VMware SD-WAN delivers a highly reliable and secure application-centric service for even the most latency-sensitive applications, independent of the underlying links. This is achieved by leveraging a simplified cloud-based platform that delivers the required business agility, performance, and simplicity. VMware SD-WAN ensures the secure delivery of traffic across various transports including the internet. It uniquely delivers simplified management with elimination of traditional CLI-based configuration and monitoring.
Follow the steps below for a quickstart of the VeloCloud lab environment and to download the full Lab Guide.
Before you Begin
In order to complete this product walkthrough please make sure you have the following:
- A valid account in the VMware TestDrive environment, sign up here if you do not have one.
- TCP & UDP ports 80, 443, 8443; and if using PCoIP, both TCP & UDP 4172
- An Horizon Client installed on your machine.
Section 1: Enabling a VMware SD-WAN Lab Instance and Accessing the RDSH Jumpbox
First, open a web browser of your choice and navigate to portal.vmtestdrive.com. Select LOG IN. If you do not already have an account please reference the instructions found here.
Enter your TestDrive Username and Password and select ENTER.
Next, locate the VMware SD-WAN product under the Intrinsic Security tab. Toggle Enable Product switch to enable a lab instance for your account.
You'll get a notification that the product is being turned on for your account. Once the provisioning is complete, the SD-WAN service will update and show a count down timer. This is how much time you have left to use your SD-WAN environment.
Once the service finishes provisioning, expand the product tile to see the information and credentials you will need for the lab.
The credentials section shows you the TestDrive Credentials username and password to use for Workspace ONE to access the Horizon Desktop. This section also shows URLs and credentials you will need for your lab instance. Please refer back to these credentials as you follow the steps in the guide.
Click LAUNCH and LAUNCH VIA WORKSPACE ONE.
A new tab will open with Workspace ONE. Enter your TestDrive Username and Password, then hit Sign In.
Next, search for SD-WAN. In the search results, click on the VMware SD-WAN desktop icon to launch the RDSH desktop via HTML access or Horizon Client access.
Now you'll be on the VMware SD-WAN RDSH desktop.
Section 2: Accessing the Connections Home Page and the Orchestrator
Within the VMware SD-WAN RDSH desktop, launch Google Chrome from the shortcut on the desktop and enter the Guacamole URL listed in the SD-WAN product tile on the TestDrive portal and hit Enter.
Below is an example of the formatted URL to enter. Please use the one listed in your own Portal view.
At the Guacamole login screen, enter the Username and Password listed in your Portal view.
After successful login, you will be presented with the Home Page which gives you access to all the sites and devices.
To access sites with + sign, expand the connection by clicking on the + sign. The below figure shows expansion of the DC1 Site. Expanding a site allows you to access all the resources available for that site.
With the multiple connections shown, you have the option to click on a connection to access it and use the browser back button to navigate back to the home page to access other connections or you can right click on each connection to open it in a separate browser tab.
Below is an example of using a right click to open the DC1-CLIENT-01 in a new browser tab.
Lab Design Walkthrough
Data Center Design
- Each Data Center will have a VMware SDWAN Cluster of 2 Edges each.
-
Each Edge in the Cluster will – (LAN side config)
- Connect on the LAN side on GE2 to DC(X)-SW-01.
- In the Global Segment, form BGP Peering with DC(X)-SW-01 and receive routes of local subnets and the DCI routes.
- Advertise to the DC(X)-SW-01, routes from the Branches.
-
Each Edge in the Cluster will – (MPLS side config)
- Connect to MPLS Router on GE4.
- Be configured with a static IP.
- Form tunnels over MPLS with Branch Edges.
-
Each Edge in the Cluster will – (Internet side config)
- Connect to Internet Router on GE3.
- Receive a DHCP IP.
- Form tunnels over Internet with Branch Edges.
- The Edges will connect to the VMware SASE Orchestrator and SASE Gateways over Internet.
Branch Design
SFO Branch
- SFO has a VMware SDWAN Edge.
-
LAN side -
- Edge is connected to the switch SFO-SW-1 on GE2.
