EMAIL SUPPORT

dclessons@dclessons.com

LOCATION

NZ

SD-WAN Control Policy Distribution

SD-WAN Control Policy Distribution

Posted on Jan 27, 2020 (0)

SD-WAN Control Policy Distribution

Task: Configure Control Policy in such a way that vSmart will send all vEdge Branch Router vEdge-002, vEdge-003, vEdge-004 OMP, routes to vEdge-001 (Which is DC) router and does not send (vEdge-002, vEdge-003, vEdge-004) routes to each other.

Use following task to achieve this task:

Topology:

Solution:

Before configuring the control policy, first let’s verify that all branches are sharing routes to each other

Now verify that each device has active BFD session working

Monitor | Network | on Device option select: BFD Session

Now to configure the Centralized policy, Go to Configuration | Policy | Add policy, here you will be under Create groups of interest.

Click on Site | New Site List | Provide details as given: dclessons-Branches, With ID 300,400, 200

Click on Next



Now on Configure Topology & VPN membership Click on Topology | Add Topology | Custom Control Routes & TLOC | Provide name dclessons-branches

Now Click on Sequence Type | TLOC

Provide details like Match Site List: Branches, Action Reject | Save & Match Action

Click on Default Action | Action: Accept | Save & Match Action

Now Save Control Policy

Click Next

Click Next

Now on Apply policy to Sites and VPN , Provide Policy  name : dclessons-dc-hubs and Click on Topology | New Site List

On outbound Site List ,  Select the dclessons-branches and Add

Now Save Policy and Copy the configuration on separate Notepad

Now Click on Configuration | policy | centralized Policy | Select Policy | Activate

Here you may find error that may say that vSmart is not managed by vManage, then in order to make this policy work, use the CLI configuration, which you copied in above steps and configure in vSmart as given below:

Now once done, Verify routes on vEdge-001(DC), and you will see that vEdge-001(DC) is receiving all routes from all other vEdge Branches

Now you are also able to reach to other vEdge Branches

But when you login to other vEdge router like vEdge-002 or vEdge-003, vEdge-004 then you will not able to see their routes , as it has been filtered by vSmart and will also not able to ping


Comment

    You are will be the first.

LEAVE A COMMENT

Please login here to comment.