cEdge behind cEdge?

[craneman1]

I have 2 cEdges at a site..but only one of them will be connected to transport.

So I could put the other cEdge in a tloc extension mode.(Even though it has no real vpn 0 transport)

But my question is since the 2nd one wont have a transport itself what is the best way to do this?

Its basically an inner router connected to an outer router.

For example if the outer router is connected to a transport in vpn 0 and had a vpn 10 on the service side say 10.1.1.1.address...can the inner cedge have say 10.10.10.100 on its vpn0 interface and just connect to the service side of the outer router?  Is there any advantage to this?  or is there another way other thna tloc extension?  Thanks!

[Kanan Huseynli]

Hi,

simple option for branch is TLOC extension. Just extend vpn0 by this technique and router2 gets connection to remote devices/controllers.

"For example if the outer router is connected to a transport in vpn 0 and had a vpn 10 on the service side say 10.1.1.1.address...can the inner cedge have say 10.10.10.100 on its vpn0 interface and just connect to the service side of the outer router?"

Interesting point, technically it should work, vpn0 requires IP reachability over any transport. This type of implementation is not covered in sdwan design guide, but you can use loopback method as described in chapter (link below).

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#WANEdgeDeployment

Personally, I recommend well-known option which is TLOC extention, no difficult configuration. But note that if you lose primary router, you will also lose secondary router as well and you should advertise TLOC extension subnet in WAN (if you use MPLS) or do 1:1 NAT (if you use INTERNET).

I recommend connecting transport interface (ISP/SP facing)  to LAN switch at branch if it is stacked (you will need manual port change in case of stack node failure). And if your one router fails, secondary router will take connection between branch and other sites.

HTH,