tunnels to other sites that are also enabled with on-demand functionality.

Cisco SD-WAN chooses one or more WAN Edge routers (typically centrally located routers) to act as backup forwarding nodes, providing a secondary path for traffic between two nodes. The backup nodes are not enabled for dynamic on-demand tunnels. All on-demand sites establish static tunnels with the backup nodes. The backup nodes provide a static backup route for traffic between two nodes that have dynamic on-demand tunnels enabled.

The first packet of traffic between the two nodes is routed through the static backup path and triggers the on-demand tunnel to become active between the sites. The backup path continues to forward traffic until the direct path becomes active.

All on-demand sites learn the TLOCs and prefixes of all other on-demand remote sites. The prefixes also have a backup path set up through the Cisco vSmart controller control policy. So, in the control plane, the on-demand tunnel network has the same state as a full-mesh tunnel network, including a backup path. The WAN Edge device’s control plane and data plane contain routes with the backup path and routes with remote TLOCs that represent a potential direct path between any two sites, but it does not set up a direct path tunnel to remote TLOCs.

Traffic from either end of the on-demand tunnel triggers setting up the tunnel, which enables on-demand tunnels to accommodate Network Address Translation (NAT) traversal.

The on-demand tunnel feature introduces two states for the on-demand branch site:

• Inactive: The on-demand tunnel is not set up with the remote site. There is no active traffic to or from the remote site. Remote site TLOCs are inactive - no BFD is set up, the prefix is installed with the inactive paths, and the backup path is set as the path to forward any traffic. The inactive path detects flows and triggers a direct site-to-site tunnel to be set up.

• Active: The on-demand direct site-to-site tunnel is set up to the remote site. There is active traffic to or from the remote site. This state is identical to the case of a typical tunnel, where the remote TLOCs have BFD set up, and the prefix is installed with the direct path tunnel. In this state, tunnel activity is tracked. If there is no traffic for the “idle time” duration (default 10 minutes), the direct site-to-site tunnel is removed, and the state changes to Inactive.

On-Demand Tunnel Mechanism in Detail—Tunnel is initially Inactive

The figure shows the following steps that occur between two WAN Edge routers with an on-demand tunnel configured:

1. There is no active tunnel between the two WAN Edge routers. Both edge-1 and edge-4 are in Inactive state.

2. The host behind edge-1 initiates traffic toward the host behind edge-4.

3. The edge-1 device forwards the traffic through the backup path using the hub or backup node to edge-4.

4. The edge-1 device provisions the on-demand tunnel and begins BFD. The edge-4 device is now considered in active state on edge-1.

5. When the edge-4 device receives the return traffic destined for the host behind edge-1, it forwards the traffic through the backup path using the hub or backup node to edge-1.

6. The edge-4 device provisions the on-demand tunnel and begins BFD. The edge-1 device is now considered in active state on edge-4.

On-Demand Tunnel Mechanism in Detail—Tunnel is Active