Legacy networking technology has become increasingly expensive and complex, and it cannot scale to meet the needs of today's multisite enterprises. The Cisco Catalyst SD-WAN Solution, which is based on time-tested and proven elements of networking, offers an elegant, software-based solution that reduces the costs of running enterprise networks and provides straightforward tools to simplify the provisioning and management of large and complex networks that are distributed across multiple locations and geographies. Built in to the Cisco Catalyst SD-WAN Solution are inherent authentication and security processes that ensure the safety and privacy of the network and its data traffic.

Cisco Catalyst SD-WAN Solution represents an evolution of networking from an older, hardware-based model to a secure, software-based, virtual IP fabric. Cisco Catalyst SD-WAN fabric, also called an overlay network, forms a software overlay that runs over standard network transport services, including the public Internet, MPLS, and broadband. The overlay network also supports next-generation software services, thereby accelerating your shift to cloud networking.

The complexity in legacy enterprise networks stems from three main sources:

• There is no clear separation between entities that exchange data traffic and the transport network that binds these entities together. That is, there is no clear separation between hosts, devices, and servers on the service side of the network and the interconnects between routers on the transport side of the network.

• Policy and control decisions are embedded at every hop across the enterprise network.

• Security is a time-intensive, manual process, and security management must be implemented either at every node in the network or by using centralized security servers to manage group keys.

Cisco Catalyst SD-WAN uses time-tested and proven elements of networking in innovative ways to build the secure, virtual IP fabric. These networking elements include:

• Using routing and routing advertisements to establish and maintain the flow of traffic throughout the network.

• Layer 3 segmentation, sometimes called virtual routing and forwarding (VRF), to isolate different flows of traffic. This is useful to separate traffic from different customers or different business organizations within an enterprise.

• Peer-to-peer concepts to set up and maintain bidirectional connections between pairs of protocol entities

• Authentication and encryptions

• Policies for routing and data traffic

With five simple steps, Cisco Catalyst SD-WAN virtual IP fabric transforms a complex legacy network into an easy-to-manage, scalable network:

• Step 1: Separate transport from the service side of the network

• Step 2: Centralize routing intelligence and enable segmentation

• Step 3: Secure the network automatically

• Step 4: Influence reachability through centralized policy

• Step 5: Simplify orchestration and provisioning

Step 1: Separate Transport from the Service Side of the Network

The job of the transport network is to carry packets from one transport router to another. The transport network needs to know only about the routes to follow to reach the next-hop or destination router. It need not know about the prefixes for nontransport routers, the routers that sit behind the transport routers in their local service networks.

Separating network transport from the service side of the network allows the network administrator to influence router-to-router communication independently of the communication between users or between hosts.

This approach has many benefits:

• The network administrator can choose transport circuits based on SLA and cost.

• The routing system can assign attributes to transport links for optimal routing, load balancing, and policy-based routing.​

Step 2: Centralize Routing Intelligence and Enable Segmentation

Every router at the edge of a network has two sides for routing: one to the transport network and one to the service side of the network. To have any-to-any communication among all routers, all routers need to learn all prefixes. Traditionally, routers learn these prefixes using full-mesh IGP/BGP or by enabling routing on an overlay tunnel (for example, BGP or IGP over MPLS or GRE). Various techniques allow the scaling issues associated with full-mesh routing adjacencies to be mitigated or eliminated, such as employing a route reflector for BGP.

The Cisco Catalyst SD-WAN fabric builds on the route reflector model by centralizing routing intelligence. Essentially, all prefixes learned from the service side on a router are advertised to a centralized controller, which then reflects the information to other routers over the network's control plane. The controllers do not handle any of the data traffic; they are involved only in control plane communication.

This approach has many benefits:

• The centralized controller can use inexpensive or commodity servers for control plane processing.

• The routers can use off-the-shelf silicon, allowing cost benefits from economies of scale.

• Scale challenges associated with full-mesh routing on the transport side of the network are eliminated.

• The network administrator can create multiple segments without the need for complex signaling protocols. For example, in the figure here, all Px prefixes can be part of one VPN, while all Sx prefixes can be part of a different VPN.

Note

The centralized controller only “influences” routing on the routers. The controller does not participate in every flow going through the network, nor does it participate in routing on the service side. This design allows the routers to have local intelligence—enough intelligence to make local site decisions quickly.

Step 3: Secure the Network and Links Automatically

The Cisco Catalyst SD-WAN fabric identifies transport side links and automatically encrypts traffic between sites. The associated encryption keys are exchanged over a secure session with the centralized controller. Secure sessions with the controller are set up automatically using RSA and certificate infrastructure.

This approach has many benefits:

• The Cisco Catalyst SD-WAN fabric itself authenticates all devices participating in the network, which is an important step to secure the infrastructure.

