Professional Documents
Culture Documents
Virtual SD-WAN Interactive Test Drive: Instructor Facilitated Customer Experience
Virtual SD-WAN Interactive Test Drive: Instructor Facilitated Customer Experience
Module 4:
Application Experience
Application Performance
IaaS
WAN SaaS
DC/Private Cloud
Benefits of Cisco SD-WAN
Predictable app experience Right security, right place Enterprise grade, simplified
Cloud OnRamp for IaaS, Full edge security stack from Proven deployments to
SaaS and Colocation branch to cloud and colocations over 10,000+ sites
One user interface for Security and SD-WAN across branch, cloud, and co-location
Module 2:
Cisco SD-WAN Overview
Cisco SD-WAN Architectural Elements
Orchestration Plane
vManage
Cisco vBond
Control Plane
Cisco vSmart
vBond
1 2
Re po
3 4 5
sp
co
on ate
r
nic rol
on
ztp
se
ag from
Qu tela
mu cont
r
a ti
. vip
wi rche
ery .co
e
th
vM ation
o
comitial
fig evic
e
Full Registration
to m
red trat
and Configuration
In
an
D
ur
ire or
s
ct
con
to
Assumption:
§ DHCP on Transport Side (WAN)
§ DNS to resolve ztp.viptela.com*
Available Software C
• Self-healing on upgrade failure
Available Software D
• Device will revert to the last good image
vEdge/cEdge vEdge/cEdge
Overlay Management Protocol (OMP)
Unified Control Plane
vSmart
• TCP based extensible control plane protocol
• Runs between vEdge/cEdge routers and vSmart
controllers and between the vSmart controllers
- Inside TLS/DTLS connections
• Advertises control plane context
vSmart vSmart • Dramatically lowers control plane complexity and
raises overall solution scale
VS
vEdge/cEdge
Full Mesh
SD-WAN Fabric TLOCs advertised to vSmarts
(Default)
vEdge/
cEdge
Local TLOCs
(System IP, Color, Encap)
vEdge/ vEdge/
cEdge cEdge
vEdge/ vEdge/
cEdge cEdge * Can be influenced by the control policies
Transport Locator (TLOC) OMP IPSec Tunnel
Transport Colors
T1 T2
Public T1
T3 T4 T3 T4 T2
Public
T1 T3 T1 DMZ T3
vEdge vEdge vEdge vEdge
T2 T4 T2 T4
Private
Private
T1, T3 – Public Color T2, T4 – Private Color
T1, T3 – Public Color T2, T4 – Private Color
T1 T3 T2 T4 T1 T3 T2 T4
T1 T4 T2 T3 T1 T4 T2 T3
vEdge/cEdge vEdge/cEdge
Transport1
TLOCs TLOCs
VPN1 VPN2 Transport2 VPN1 VPN2
BGP, OSPF, BGP, OSPF,
EIGRP, EIGRP,
Connected, A B C D Connected,
Static Static
Subnets Subnets
Module 3:
Securing and
Troubleshooting the WAN
Cisco SD-WAN VPNs
Router Security Zones
IF, IF,
Sub-IF Sub-IF
MPLS
Service Transport
(VPNn) (VPN0)
IF, IF,
Sub-IF Sub-IF
INET
Management
(VPN512)
• VPNs are isolated from each other, each VPN
has its own forwarding table
IF • Reachability within VPN is advertised by the
OMP
End-to-End Segmentation
VPN 1
Interface VPN1 SD-WAN VPN1 Interface
IPSec VPN 2
VLAN VPN2 VPN2 VLAN
Tunnel VPN 3
Ingress Egress
vEdge vEdge
• Segment connectivity across fabric w/o • Labels are used to identify VPN for
reliance on underlay transport destination route lookup
• vEdge/cEdge routers maintain per-VPN • Interfaces and sub-interfaces (802.1Q
routing table tags) are mapped into VPNs
Arbitrary VPN Topologies
Full-Mesh Hub-and-Spoke
BASIC/NO SECURITY
Data Center Branch/Campus
• Guest access liability
Corporate
Software Users Internal
• Untrusted access (malicious insider)
• Compliance (PCI, HIPPA, GDPR)
SD-WAN Fabric • Lateral movements (breach
propagation)
WAN Edge Device Existing Security Stack in DMZ
Secure Access Service Edge
Transitioning to a Cloud-First Security Model
Cloud-delivered What is SASE?
Secure Web firewall
Gateway Cloud-delivered
(SWG) security broker (CASB)
“SASE combines network security
functions (such as SWG, CASB,
DNS-layer Interactive Threat FWaaS and ZTNA*), with WAN
security Intel capabilities (i.e., SDWAN) to
support the dynamic secure
access needs of organizations.
These capabilities are delivered
primarily aaS and based upon the
identity of the entity, real time
context and security/compliance
policies.” –Andrew Lerner, Gartner
Inc.
Cisco SD-WAN
https://blogs.gartner.com/andrew-lerner/2019/12/23/say-
Cisco SD-WAN + Umbrella hello-sase-secure-access-service-edge/
Enterprise Firewall
Layer 3 to 7 apps classified
URL-Filtering
Cisco Web reputation score using 82+ web categories
Cisco
Security Adv. Malware Protection
SD-WAN With File Reputation and Sandboxing (TG)
SSL Proxy
Detect Threats in Encrypted Traffic
Internet
IaaS/SaaS FEC FEC Capabilities
Header Header
1 2 FEC
Header
FEC FEC 3 • Application SLA
Header Header
P 4 • TCP Optimization
Internet
Internet
Optimized
Data Center 1 (Secondary) 4 Branch/Campus • Forward Error
TCP Connection (Cubic)3
Parity
1 22
App 4 P
1
3 ath4
MPLS
2
1 Correction
A 3 4
Path 2
4
P3ath
2
1
• Packet Duplication
23 4
1 MPLS
(Primary)
4G
MPLS
LTE
Up to 40% faster
Data Center Branch/Campus
Office 365
Corporate
Software Users
Performance
SD-WAN Fabric
Transit Transit
VPC Hub VNet VPC Hub VNet
• Cisco WAN Edges deployed in
SD-WAN
a Transit Hub, acting as virtual SD-WAN
Fabric aggregation routers Fabric
OSS/BSS Integration
Learning and Multi-Tenant
hands-on content
Sandbox Partners
SD-WAN
(Viptela OS)
ISR 1100-4G/6G/LTE vEdge 2000
vEdge 2000 vEdge Cloud*
vEdge 5000
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 39
Empowering organizations
Empowering to see
Organizations tothe
SeeCloud,
the Cloud,
Internet and SaaS
Internet like your
and SaaS own own environment
like your
environment
2010 Founded HQ San Francisco
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 40
ThousandEyes + Cisco = Million Eyes
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 41
WAN Modernization - Viptela SD-WAN
CAUSED BY LATENCY IN
UNDERLAY COMCAST’S NETWORK
© 2020 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 42
Please fill out surveys!
Thank You!