SD-WAN Lab Note Part 2

-------------------------------------------------------------------------------------------------------------------------------

Service VPN1 Static Routes and CLI and Templates

vEdge1

vpn 1

ip route 10.1.0.16/32 10.1.16.2

ip route 10.5.16.0/24 10.1.16.2

vSmart# show omp peers

DOMAIN OVERLAY SITE

PEER TYPE ID ID ID STATE UPTIME R/I/S

------------------------------------------------------------------------------------------

10.3.0.1 vedge 1 1 3 up 2:19:17:08 2/0/11

10.4.0.1 vedge 1 1 4 up 2:19:56:24 2/0/11

10.5.0.1 vedge 1 1 5 up 0:21:38:09 1/0/12

10.12.0.1 vedge 1 1 12 up 0:03:07:51 6/0/7

10.12.0.2 vedge 1 1 12 up 0:18:24:16 2/0/11

vEdge2

Edit "vEdge_Dual_Site_VPN1_Template"

vEdge2# show run vpn 1

…

ip route 10.1.0.16/32 10.2.16.2

ip route 10.5.16.0/24 10.2.16.2

vEdge 3 and 4

Edit "vEdge_Single_Site_VPN1_Template"

vEdge3# show run vpn 1

vpn 1

interface ge0/4

ip address 10.3.13.1/24

no shutdown

ip route 10.3.130.0/24 10.3.13.2

ip route 13.13.13.13/32 10.3.13.2

vEdge4# show run vpn 1

vpn 1

interface ge0/4

ip address 10.4.15.1/24

no shutdown

ip route 10.4.150.0/24 10.4.15.2

ip route 15.15.15.15/32 10.4.15.2

vEdge5

Edit "vEdge_MPLS_Only_VPN0_Template"

vEdge5# show run vpn 1

vpn 1

interface ge0/4

ip address 10.5.14.1/24

no shutdown

ip route 10.5.140.0/24 10.5.14.2

ip route 14.14.14.14/32 10.5.14.2

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Service VPN1 DHCP and VRRP via CLI and Templates

vEdge1

vpn 1

interface ge0/7

ip address 10.5.6.1/24

no shutdown

vrrp 56

priority 150

track-omp

ipv4 10.5.6.254

dhcp-server

address-pool 10.5.6.0/24

offer-time 600

lease-time 86400

admin-state up

options

default-gateway 10.5.6.254

dns-servers 10.61.91.175

vEdge2

"vEdge_Dual_Site_VPN1_Int_G0/7_Template"

"vEdge_Dual_Site_VPN1_DHCP_G0/7_Template"

Assign newly created feature templates to device template --"vEdge_Dual_Site_Device_Template"

vpn 1

interface ge0/7

ip address 10.5.6.2/24

no shutdown

vrrp 56

priority 125

track-omp

ipv4 10.5.6.254

dhcp-server

address-pool 10.5.6.0/24

offer-time 600

lease-time 86400

admin-state up

options

default-gateway 10.5.6.254

dns-servers 10.8.25.190

SW17

SW17(config)#vlan 56

SW17(config-vlan)#name VLAN56

SW17(config)#int r g0/0-2

SW17(config-if-range)#sw acc vlan 56

SW17(config-if-range)#sw mo acc

SW17(config-if-range)#spanning-tree portfast

IOS5

interface GigabitEthernet0/0

ip address dhcp

IOS5#show ip int bri

Interface IP-Address OK? Method Status Protocol

GigabitEthernet0/0 10.5.6.217 YES DHCP up up

IOS5#show ip route

S* 0.0.0.0/0 [254/0] via 10.5.6.254

IOS5#traceroute 13.13.13.13 numeric

Type escape sequence to abort.