• The fabric automatically exchanges encryption keys associated with the transport links, eliminating the hassle of configuring thousands of pair-wise keys.

• The fabric ensures that the network is not prone to attacks from the transport side.​

Step 4: Influence Reachability through Centralized Policy

Policy configured on a centralized controller strongly influences how prefixes are advertised among the routers. For example, if all traffic between routers P3 and P4 in the figure here has to make a U-turn at router vEdge-1, the network administrator can apply a simple route policy on the centralized controller. The controller then passes the policy to the affected edge routers. The network administrator does not need to provision the policy on each individual router.

This approach has many benefits:

• The controller centrally influences access control, that is, which prefixes are allowed to talk to each other inside a VPN.

• The controller optimizes user experience by influencing transport link choice based on SLA or other attributes. The network administrator can color transport links (such as gold and bronze), and allow applications to map the colors to appropriate transport links.

• The network administrator can map business logic from a single centralized point.

• The network can react faster to planned and unexpected situations, such as routing all traffic from high-risk countries through an intermediate point.

• The network can centralize services such as firewalls, IDPs, and IDSs. Instead of distributing these services throughout the network at every branch and campus, the network administrator can centralize these functions, achieving efficiencies of scale and minimizing the number of touch points for provisioning.

Step 5: Simplify Provisioning and Management

Legacy network devices are provisioned and monitored manually through a CLI. Network administrators must type configurations line by line, and enter operational commands one at a time on individual devices in order to retrieve and read status information. This method is error prone and time consuming when provisioning and troubleshooting a network, and it can present serious difficulties when devices are in remote locations or when management ports are inaccessible.

Cisco Catalyst SD-WAN centralizes and significantly simplifies provisioning and management through Cisco SD-WAN Manager. Cisco SD-WAN Manager provides an easy-to-use, graphical dashboard from which you can monitor, configure, and maintain all Cisco vEdge devices and links in the overlay network. For example, the GUI dashboard provides a templated view of various configurations to ease provisioning a service, so all common elements, such as AAA and company-specific servers, can be pushed to multiple devices with a single click, from a single point.

This approach has many benefits:

• The network administrator provisions and manages the network as a whole, efficiently and easily, as opposed to a piece-meal approach that deals with individual devices one at a time.

• The network administrator has improved network visibility (for example, viewing network-wide VPN statistics) from a single point.

• Troubleshooting tasks are simplified and presented visually, instead of requiring network administrators to read lengthy configurations and output from individual devices.

The secure, virtual IP fabric of Cisco Catalyst SD-WAN is made up of four fundamental components:

• Cisco SD-WAN Manager: Cisco SD-WAN Manager is a centralized network management system that lets you configure and manage the entire overlay network from a simple graphical dashboard.

• Cisco SD-WAN Controller: The Cisco SD-WAN Controller is the centralized brain of the Cisco Catalyst SD-WAN solution, controlling the flow of data traffic throughout the network. The Cisco SD-WAN Controller works with the Cisco SD-WAN Validator to authenticate Cisco vEdge devices as they join the network and to orchestrate connectivity among the edge routers.

• Cisco SD-WAN Validator: The Cisco SD-WAN Validator automatically orchestrates connectivity between edge routers and Cisco SD-WAN Controllers. If any edge router or Cisco SD-WAN Controller is behind a NAT, the Cisco SD-WAN Validator also serves as an initial NAT-traversal orchestrator.

• Cisco IOS XE Catalyst SD-WAN and Cisco vEdge Devices: The edge routers sit at the perimeter of a site (such as remote offices, branches, campuses, data centers) and provide connectivity among the sites. They are either hardware devices or software (Cloud router), that runs as a virtual machine. The edge routers handle the transmission of data traffic.

Of these four components, the edge router can be a Cisco Catalyst SD-WAN hardware device or software that runs as a virtual machine, and the remaining three are software-only components. The Cloud router, Cisco SD-WAN Manager, and Cisco SD-WAN Controller software runs on servers, and the Cisco SD-WAN Validator software runs as a process (daemon) on a edge router.

The figure below illustrates the components of Cisco Catalyst SD-WAN. The sections below describe each component in detail.

To streamline and optimize cloud networking, Cisco Catalyst SD-WAN offers next-generation software services that run on the secure, virtual IP fabric:

• Cloud onRamp for SaaS: Cloud onRamp for SaaS optimizes the performance of Software as a Service (SaaS) cloud applications. It provides clear visibility of the performance of individual applications and automatically chooses the best path for each one. Cloud onRamp calculates metrics about loss and latency using a formula customized for each application.

