Digital innovation is overwhelming the branch and WAN. More specifically, 80 percent of employees and customers work in or are served in branch offices*, which is leading to a 73 percent growth in mobile devices from 2014 to 2018**. These mobile devices are accessing a significantly larger number of cloud applications (such as Office 365, salesforce.com, and Google apps) and as a result, demand for bandwidth and related costs will increase by 20 to 50 percent per year through 2018. The increased surface area and complexity of cyber attacks, and the subsequent increase in time required to mitigate these attacks, have made the branch a prime target for advanced threats.
Please refer to below Cisco Verified Profile for design and configuration
Forward certain Internet-bound traffic(eg. facebook, youtube etc.) from the branch directly to the Internet. It helps reduce IT spending, ensure better application experiences, and provide guest Wi-Fi at the branch.
Direct Cloud Access:
Forward SaaS traffic(eg. Office365, Salesforce, Box, Google etc.) from the branch directly to the Internet or the backhaul path to DC based on candidate path performance, it ensures the best SaaS application experience and also reduce the IT WAN cost.
Q1: Who is the target customer for this solution?
A1: Enterprise who manages their own WAN networking or Service Provider who provides managed WAN networking services.
Q2: what benefit can I get from this solution?
For enterprise customers, more and more applications moving to the cloud and SaaS applications(eg. Office365, Box, Webex, Salesforce, Google etc,) adopted quickly, with this solution, it can greatly improve SaaS application user experience(much lower latency) and also reduce the WAN link cost. Other than that, the non business traffic(such as facebook, youtube) are growing, this may occupy the expensive WAN link and impact business critical applications, with this solution, you can route non business traffic to the internet link ,thus can ensure the business application user experience.
For service provider, with this solution, you can provide better SaaS application experience to your end customers and also can use the internet link to offload the expensive WAN link ,thus reduce your IT cost.
Q3: This looks good, but what is pre-requisites of this solution? Do I need to enable Cisco IWAN or SD-WAN?
A3: No, IWAN or SD-WAN not needed, this solution is a lightweight solution ,IWAN/SD-WAN not needed, it can be enabled with only one routers, no dependency of any overlay/IPsec.
If you already deployed Cisco IWAN, please refer to IWAN DCA solution FAQ:
Q4: This sounds a pretty simple solution, what is the difference between this and PBR(Policy based routing)?
A4: This is a much better solution
It can directly match application/application group, or URL and achieve application based routing while PBR can only match DSCP/prefix etc.
Some applications requires several packets to be classified(eg. first 3 packets classified as TCP, later packets classified as youtube) , In PBR solution, the first few packets may take backhaul path and later packets take the internet path once classified, this may cause TCP connection reset and impact user experience. This solution provides flow stickiness which stick to the original path , thus no connection reset and provide best user experience.
Configuration simplicity. This solution requires very limited config and automatically start IP SLA to probe the path.
Better support of 2 or more branch devices. some medium or big site may have 2 branch routers for redundancy ( 1 MPLS link and 1 INET link , or 2 INET link), with this solution, we can fully leverage the 2 links(active/active) and configuration is very simple(similar to 1 device config)
Q5: I like this solution, but what about security if we local breakout the internet traffic?
A5: This solution only allow whitelist traffic(like Office365, Facebook etc. defined by policy) initiated for LAN to the internet, these traffic can be trusted, other traffic still follow the existing path. Other that, you can enable VRF segmentation to segment the internet traffic . You can also enable NAT, Umbrella or ZBFW or UTD on the device to improve the security
Q6: what SaaS are supported here?
A6: Popular SaaS are all supported, like Salesforce, Microsoft O365, Sharepoint, AWS, Dropbox, Box, Google apps, Zendesk, SAP, Webex.
Q7: I want to break out some URL domain, but it is not found in the NBAR support list, How can I do that?
A7: You can use NBAR custom protocol to achieve this.
Q8. Do I need to enable NAT?
A8: In order to make your host which normally in a private network directly communicate with the server application in the public, normally we need NAT in the path, you can enable NAT on the same router which has DCA enabled or other devices in the path.
Q9. Is there any configuration guide for this solution?
Hello, I am trying to rename host vpc but it doesn't seem that there is an option to do so. I tried to Un-Map that vpc so I can re-map it and then give it the new name; however, when I tried to search for the host vpc account name it came up with the...
I understand that the following configuration will associate the native vlan with physical interface G0/0 on a router:R1# conf tR1(config)# int G0/0R1(config-if)# ip address 10.1.10.1 255.255.255.0R1(config-if)# no shutdown But what is the command on...
Dear Tim Cisco I Have a cisco prime with version 3.7.1. I see on alarms and events option there are setting of alert will be sent to email in every 30 minutes (i setting 30 mins) until the cases is solved. So, i want to setting the email notification...
Should switchport block unicast be set on trunk ports? There is plenty of documentation about setting it in general and what it does with regards to not flooding unknown unicast traffic, but, I cannot find anything in specific about setting it on trunk po...
Hello, since the last reload two days ago I have a lot of dnsproxy errors in my log3199015Jun 24 16:32:07 firepower-1010 dnsproxy: No server for ctx: 1, idx: 0working on a FPR-1010 with cisco-asa-fp1k.9.16.1.SPA installed.What does this error mean? T...