Tracing the route to 13.13.13.13

VRF info: (vrf in name/id, vrf out name/id)

1 10.5.6.1 7 msec 4 msec 5 msec

2 10.3.13.1 75 msec 43 msec 45 msec

3 10.3.13.2 56 msec * 58 msec

vEdge1# show vrrp vpn 1

vrrp vpn 1

interfaces ge0/7

groups 56

virtual-ip 10.5.6.254

virtual-mac 00:00:5e:00:01:38

priority 150

vrrp-state master

omp-state up

advertisement-timer 1

master-down-timer 3

last-state-change-time 2024-01-30T16:02:48+00:00

vEdge2# show vrrp vpn 1

vrrp vpn 1

interfaces ge0/7

groups 56

virtual-ip 10.5.6.254

virtual-mac 00:00:5e:00:01:38

priority 125

vrrp-state backup

omp-state up

advertisement-timer 1

master-down-timer 3

last-state-change-time 2024-01-30T16:02:48+00:00

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Setting up the ASA for Internet and Internal Routing

SW17

interface Loopback0

ip address 10.1.0.16 255.255.255.255

interface Loopback1

ip address 10.5.16.2 255.255.255.0

interface GigabitEthernet0/0

switchport access vlan 56

switchport mode access

interface GigabitEthernet0/1

switchport access vlan 56

switchport mode access

interface GigabitEthernet0/2

switchport access vlan 56

switchport mode access

interface GigabitEthernet1/1

no switchport

ip address 10.1.16.2 255.255.255.0

interface GigabitEthernet1/2

no switchport

ip address 10.2.16.2 255.255.255.0

interface GigabitEthernet1/3

no switchport

ip address 10.1.160.2 255.255.255.0

router ospf 1

network 10.1.0.16 0.0.0.0 area 0

network 10.1.16.0 0.0.0.255 area 0

network 10.1.160.0 0.0.0.255 area 0

network 10.2.16.0 0.0.0.255 area 0

network 10.5.16.0 0.0.0.255 area 0

ASA

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Service VPN1 OSPF Routing via CLI and Templates

vEdge 1

vpn 1

router

ospf

timers spf 200 1000 10000

area 0

interface ge0/6

exit

vEdge1# show ip route vpn 1 ospf

PROTOCOL NEXTHOP NEXTHOP NEXTHOP

VPN PREFIX PROTOCOL SUB TYPE IF NAME ADDR VPN TLOC IP COLOR ENCAP STATUS

---------------------------------------------------------------------------------------------------------------------------------------------

1 0.0.0.0/0 ospf E2 ge0/6 10.1.16.2 - - - - F,S

1 10.1.0.16/32 ospf IA ge0/6 10.1.16.2 - - - - -

1 10.1.16.0/24 ospf IA ge0/6 - - - - - -

1 10.1.160.0/24 ospf IA ge0/6 10.1.16.2 - - - - F,S

1 10.2.16.0/24 ospf IA ge0/6 10.1.16.2 - - - - F,S

1 10.5.16.2/32 ospf IA ge0/6 10.1.16.2 - - - - F,S

vEdge 2

"vEdge_Dual_Site_VPN1_OSPF_Template"

vEdge 3 and 4

Copy dual site template

"vEdge_Single_Site_VPN1_OSPF_Template"

vEdge 5

Copy single site template

"vEdge_MPLS_Only_Site_VPN1_OSPF_Template"

Assign feature templates to device templates

Edit device templates, Repeat this for dual/single/mpls_only templates

vEdge2# show run vpn 1

vpn 1

router

ospf

timers spf 200 1000 10000

redistribute omp

area 0

interface ge0/6

exit

vEdge2# show ip route vpn 1 ospf

PROTOCOL NEXTHOP NEXTHOP NEXTHOP

VPN PREFIX PROTOCOL SUB TYPE IF NAME ADDR VPN TLOC IP COLOR ENCAP STATUS

---------------------------------------------------------------------------------------------------------------------------------------------

1 0.0.0.0/0 ospf E2 ge0/6 10.2.16.2 - - - - F,S

1 10.1.0.16/32 ospf IA ge0/6 10.2.16.2 - - - - -

1 10.1.16.0/24 ospf IA ge0/6 10.2.16.2 - - - - F,S

1 10.1.160.0/24 ospf IA ge0/6 10.2.16.2 - - - - F,S

1 10.2.16.0/24 ospf IA ge0/6 - - - - - -

1 10.5.16.2/32 ospf IA ge0/6 10.2.16.2 - - - - F,S

vEdge3/4# show run vpn 1

vpn 1

router

ospf

default-information originate

timers spf 200 1000 10000

redistribute omp

area 0

interface ge0/4

exit

vEdge5# show run vpn 1

vpn 1

router

ospf

default-information originate

timers spf 200 1000 10000

redistribute omp

area 0

interface ge0/4

exit

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Service VPN 1 OSPF Network Types, Authentication via CLI and Templates

