P2P IPsec tunnel alternative for connecting onprem ACI and Cloud ACI

[m1xed0s]

I have particular customer use case and want some validation here.

A customer has ACI single fabric onprem and planning to move to public cloud (Azure/AWS) for DR. They currently have a non-Cisco SD-WAN in place connecting their DCs, branches and Cloud. So can ACI use this 3rd party SD-WAN fabric/tunnel as the transport to connect between Onprem and Cloud as ACI multi-site, in a similiar fashion like below?

Onprem VM<->Onprem ACI Leaf<->Onprem ACI Spine<->Onprem ISN<->3rd party onprem SD-WAN Device<->3rd party cloud SD-WAN device <->Cloud CSR/C8v<->vPC/vNET<->Cloud Workloads

I think this is do-able as far as the SD-WAN device, as the ipec termination device, can do OSPF and IKEv1/2 IPSec tunnel. Am I wrong? 

Whatif that 3rd party SD-WAN is replaced by Viptela? Will it still work? I do not think so due to the Viptela unique architecture...But I could be wrong.

[Shyam Sundar · Accepted solution]

Hello,

Yes, it is a supported model, as long as SDWAN can provide underlay connectivity from ACI spine to C8KV on Cloud.

Regarding SDWAN interwork, customer can use any SDWAN solution.

Also please take a look at use case 5, 6 - https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-cloud-aci-hybrid-multicloud-design-guide.html#use_case5_extCon_toWan_nonACI

Let us know if this helps.