- Edge is connected to Client SFO-Guest-1 on GE5.
- In the Global Segment, the Edge will form BGP Peering with SFO-SW-1.
- In the Guest Segment, create a sub interface on GE5 and advertise this subnet to the overlay. This sub interface will be the default gateway for all the guest users at the site.
-
WAN side -
- Edge is connected to Internet router on GE3.
- Edge is connected to MPLS router on GE4.
- The Edge will form overlay tunnels to its Data center hubs over Internet and MPLS.
NYC Branch
- NYC has a VMware SDWAN Edge.
-
LAN side -
- Edge is connected to the switch SFO-SW-1 on GE2.
- In the Global Segment, the Edge will form OSPF Peering with NYC-SW-1.
-
WAN side -
- Edge is connected to Internet router on GE3.
- Edge is connected to MPLS router on GE4.
- The Edge will form overlay tunnels to its Data center hubs over Internet and MPLS.
Profiles
This page will display the Profiles that are already created and how many Edges theyre being used by. The Quick Start Profile is a default profile that isnt used in this lab. The Branch Profile is being used by the NYC and SFO branches. The data centers are each using their own profile.
With VMware SD-WAN, all configurations start with a Profile. The Profiles provide a configuration template that can be applied to multiple Edges. When an Edge is attached to a Profile, it inherits the configuration so that only the site-specific information such as IP addresses will be required. Future configuration updates are also automated because any changes made to the Profile will be pushed to all the Edges attached to that Profile.
In this lab environment, there are four profiles that are already created but with minimal configuration. In the following steps, well introduce you to our Profiles in the Orchestrator.
1. In the Orchestrator, select the Configure tab and then on the left menu, select Profiles.
This page will display the Profiles that are already created and how many Edges theyre being used by. The Quick Start Profile is a default profile that isnt used in this lab. The Branch Profile is being used by the NYC and SFO branches. The data centers are each using their own profile.
2. From the Profiles page, select the DC1-Hub-Profile
This should bring you to the Device configuration where you'll find configuration for interfaces, VLANs, routing, overlay tunnels, and any other general networking features.
3. On the DC1-Hub-Profile, scroll down to and expand the Cloud VPN section under VPN Services.
The Cloud VPN configuration controls how overlay tunnels are built between Edges. At hubs, the only required configuration is to turn the Cloud VPN feature on. Thats because the hubs will respond to the branches that attempt to build tunnels. Well explain this section in more detail later in the guide.
4. Continue scrolling to BGP under the Routing & NAT section
This section has also come preconfigured in the lab with the local ASN and a filter list. The only thing required for BGP on a specific Edge would be adding the neighbor information.
Edge Provisioning
After the Profile is configured, an Edge can be deployed. The Edge needs to be attached to a Profile and then any site specific information added such as IP addresses. Once the specific Edge configuration is completed, it can be activated.
There are two methods of activation: Auto-Activation and Email Activation. With Auto-Activation, the Edge only needs to be powered on and connected to the Internet. The email activation requires a user at the site to connect to the Edge and then click a URL that was provide by the Orchestrator. While the email activation does require a manual step, its made with non-technical people in mind that may be doing the installation. It also supports automatically provisioning static IP addresses whereas Auto-Activation will require DHCP on the Internet circuit. More info on both methods can be found in the References section.
All of the Edges in this lab have already been created and activated. To demonstrate the process of provisioning an Edge, well walk through creating a sample Edge in the following steps.
1. In the Orchestrator, select the Configure tab and then on the left menu, select Edges.
This screen will display all Edges that are configured, what Profile they're using, their software version, and other information. You should see the six Edges that already created for the lab here.
2. On the Edge configuration page, click Add Edge.
The Provision an Edge screen will appear and allow you to configure the Edge Name, model, profile, and other options.
