Thank you for the reply. I had read related pages in the deployment and design guides but they only showed the principals and the commands. What is needed is a scenario showing on-prem controllers with their real pre-NAT and post-NAT IPs and reachability between ios-xe vEdge and controllers through Internet and MPLS lines. All of the related documents on cisco website either show cloud-based controllers or only display commands (without using IPs). I already know the commands and need to find complete & detailed resolved examples.
As an example we have this topology:
IP addresses of controllers are (192.168.1.10 = vBond)(192.168.1.11 = vSmart)(192.168.1.12 = vManege). These addresses will be 1-to-1 NATed respectively to 5.5.1.10 , 5.5.1.11 and 5.5.1.12. We don’t use any NAT on MPLS line. Now the questions:
1) which IP address of vBond will be used on vManage and vSmart?
2) what will be the color of each controller?
3) two IOS-XE sd-wan routers in HQ site have links to both of Internet and MPLS lines. Which IP address of the vBond should be configured on these 2 routers? What will be color of each interface on these routers?
4) sd-wan branch routers will use which IP as vBond? What will be color of each interface on these branch routers?
G
First of all i would like to know ,
1. Are you using MPLS as a transport for you sdwan controllers to vEdges or cEdges communication?
Ans:- if you are using MPLS only as a transport for on-prem controllers to vEdges or cEdges communication then in this case you dont have use NAT, you can use private IP for controllers and vEdges/cEdges will communicate to on-prem controllers. In this case you have to use vBond ip address which private ip address on All controllers(vM, vB, and vS) and cEdge/vEdge routers.
==================================================================================
2. Are you using internet as a transport for you sdwan controllers to vEdges or cEdges communication?
Ans:- if you are using Internet only as a transport for on-prem controllers to vEdges or cEdges communication then in this case you you will have to use one public ip address for each controllers which means vManage, vBond and vSmart and you will have to configure the NAT on your firewall and when remote site vEdge or cEdge routers will communicate to on-prem controllers NAT will translate the public ip address of vManage, vBond and vSmart to private IP address.
================================================================================
Note:- In case of hybrid deployment :-
Hybrid means if you are using MPLS and Internet both as a transport then in this case, again you have to use NAT and one public ip address for each controllers.
below is the explanation for hybrid deployment:-
On-Prem Controllers Hybrid Deployment:-
For Controllers Communication :-
=>vSmart and vManage point to the vBond IP address - NATed public IP address •
=>vBond learns interface private and NATed public IP address of vSmart and vManage - Private is pre-NAT, public is postNAT •
=>vSmart and vManage use interface private IP addresses for communication - vSmart and vManage use private color (non-default) - Private color to private color uses private IP address
------------------------------------------------------------------------------------
For vEdge or cEdge to Controller Communications:-
=> vEdge/cEdge points to the vBond FQDN that resolves to both public and private IP addresses
=>vEdge/cEdge communicates with vSmart and vManage NATed public IP addresses over Internet and interface private IP addresses over MPLS - Private color to private color uses private IP address, private color to public color uses public IP address
Below i have added one image for clarity:-
That answer your all questions. If you still have any doubts you can ask your questions will answer.
Again:-
if you are going with the design you are using it (however i could suggest different and better than your design), in this case , its hybrid deployment use vBond NATed ip address for all (controllers and routers).
======================================================================================
Kindly let me know if you have further queries for SD-WAN deployment.
Kindly hit helpful button and mark as a solve if this post has helped you.
Happy learning!!
Thanks & Regards,
Rohit Raj
Hello TCPuniverse,
Sorry for the late response.
Kindly share vManage, vBond, vSmart and cEdge router configurations and if possible come online with me and share you screen i will help you to resolve and will give you understanding how it work, also will resolve this problem.
Regards,
Rohit Raj
This is my new topology which is a little bit different from the previous one. In this topology I've put vBond on the separate network from other controllers.
I attached controllers and one of IO-XE SDWAN routers config to this post as ZIP file. This is dashboard screenshot of the vManage:
I've created two AAA records for vBond (one for its private address and one for its public address) on the DNS server ( is this correct? ). I have also configured NAT only on the Internet lines. The IP address of the Controllers are the same as mentioned on previous post but I wrote them down on the topology above again.
I think there is an issue regarding DNS; Routers shouldn't reach vBond public server through MPLS, but due to MPLS static route configured on them, sometime they use that route toward vBond which they shouldn't. I will check the NAT config on the DC router but in the meantime you can take a look at what I have done till that point.
Regards;