• Cisco SD-WAN Analytics: Cisco SD-WAN Analytics is a SaaS service hosted by Cisco Catalyst SD-WAN as part of the solution. It provides graphical representations of the performance of your entire overlay network over time and lets you drill down to the characteristics of a single carrier, tunnel, or application at a particular time.

• Cisco Catalyst SD-WAN Portal: Cisco Catalyst SD-WAN Portal is a cloud-infrastructure automation tool tailored for Cisco Catalyst SD-WAN, which provides a quick way to provision, monitor, and maintain Cisco SD-WAN Controllers on public cloud providers.

Cisco SD-WAN Manager Cluster

Cisco SD-AVC must operate on only one Cisco SD-WAN Manager instance. In a Cisco SD-WAN Manager cluster, enable Cisco SD-AVC on only one instance of Cisco SD-WAN Manager.

Let’s use a simple network design, one that has two vEdge routers and one Cisco SD-WAN Controllers, to illustrate how to form a functioning overlay network from Cisco vEdge components. In this topology, the Cisco SD-WAN Validator software has been enabled on one of the vEdge routers. Once you understand a simple network, you can start designing and building more complex topologies.

A Simple Network Topology

The following figure illustrates our simple topology. Here, we have two sites, Site-100 and Site-200. vEdge-1 is the edge device in Site-100, and vEdge-2 is the edge device at Site-200. At each local site, the vEdge router connects to an existing traditional router via a standard Ethernet interface. vEdge-2 is connected to the transport network through a NAT device that also has firewall functionality.

The goal of our design is to create a private network so that Router-1 and Router-2 can be next to each other from a Layer 3 perspective and so that hosts connected to each of these routers can communicate through the private network.

Construct a Basic Network

The following steps allow you to create the simple overlay network depicted in the topology above.

• Step 1: Perform initial bringup and basic configuration.

• Step 2: Enable host or service-side interfaces and routing.

• Step 3: Enable overlay routing over OMP.

• Step 4: Check the automatic setup of the IPsec data plane.

• Step 5: Enforce policies.

Let’s look at the steps in a bit more detail.

Step 1: Perform Initial Bring up and Basic Configuration

From the perspective of a network administrator, the initial bringup of the Cisco vEdge network components is a straightforward and simple process, involving creating the configurations for each of the network components and ensuring that a few key authentication-related files are in place. From the perspective of user, bringup entails simply powering up the vEdge router and plugging in a cable to connect the router to the network. The remainder of the bringup occurs automatically via a zero-touch-provisioning process.

The network administrator performs the following tasks as part of the initial bringup:

1. Configure the Cisco SD-WAN Validator function on one of the vEdge routers in the network. In our example, this is vEdge-1.

2. Optionally, configure a top-level Cisco SD-WAN Validator to act as a ZTP server. In this situation, a DNS server must be present in the enterprise network.

3. Ensure that a DHCP server is present in the enterprise network.

4. Install the signed certificate on Cisco SD-WAN Manager, and download that certificate to Cisco SD-WAN Manager orchestrator.

5. Install the vEdge router authorized serial number file on Cisco SD-WAN Manager, and then download it to the Cisco SD-WAN Controllers.

6. From Cisco SD-WAN Manager CLI, create a configuration for each Cisco Catalyst SD-WAN Controller and vEdge router in the overlay network:

   1. ​Configure a system IP address, which is similar to the router ID address on a traditional router, identifying the Cisco vEdge device with an address that is independent of any of the interfaces on the device. System IP addresses must be pre-allocated and must be unique across each vEdge router and Cisco Catalyst SD-WAN Controller. These addresses need not be routable through the network.

   2. Configure site IDs for the various sites in the overlay network. In our example, vEdge-1 is at site-100 and vEdge-2 is at site-200. The Cisco Catalyst SD-WAN Controller can be collocated at a site, or it can be in its own site.

   3. Configure domain IDs. This is an optional step to create clusters. For our example, configure the domain-ID as 1.

   4. ​Configure the IP address or DNS name for the Cisco SD-WAN Validator server and the Cisco Catalyst SD-WAN Controller.

   5. Configure WAN interfaces on vEdge-1 and vEdge-2. VPN 0 is the VPN reserved for WAN transport interfaces. IP addresses can be automatically obtained through DHCP. Alternatively, you can configure a default gateway and DNS explicitly.

   6. By default, DTLS and IPsec are enabled on the WAN interfaces.

   7. Save the configuration.

When the Cisco SD-WAN Controllers join the network, they are authenticated by the Cisco SD-WAN Validator, and when vEdge routers join the network, they are authenticated by both the Cisco SD-WAN Validator and the Cisco SD-WAN Controllers. These devices then connect to Cisco SD-WAN Manager, which downloads the configuration to them.

