External route into SDWAN

[Kevin Sherwood]

How do you introduce an external network into your sdwan that does not have a viptela router ie Can also access the bearer in the underlay. I can PING the connected Edge routers from this device but no further into the mesh.

Maybe OMP/Advertise Static on the connected Edges?

[Lei Tian]

Hello,

Not sure if I got your requirements correctly.
The SDWAN edge router can function as normal router if you wish to. As long as you don’t enable transport on the interface, you can use that interface as normal router. If you want extend overlay fabric to non SDWAN network, I think best option is to use service side ipsec tunnel.
Let me know if you want achieve something else.
HTH,
Lei Tian

[Kevin Sherwood]

Hi Lei, thanks for your reply.

Maybe I can give you a bit more perspective as I'm sure it's hard to know exactly what I am trying to achieve.

I'll attach a quick diagram for you to view, but I have two Vedge nodes connected on the transport side and each have a service side PC. PCs can ping each other over their OMP tunnel. Also connected to this bearer is an external (to the SDWAN system) PC. This PC can ping each end vEdge WAN interface but I want it to be able to pop into the SDWAN system and communicate to one of the service side PCs. The SDWAN system should be able to act as a relay for this external node. ie It's in the middle of each LAN node.

[Kevin Sherwood · Accepted solution]

You can't connect an external network to Viptela unless it is a service side connection. This means that it needs to be configured in a VPN (or VRF) other than 1. All networks that want to join the SD-WAN need a Viptela Edge node which can participate in the mesh.

[Kanan Huseynli]

Hi,

leaking between global and service side would work in your case too.

[jcockburn]

Hi, 

I believe it is doable...if I understand this correct. You may use either route-leaking (between VPN and Global/VPN0) or maybe IPSec.

Other than that, you will have to do some funky connectivity footwork by connecting service VPN to transport VPN (by some means) as well, but this is getting hairy and should be avoided.

Anything is possible

Just depends

Have fun

Ciao