Explain the working principles of the Cisco SD-WAN solution
1.3.a SD-WAN control and data planes elements
Cisco’s software defined wide area network (SD-WAN) is part of Cisco’s overall software defined networking solution for enterprise networks. The Cisco SD-WAN product is a WAN architecture overlay that integrates routing, security, centralized plicy, and orchestration into large-scale networks.
SD-WAN Architecture Components
Four planes of operation are involved in SD-WAN:
- Control plane: builds & maintains the network topology and makes forwarding decisions.
- Data plane: responsible for forwarding packets based on decisions made from the control plane.
- Orchestration plan: assists in the onboarding of routers into the SD-WAN overlay fabric.
- Management plane: responsible for central configuration & monitoring.
The primary components of an SD-WAN deployment are the vSmart controller (control plane), the WAN edge router (data plane), vBond orchestrator (orchestration plane), and network management system (management plane).
vSmart Controller
The vSmart controller is a software component that is responsible for the control plane of an SD-WAN network. The controller creates a DTLS tunnel to each edge router and distributes routes & policy information via Overlay Management Protocol (OMP). The tunnels are established when an edge router comes online and authenticates to the vSmart controllers using pre-defined credentials.
Once the DTLS tunnel is established, the vSmart controller processes the route information learned from each edge router, decides on a network topology and calculates the best routes to various destinations. It then advertises the reachability information for these destinations to the all routers in the SD-WAN. The controller also applies any policies to the routes before advertising them.
WAN Edge Router
Edge routers can be either hardware or software-based and provide data plane connectivity to the sites over WAN transports. An edge router in the SD-WAN network is responsible for traffic forwarding, security, encryption, QoS, and routing protocols. Two different edge router options are available for a Cisco SD-WAN deployment:
- vEdge: the Viptela platform running Viptela software.
- eEdge: the Viptela software integrated into IOS XE.
WAN edge routers user OSPF & BGP to learn reachability information. For redundancy, they can implement VRRP as an FHRP, on a per-VLAN basis. Edge routers also encrypt traffic between sites via IPSec tunnels.
vBond Orchestrator
The vBond orchestrator is a software component that performs the initial authentication of edge routers to the control plane. The orchestration plan performs the following:
- Joining the edge router to the overlay: Before participating in the overlay network, it needs to establish a connection to vManage to receive a configuration file; and also to the vSmart controller. Those two components will be automatically discovered once connected to the vBond orchestrator.
- Onboarding the edge router: configuring the edge router to connect to the vBond orchestrator can be done manually or automated. IOS XE routers running the Viptela software can booted with a configuration from the bootflash or a USB drive.
vManage
vManage is the software-based centralized management system for an SD-WAN deployment. It provdes a single pane of glass view of the SD-WAN components through a graphical interface. vManage can also provide centralized provisioning & policies, device configuration templates, and the capability to do software upgrades on all fabric elements. It can export performance statistics to an external system or to the Cisco vAnalytics tool; which is a optional analytics platform that offers visibility into the SD-WAN infrastructure. The Cisco SD-WAN architecture uses a REST API for programmatic configuration & monitoring of devices. The API plays a critical role for clients to use the vManage features. Some of the uses for the vManage API are:
- Monitoring device status
- Configuring devices
- Querying device statistics
SD-WAN Considerations
The following elements should be considered and determined for an SD-WAN deployment:
- IP addresses: SD-WAN devices can have private and public addresses, if they are placed behind a NAT device. vBond can act as STUN server, allowing SD-WAN routers to discover their own outside global addresses & port numbers.
- Transport locators (TLOCs): A TLOC is the point where a WAN edge router connects to the WAN transport network. It is identified by a three tuple; comprised of the device IP address, link color, and encapsulation.
- Overlay Management Protocol (OMP): OMP has a similar structure to BGP and manages the SD-WAN overlay network. Control plane information is exchanged between the vSmart controllers and WAN edge routers over a DLTS or TLS connection.
- VPNs: In an SD-WAN overlay, VPNs provide segmentation akin to VRFs. An interface or subinterface is configured under a single VPN and cannot communicate over more than one VPN. For the vBond, only two VPNs are functional:
- VPN 0: A transport VPN that contains the interfaces that connect to WAN transports.
- VPN 512: A management VPN that transports out-of-band management traffic to & from SD-WAN devices.
1.3.b Benefits and limitations of SD-WAN solutions
SD-WAN represents a shift hardware-based WANs to a software-driven overlay fabric that runs on top of standard WAN transport services. SD-WAN can offer new benefits over hardware-based WANs, but is still susceptible to the same problems as hardware WAN networks. One main benefit for using an SD-WAN solution over a traditional WAN is that SD-WAN creates overlay networks on top of a phyiscal underlay network, providing features that may not be available (or difficult to implement) in typical WAN designs.
Common uses of SD-WAN over traditional WANs are:
- Automated provisioning: an SD-WAN can discover a controller automatically, download a configuration, and establish IPsec tunnels with the rest of the network.
- Bandwidth augmentation: SD-WAN can distribute traffic across all available WAN transports, and prioritize traffic to lower cost circuits over higher cost circuits.
- VPN segmentation: traffic isolation is done by assigning router interfaces to separate VPNs, with traffic flowing over separate VPNs.
- Application-aware routing: enables customized SLAs for application traffic and directing application traffic over the most optimal path for that traffic.