advice sdwan deployment

[reylite]

hi

need advice with this simulation topology, i have vmanage, vbond and vsmart communicate with ip private, i wanted my cEdge router register to vmanage via ip public, how can i achieve that ? in this topology there is no firewall

thank you

[nnegi]

If you are using only Internet as the transport for communication between on-prem controllers and Wan Edges, It is recommended to have 1:1 public ip mappings (NAT) for each controller vManage, vBond and vSmart (BackHaul router in your case).
Additionally, you will have to ensure communiaction to vBond from both vManage and vSmart is through public IP only. 

[reylite]

Hello, what if i change topology into hybrid deployment, so vmanage can be access from public and private ? what else do i need to change ? 

thank you

[nnegi]

The above solution works for hybrid setup too. Since vBond acts as a stun server, it will have both public and private ip information for controllers and wan edges. When a wan edge onboards vBond would provide both public and private addresses for controllers so the wan edges can reach on appropriate links.