SW17

interface GigabitEthernet1/1

no switchport

ip address 10.1.16.2 255.255.255.0

ip ospf network point-to-point

ip ospf authentication

ip ospf authentication-key cisco123

interface GigabitEthernet1/2

no switchport

ip address 10.2.16.2 255.255.255.0

ip ospf network point-to-point

ip ospf authentication

ip ospf authentication-key cisco123

Edge 1

vpn 1

router

ospf

area 0

interface ge0/6

network point-to-point

authentication type simple

authentication authentication-key cisco123

exit

Edge 2

Edit feature template " vEdge_Dual_Site_VPN1_OSPF_Template"

vEdge2# show run vpn 1

vpn 1

router

ospf

timers spf 200 1000 10000

redistribute omp

area 0

interface ge0/6

network point-to-point

authentication type simple

authentication authentication-key cisco123

exit

SW17#show ip ospf nei

Neighbor ID Pri State Dead Time Address Interface

10.12.0.2 0 FULL/ - 00:00:36 10.2.16.1 GigabitEthernet1/2

10.12.0.1 0 FULL/ - 00:00:30 10.1.16.1 GigabitEthernet1/1

192.1.101.2 1 FULL/DR 00:00:38 10.1.160.1 GigabitEthernet1/3

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Service VPN1 BGP Peering Setup and Route Propagation

Edge 1

vpn 1

router

ospf

timers spf 200 1000 10000

area 0

interface ge0/6

network point-to-point

authentication type simple

authentication authentication-key cisco123

exit

interface loopback0

exit

bgp 65012

address-family ipv4-unicast

redistribute ospf

neighbor 10.1.0.16

no shutdown

remote-as 65012

update-source loopback0

next-hop-self

address-family ipv4-unicast

interface loopback0

ip address 10.1.0.1/32

no shutdown

vEdge1# show bgp summary vpn 1

vpn 1

bgp-router-identifier 10.12.0.1

local-as 65012

rib-entries 41

rib-memory 4592

total-peers 1

peer-memory 4816

Local-soo SoO:0:12

ignore-soo

MSG MSG OUT PREFIX PREFIX PREFIX

NEIGHBOR AS RCVD SENT Q UPTIME RCVD VALID INSTALLED STATE

---------------------------------------------------------------------------------------------------------

10.1.0.16 65012 967 930 0 0:15:24:04 0 0 0 established

vEdge1# sh bgp route vpn 1

…

SW 17

router bgp 65012

bgp log-neighbor-changes

no bgp default ipv4-unicast

neighbor 10.1.0.1 remote-as 65012

neighbor 10.1.0.1 update-source Loopback0

neighbor 10.1.0.2 remote-as 65012

neighbor 10.1.0.2 update-source Loopback0

address-family ipv4

neighbor 10.1.0.1 activate

neighbor 10.1.0.2 activate

exit-address-family

SW17# show ip bgp su

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

10.1.0.1 4 65012 29 26 99 0 0 00:20:32 24

10.1.0.2 4 65012 29 27 99 0 0 00:20:32 24

SW17# show run | s router ospf

router ospf 1

distance ospf external 201

SW17#show ip route

Gateway of last resort is 10.1.0.1 to network 0.0.0.0

B* 0.0.0.0/0 [200/1] via 10.1.0.1, 00:01:05

10.0.0.0/8 is variably subnetted, 26 subnets, 2 masks

O 10.1.0.1/32 [110/2] via 10.1.16.1, 00:01:05, GigabitEthernet1/1

O 10.1.0.2/32 [110/2] via 10.2.16.1, 00:01:05, GigabitEthernet1/2

C 10.1.0.16/32 is directly connected, Loopback0

C 10.1.16.0/24 is directly connected, GigabitEthernet1/1

L 10.1.16.2/32 is directly connected, GigabitEthernet1/1

C 10.1.160.0/24 is directly connected, GigabitEthernet1/3

L 10.1.160.2/32 is directly connected, GigabitEthernet1/3

C 10.2.16.0/24 is directly connected, GigabitEthernet1/2

L 10.2.16.2/32 is directly connected, GigabitEthernet1/2

B 10.3.13.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.3.100.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.3.101.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.3.130.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.3.130.1/32 [200/16777214] via 10.1.0.1, 00:01:05

B 10.4.15.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.4.100.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.4.101.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.4.150.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.4.150.1/32 [200/16777214] via 10.1.0.1, 00:01:05