For this example, add the Edge with the following information, everything else can be left default for now:
- Name: Test-ZTP
- Model: Virtual Edge
- Profile: Branch Profile
- Edge License: ENTERPRISE 10 Gbps
3. Click Next and then on the following screen, click Add Edge
4. Explore the Edge configuration that was inherited from the Profile.
After adding the Edge, you’ll be taken to the device configuration page. Before the Edge is activated, you’ll see the activation key displayed at the top of the page. We also haven’t added much to the Branch Profile yet but you can still see some differences from the Profile configuration in the previous section. For example, you won’t be able to make many configuration changes here because we want to enforce standardization across your sites whenever possible. When a site does need a unique configuration that differs from the Profile, you can use the Override check box.
5. Go to the Overview tab
When using the email activation method, this is done from the overview tab. After sending the activation email to the on site personnel, they’ll connect to the Edge and click the URL provided in the email. This URL will tell the Edge the Orchestrator name, the activation key, and will automatically provision any static IP addresses for Internet circuits.
Clustering and High Availability
For physical device redundancy, there are two different options depending on the use case.
High Availability (HA) operates by connecting two Edges together that become mirror images of each other and are managed and configured as a single device. The Edges are deployed to a site as a pair and will be in an Active/Standby mode. If the Active Edge loses connectivity or a physical interface goes down, well failover to the standby device. While the Edges are in an Active/Standby mode, its important to note that well use all WAN circuits as Active/Active even when theyre connected to our Standby Edge.
While Clustering does provide redundancy, the main use case for clustering is for scale. HA is limited to the scale of a single device whereas clustering essentially combines the resources of multiple Edges. All devices in the cluster are Active and will be managed separately. The Orchestrator will automatically control which cluster member that branch Edges will build tunnels to.
Due to limitations of this lab environment, we cant show HA but well configure Clusters for the two data centers. For more information on HA, please see the references section.
Clustering at the Data Centers
In the following steps, we’ll create two clusters, one for each data center.
1. Navigate to the Configure tab and then click Network Services on the left.
2. Under the SD-WAN Destinations section, open Clusters and Hubs, and then click New.
For DC1, name the cluster DC1-Cluster and select the checkboxes for DC1-VCE-01 and DC1-VCE-02. Save changes.
3. Repeat the previous step for DC2.
4. You should now see two clusters listed, each with two edges.
5. Navigate to the Monitor tab.
On the Network Overview tab, you should see that all four of the DC Edges have Cluster listed in the HA column.
6. Navigate to the Network Services tab on the left. Then select Edge Clusters.
This page should display your clusters and provide an overview of their resource usage.
Interfaces
In this reading exercise, you will understand how interfaces are configured in VMware SDWAN.
The exercise will review the interface configuration on DC1-VCE-01. The steps can be followed to review configuration on other Edges.
1. Navigate to the Configure tab and then click Edges on the left panel.
2. Select DC1-VCE-01. The device tab on the edge will be visible.
3. Scroll down and expand the Interfaces section under Connectivity. This will list all the interfaces on the Edge. Review the following
a. Interfaces GE1 to GE8 are listed. This will depend on device type. For device type = virtual, these interfaces will be listed.
b. GE3 has a DHCP address, WAN link is configured as ‘Auto-Detect’. This is the Internet facing WAN interface.
c. GE3 has a Static address, WAN link is configured as ‘User Defined’. This is the MPLS facing WAN interface.
d. GE2 has a Static address, WAN link is not enabled. This is the LAN facing interface of the Edge.
4. Click on GE3 and this will bring in the interface specific configuration on this interface.
Notice that ‘Enable WAN Link’ is checked.
5. Scroll down to the IPv4 Settings to look at addressing information. Notice that ‘Addressing Type’ is set to DHCP.
6. Click on CANCEL to go back to the Interfaces list. Click on GE4.
7. Notice that ‘Enable WAN Link’ is checked.
8. Scroll down to the IPv4 Settings to look at addressing information. Notice that ‘Addressing Type’ is set to Static with an IP Address, CIDR Prefix and Gateway configured.
9. Click on CANCEL to go back to the Interfaces list. Click on GE2. Notice that ‘Enable WAN Link’ is not checked.
10. Scroll down to the IPv4 Settings to look at addressing information. Notice that ‘Addressing Type’ is set to Static with an IP Address, CIDR Prefix and Gateway configured.
