Deployment of SD-WAN with firewall for ISP connection

[inhamit]

Hi, Our client wanted to deploy SD-WAN routers to connect with ISP equipment's as per below image. Can u please help me to understand what is the use of SD-WAN router in the network and which physical devices we can use for this network design requirement

[dijix1990]

it depends on the bandwidth you need

For example, if we refer to datasheets 

C1111x-8P about 400Mbps

https://www.cisco.com/c/en/us/products/collateral/routers/1000-series-integrated-services-routers-isr/datasheet-c78-739512.html#Cisco111xISRsFlexibleWANandLANconnectivity table 25

C8200 about 400Mbps or about 900Mbps

https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/nb-06-cat8200-series-edge-plat-ds-cte-en.html table 3a

C8300 from about 1.75Gbps to about 5Gbps

https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8300-series-edge-platforms/datasheet-c78-744088.html table 3a

C8500 from about 8Gbps to about 100Gbps

https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/datasheet-c78-744089.html table 5a

[inhamit]

Thanks. Can we use ISR-4451 as a SD WAN router? What are the cards we need to purchase along with this?

[dijix1990]

Yes, you can use it + hsec licences (for security, maybe you've already had it), depend on my experience it can work as sdwan edge with bandwidth about 1.5-2Gbps.

I think you can use 4 onboard ports on it (for example for connecting to isps use sub-interfaces or for lan), if you need extra ports you can buy nim cards - NIM-1GE-CU-SFP or NIM-2GE-CU-SFP (4451-x has 3 nim slots on it)

[inhamit]

What inputs I should ask to our customer before finalize the model except bandwidth?

[dijix1990]

Which licence does customer have (Customer needs hsec licence if wants to encrypt his traffic)

and of course about design. Maybe customer wants to connect isp directly to isr4451-x or it can be via switch. Of course you can advice to customer your design

[inhamit]

I was thinking to propose the C8200 about 400Mbps or about 900Mbps as ISP bandwidth is limited to 100/100 mbps. Our plan is to connect directly via ISP.

[dijix1990]

It's good idea, isr4000 very good device, but in 4 years it will be eol. But if the customer has device from isr4000 (4331/4431/4451 etc) then customer can start with it and in future move to new platform. It depends on the customer

[inhamit]

Customer wanted to have redundant connection for ISP, one is via dedicated ISP equipment and other is via another site switch. Do we need to purchase any specific cards for ISR or we can use any port for WAN (towards internet) and LAN connections (towards internal network to firewall) from the onboard ports? I have denoted them via 1 and 2.

[dijix1990]

You can use any dedicated ports, there are the same (for isr4451-x or c8200 have 4 onboard ports)

and to understand (refer your figure it seems as different providers A and B? or is it one isp?)

[inhamit]

There will be different service provider A and B. Do I need to mention any thing additional to Cisco ISR 4451 with NIM slot and + hsec licences to our suplier. Do i need to mention aanything else when purchasing? 

[dijix1990]

For the first you should ask the customer about hsec licence on his devices (if customer has isr4451-X) 

Next, you can recommend to buy extra nim card for isr4451-x but it depends on scheme.

Example 1. You can use only 4 onboard ports

For example, we have two isr4451-x which has 4 ports 

sdwan edge 1
Gi0/0/0 - Unsecure A
Gi0/0/1 - Unsecure B
Gi0/0/2.100 - To ISP A via switch
Gi0/0/2.200 - To ISP B via switch
Gi0/0/3 - LAN

sdwan edge 2
Gi0/0/0 - Unsecure A
Gi0/0/1 - Unsecure B
Gi0/0/2.100 - To ISP A via switch
Gi0/0/2.200 - To ISP B via switch
Gi0/0/3 - LAN

Or Example 2. Customer buys one nim card NIM-1GE-CU-SFP or NIM-2GE-CU-SFP

For example, we have two isr4451-x which has 4 ports + one nim card NIM-1GE-CU-SFP or NIM-2GE-CU-SFP

sdwan edge 1
Gi0/0/0 - Unsecure A
Gi0/0/1 - Unsecure B
Gi0/0/2 - To ISP A via switch
Gi0/0/3 - LAN
Gi0/1/0 - To ISP B via switch - (it's port on the NIM-1GE-CU-SFP or NIM-2GE-CU-SFP)


sdwan edge 2
Gi0/0/0 - Unsecure A
Gi0/0/1 - Unsecure B
Gi0/0/2 - To ISP A via switch
Gi0/0/3 - LAN
Gi0/1/0 - To ISP B via switch - (it's port on the NIM-1GE-CU-SFP or NIM-2GE-CU-SFP)

 If the customer doesn't have devices for sdwan you can recommend him to buy devices (isr4451-x or C8200) with HSEC licence and (for Example 2) one nim card NIM-1GE-CU-SFP or NIM-2GE-CU-SFP 

[inhamit]

Thanks. Last question...if customer want to have MPLS and LTE connection, do we need to purchase any additional cards?

[dijix1990]

for LTE yes you need c8200 because it has pim slot for lte, Kind of LTE in https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8200-series-edge-platforms/nb-06-cat8200-series-edge-plat-ds-cte-en.html table 4 

for mpls you can use any onboard ports.

for c8200 with lte you need LTE pim module and maybe for future nim module C-NIM-2T (two extra wan ports)

[dijix1990]

By the way, isr4000 can use lte nim module, I've checked it's NIM-LTEA-EA