B 10.5.14.0/24 [200/16777214] via 10.1.0.1, 00:01:05

C 10.5.16.0/24 is directly connected, Loopback1

L 10.5.16.2/32 is directly connected, Loopback1

B 10.5.100.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.5.101.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.5.140.0/24 [200/16777214] via 10.1.0.1, 00:01:05

B 10.5.140.1/32 [200/16777214] via 10.1.0.1, 00:01:05

13.0.0.0/32 is subnetted, 1 subnets

B 13.13.13.13 [200/16777214] via 10.1.0.1, 00:01:05

14.0.0.0/32 is subnetted, 1 subnets

B 14.14.14.14 [200/16777214] via 10.1.0.1, 00:01:05

15.0.0.0/32 is subnetted, 1 subnets

B 15.15.15.15 [200/16777214] via 10.1.0.1, 00:01:05

vEdge 2

Add feature template "vEdge_Dual_Site_VPN1_Int_Loopback0"

Edit Device template "vEdge_Dual_Site_Device_Template"

Add loopback0 interface IP 10.1.0.2/32 in vManager

vEdge2# show run vpn 1

…

interface loopback0

ip address 10.1.0.2/32

no shutdown

Edit feature template "vEdge_Dual_Site_VPN1_OSPF_Template"

vEdge2# show run vpn 1 router

vpn 1

router

ospf

timers spf 200 1000 10000

redistribute omp

area 0

interface ge0/6

network point-to-point

authentication type simple

authentication authentication-key cisco123

exit

interface loopback0

exit

Create feature template "vEdge_Dual_Site_VPN1_BGP_Template"

Edit Device template "vEdge_Dual_Site_Device_Template" again

vEdge2# show run vpn 1 router bgp

vpn 1

router

bgp 65012

address-family ipv4-unicast

redistribute ospf

neighbor 10.1.0.16

no shutdown

remote-as 65012

update-source loopback0

next-hop-self

address-family ipv4-unicast

Additional:

Remove "redistribute omp" into ospf in "vEdge_Dual_Site_VPN1_OSPF_Template"
Remove static routes in "vEdge_Dual_Site_VPN1_Template"

Final vEdge 2 - VPN 1 config:

vEdge2# show run vpn 1

vpn 1

router

ospf

timers spf 200 1000 10000

area 0

interface ge0/6

network point-to-point

authentication type simple

authentication authentication-key cisco123

exit

interface loopback0

exit

bgp 65012

address-family ipv4-unicast

redistribute ospf

redistribute omp

neighbor 10.1.0.16

no shutdown

remote-as 65012

update-source loopback0

next-hop-self

address-family ipv4-unicast

interface ge0/6

ip address 10.2.16.1/24

no shutdown

interface ge0/7

ip address 10.5.6.2/24

no shutdown

vrrp 56

priority 125

track-omp

ipv4 10.5.6.254

dhcp-server

address-pool 10.5.6.0/24

offer-time 600

lease-time 86400

admin-state up

options

default-gateway 10.5.6.254

dns-servers 10.8.25.190

interface loopback0

ip address 10.1.0.2/32

no shutdown

OMP route redistribution / Loop Prevention - BGP Site of Origin (SoO)

SW17# show ip bgp 10.3.130.0

BGP routing table entry for 10.3.130.0/24, version 97

Paths: (2 available, best #2, table default)

Not advertised to any peer

Refresh Epoch 1

Local

10.1.0.2 (metric 2) from 10.1.0.2 (10.12.0.2)

Origin incomplete, metric 1000, localpref 50, valid, internal

Extended Community: SoO:0:12

rx pathid: 0, tx pathid: 0

Refresh Epoch 1

Local

10.1.0.1 (metric 2) from 10.1.0.1 (10.12.0.1)

Origin incomplete, metric 1000, localpref 50, valid, internal, best

Extended Community: SoO:0:12

rx pathid: 0, tx pathid: 0x0

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Service VPN1 BGP Localized Route Policy

vEdge 1

policy

route-policy RP_BGP_ROUTES

sequence 1

action accept

set

local-preference 1000

default-action reject

vpn1

router

bgp 65012

neighbor 10.1.0.16

route-policy RP_BGP_ROUTES out

SW17#show ip bgp | i 10.1.0.1

*>i 0.0.0.0 10.1.0.1 1 1000 0 ?

r>i 10.1.0.1/32 10.1.0.2 12 100 0 ?

r>i 10.1.0.2/32 10.1.0.1 12 1000 0 ?

r>i 10.1.0.16/32 10.1.0.1 11 1000 0 ?

r>i 10.1.160.0/24 10.1.0.1 11 1000 0 ?

r>i 10.2.16.0/24 10.1.0.1 11 1000 0 ?