Example Configuration on vEdge-1:

system
  host-name vEdge-1
  system-ip 1.0.0.1
  domain-id 1
  site-id   100
  vbond 75.1.1.1  local
!
vpn 0
  interface ge 0/0
    ip address 75.1.1.1/24
    tunnel-interface
      color default
    no shutdown
  ip route 0.0.0.0/0 75.1.1.254
!

The remaining sections in this article describe how to configure other common functionality on vEdge routers and Cisco SD-WAN Controllers. Typically, you configure all functionality at one time, in the configuration that you create on Cisco SD-WAN Manager and that is downloaded to the device when it joins the overlay network. However, to highlight the different functionalities, this article describes the various portions of the configuration separately.

Step 2: Enable Host or Service-Side Interfaces and Routing

From Cisco SD-WAN Manager, you can also configure service-side interfaces and regular routing:

1. Configure interfaces on vEdge-1 towards the existing traditional router. Assign IP address and put the interface in a non-default VPN. In our example, this is VPN 1. Do the same on vEdge-2.

2. Configure OSPF or BGP on the vEdge routers towards the existing routers

3. Commit

To check for standard IP reachability, routes, and next hops at the local site, use the standard ping, traceroute, and various show commands on Cisco SD-WAN Manager or from the CLI of the device (if you have a direct connection to the device):

Example Configuration for the Host or Service-side VPN:

vpn 1
  router
    ospf
      redistribute omp
      area 0
        interface ge 0/1
        exit
      exit
    !
  !
  interface ge 0/1
    ip address 10.1.2.12/24
    no shutdown
!

Step 3: Enable Overlay Routing over OMP

All site-local routes are populated on the vEdge routers. Distributed these routes to the other vEdge routers this is done through the Cisco Catalyst SD-WAN Controller, via OMP.

1. If you are using BGP or if there are OSPF external LSAs, allow OMP to redistribute the BGP routes.

2. Re-advertise OMP routes into BGP or OSPF.

3. Commit.

Example Configuration of Overlay Routing over OMP:

omp
  advertise ospf external
!

At this point, vEdge-1 is able to learn about the prefixes from site-200, and vEdge-2 is able to learn about prefixes from site-100. Because all the prefixes are part of VPN 1, the hosts in site-100 and site-200 have reachability with one another. From a Cisco Catalyst SD-WAN overlay network point of view, this reachability is possible because vEdge-1 advertises a vRoute consisting of the address 10.100.0.0/24 and the TLOC color of default, which we write as {75.1.1.1, default }, to the Cisco Catalyst SD-WAN Controller. In turn, the Cisco Catalyst SD-WAN Controller advertises this vRoute to vEdge-2. The same process happens with prefix 10.200.0.0/24 on vEdge-2.

Step 4: Check the Automatic Setup of the IPsec Data Plane

For every TLOC on a vEdge router, the vEdge router advertises a symmetric key for encryption. The Cisco Catalyst SD-WAN Controller reflects this key automatically and advertises the TLOC with the symmetric key. A two-way IPsec SA is set up as a result (that is, there is a different key in each direction), and data traffic automatically starts to use this IPsec tunnel. Once a tunnel is up, BFD automatically starts on the tunnel. This is done to ensure fast data plane convergence in the event of a failure in the transport network.

The setup of the IPsec data plane happens automatically. No configuration is necessary. Multiple show commands are available to check the SAs and the state of the IPsec tunnel.

Step 5: Enforce Policies

As an optional step, you can create control and data plane policies on the Cisco Catalyst SD-WAN Controller and push them to the vEdge routers. As an example, if the network administrator wants to enforce a policy to divert traffic destined to { vEdge-2, prefix 10.200.0.0/24 } to go to another site say vEdge-3, a control plane policy can be created on the Cisco Catalyst SD-WAN Controller and pushed to the respective vEdge routers. The results of the policy are pushed to the vEdge routers, not the configuration itself.

Example Configuration of Policies:

policy
  lists
    site-list site-100
      site-id 100
    !
    prefix-list my-prefixes
      ip-prefix 10.200.0.0/24
    !
  control-policy TE-thru-vedge3
    sequence 10
      match route
        prefix-list my-prefixes
      !
      action accept
        set
          tloc 1.0.0.3 color default
        !
      !
      default action accept
    !
apply-policy
  site-list site-100
    control-policy TE-thru-vedge3 out
  !
!

Advanced Options

Now that we have looked at basic routing, security, and policy, we can start adding various other elements to the network. You are encouraged to look at the Software category to add elements such as High Availability, Convergence, BFD, QoS, ACLs, segmentation, and advanced policy.

The following figure summarizes the terminology used to describe a Cisco Catalyst SD-WAN overlay network.