*>i 10.3.13.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.3.100.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.3.101.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.3.130.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.3.130.1/32 10.1.0.1 1000 1000 0 ?

*>i 10.4.15.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.4.100.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.4.101.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.4.150.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.4.150.1/32 10.1.0.1 1000 1000 0 ?

*>i 10.5.14.0/24 10.1.0.1 1000 1000 0 ?

r>i 10.5.16.2/32 10.1.0.1 11 1000 0 ?

*>i 10.5.100.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.5.101.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.5.140.0/24 10.1.0.1 1000 1000 0 ?

*>i 10.5.140.1/32 10.1.0.1 1000 1000 0 ?

*>i 13.13.13.13/32 10.1.0.1 1000 1000 0 ?

*>i 14.14.14.14/32 10.1.0.1 1000 1000 0 ?

*>i 15.15.15.15/32 10.1.0.1 1000 1000 0 ?

vEdge 2

Match everything, keep default

Edit device template "vEdge_Dual_Site_Device_Template"

Edit feature template "vEdge_Dual_Site_VPN1_BGP_Template"

vEdge2# show run policy

policy

route-policy RP_BGP_ROUTES

sequence 1

action accept

set

local-preference 2000

default-action reject

vEdge2# show run vpn 1 router bgp

vpn 1

router

bgp 65012

neighbor 10.1.0.16

no shutdown

remote-as 65012

update-source loopback0

next-hop-self

address-family ipv4-unicast

route-policy RP_BGP_ROUTES out

Veirfy

SW17#show ip bgp | i 10.1.0.2

*>i 10.1.0.2 1 2000 0 ?

r>i 10.1.0.1/32 10.1.0.2 12 2000 0 ?

r>i 10.1.0.2/32 10.1.0.1 12 1000 0 ?

r>i 10.1.0.2 11 2000 0 ?

r>i 10.1.16.0/24 10.1.0.2 11 2000 0 ?

r>i 10.1.0.2 11 2000 0 ?

*>i 10.1.0.2 1000 2000 0 ?

r>i 10.1.0.2 11 2000 0 ?

*>i 10.1.0.2 1000 2000 0 ?

SW17#show ip route bgp

B* 0.0.0.0/0 [200/1] via 10.1.0.2, 00:02:43

10.0.0.0/8 is variably subnetted, 26 subnets, 2 masks

B 10.3.13.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.3.100.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.3.101.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.3.130.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.3.130.1/32 [200/1000] via 10.1.0.2, 00:02:43

B 10.4.15.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.4.100.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.4.101.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.4.150.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.4.150.1/32 [200/1000] via 10.1.0.2, 00:02:43

B 10.5.14.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.5.100.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.5.101.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.5.140.0/24 [200/1000] via 10.1.0.2, 00:02:43

B 10.5.140.1/32 [200/1000] via 10.1.0.2, 00:02:43

13.0.0.0/32 is subnetted, 1 subnets

B 13.13.13.13 [200/1000] via 10.1.0.2, 00:02:43

14.0.0.0/32 is subnetted, 1 subnets

B 14.14.14.14 [200/1000] via 10.1.0.2, 00:02:43

15.0.0.0/32 is subnetted, 1 subnets

B 15.15.15.15 [200/1000] via 10.1.0.2, 00:02:43

UC Valley

Friday, 2 February 2024

SD-WAN Lab Note Part 2

vEdge1

vEdge2

Edit "vEdge_Dual_Site_VPN1_Template"

vEdge 3 and 4

Edit "vEdge_Single_Site_VPN1_Template"

vEdge5

Edit "vEdge_MPLS_Only_VPN0_Template"

vEdge1

vEdge2

"vEdge_Dual_Site_VPN1_Int_G0/7_Template"

SW17

IOS5

Setting up the ASA for Internet and Internal Routing

SW17

Service VPN1 OSPF Routing via CLI and Templates

No comments:

Post a Comment