Cisco SDWAN - DIA Configuration on cEdge router [CSR1000v - IOS XE SDWAN Image]

hi guys in this video i'm going to show you how to configure a cisco sd1 daa that is direct internet access on a ch router ch router is nothing but a cisco ios xc sd van image running router so this is my lab topology i have one ch 4 router that is running a cisco ios xcsd1 image it has got one interface connected to mpls link and another interface connected to public internet and it has got two lan interface both under vpn 10 one subnet i have 18166.1 slash 24 and one into 168 60.1 slash 24 and we will enable uh the direct internet access for this particular subnet 192.168.6.1 lesson before under that i have two machines from which we will test the interconnection the procedure is like how we did for vh on the service vpn side we apply a centralized data policy or a nat dia route that will root the traffic coming for internet uh to a vpn 0 nat enable interface from there the traffic gets directed to internet first we will see a dia using a centralized data policy and then we will see a nat dia root method this is my vmanage dashboard and i have this ch4 already onboarded using the a device template csr ch4 so in this i'm going to add new interface connected to internet and this van interfaces so let's go to templates so csr ch4 is the template i'm going to edit this so under transport and management i'm going to add one vpn interf interface template so i'm going to name it csr 1 2 da interface template face address tunnel will make it on and color i'm going to make it a public internet because this interface i'm adding this is connected to internet so the color i given public internet so hello services all like given and this is a internet link so we have to enable the nat here so i'm going to global mode making it on so net refresh i'm globally giving bi-directional and log net flow creation deletion i'm blocking globally making it on for to see the next translations and block icmp again and globally make it off and respond to ping i'm globally making on so that's it then add config refresh mode given bi-directional net flow creation relation i am logging and block icmp given off and respond to being on rest everything i'm keeping default so we just uh created a a di interface template uh given no short interface name ip address we're given device specific tunnel mode we own and given the color public internet law services all we have given and we have enabled the net that's it i'm going to save this so under transport and management we can see under a vpn0 we have two interfaces now one for mpls and one for internet and we also have uh service vpn vp entered already one interface is there and we i'm going to add one more interface to that i rest everything i'm keeping as it is so now we have added one additional da interface connected to internet this one and we added one more uh lan interface like this one this one is already there i'm going to update this template so that we can push it to the ch i'm going to stop the video and enter all the details now we will configure a centralized data policy on our vmanage in order to give internet access to our prefix 192.1686.1 so this is our ch4 we are allowing the internet access to this particular prefix in our dia setup using a centralized data policy so i'm in the v manage i'm going to configuration policies under centralized policy and giving ad policy the first step in creating a centralized data policy is to create the group of interest we have to create a data prefix so the first one you can see i created a ch4 vpn 10 prefix which is nothing but this one 192 on just 86.1 24. so i have added that 192.168.6.0.24 you can see there are already other vpn in trend users this is for vh devices we need to keep a separate data prefix for your vhs and chs and we should have one data prefix called overlay traffic matching all your land subnets like a vh1 to all the other vhs and chs in your only network so if you see this one you can see 192.168 10.0624 that is nothing but your vh1 192.168.10.074 so like that i have added all your subnets in your older network and created this data prefix then we need to create a site list cyclist 400 for vh4 is already there and vpn 10 that we are using in our lab that is also already there can give nest and topology we are not doing anything in this one so click nest and click on traffic data here we have to create a new rule we can name it ch4 dia setup click on sequence type click on custom so i'm going to add a new sequence rule the first rule we should match destination data prefix and select the overlay traffic and then accept so this rule basically allowing traffic coming from your lan user towards any ip address in your overlay network we are allowing the traffic so we are matching this destination and click on action accept and then save this rule and i'm going to add one more so here we will match source data free pix and match this one csrv ch4 vpn 10 prefix that is nothing but one into units of state 6.0 the one we are trying to allow the internet access and uh action click on accept when you click on outside you will see there are multiple options getting enabled click on nat vpn so it simply says traffic coming from this uh particular prefix send the traffic to a nat enabled vpn 0 interface so when the traffic coming from this one is 6.1 when it reaches this router it will be sent to nat enable interface which is this one towards the internet save and match and create one more rule matching source data prefix same prefix action accept not vpn and also local t-lock so the local t-log we need to sit for that public internet okay public internet seven match so right now we have three rules one to allow traffic to any overlay uh ip address in your network the next rule is to allow a particular prefix to access the internet and this last tool to match the t lock and the default action will be at the end will be to drop we need to click on accept save and match now we will save the policy click next this is the uh the policy name that we are going to apply uh given ch for the setup policy so here we have to click on traffic data click on new site list and vpn list so here you can see the direction from services that is traffic coming from your services vpn towards your router and i'm going to select only for the site 400 and select the vpn 10. in our lab we have only vpn 10 so we're giving only for site 400 and vpn site 400 is nothing but our ch4 and then add so it is added now we can just quickly preview the policy so the policy simply says vpn 10 matching the destination overlay accept and then traffic coming from this particular source prefix accept and add vpn 0 and this one setting the t lock and it is getting applied to site 400 alone in the lab setup so i'm going to save this policy so now we have this ch4 dia setup we will click attach get push to the v-smart now the policy is pushed let's verify that under policies we can see the policy true here let's go to our machine now you can see the internet access is there and from cli i can trace uh to the public ip and the traffic is going out of 61 and then towards the internet gateway and also let me confirm the ping towards the other uh lan eyepiece 192.168.10.1 yeah so the only traffic also is working fine that is from from this machine 6.4 i am able to ping 182 168 10.1 so now let's go to our we manage go to networks click on ch4 under real time you can click on nat you can see ipnot translations that is happening on the ch4 you can see the traffic inside local address 6.4 is coming and getting netted to this ip inside global address 10.127.201.1.1 the outside local address remains same there is a public ip where the traffic is going out and the number of port numbers we are of all the other details so that's the position how to configure dia on a ch routers now let's go to policies and disable this and we'll configure nat dia root method not the root method we just have to configure a sdf default route under a vpn 10 that is under your service vpn and we have to give the nest up of your vpn0 interface so that will point to your uh nat enable to vpn zero interface and now the policy is not there so right now you can see everything is showing false let's go to templates go to feature templates so all the csrb templates will come here and we have to go under vpn 10 vpn template here it is csr vpn vpn template here we need to make the changes under ipv4 root so right now there is nothing added here under vpn 10 so you can see sure and pipe include ip root you can see there are two default routes for your van interfaces only one for your mpls link and one for your internet link under vr of nothing is added once we add we can see that uh getting held here as well i think we have to check under ip nat so once we add the config we will see ipnot root vr of 10 and then default towards global we will see that now so add a new ipv4 root 0 0 0 so instead of clicking uh add desktop we click on vpn and we globally make it on and then click on add so you can see it is added and the gateway is showing as vpn now click on update this config will get pushed to your ch4 you see the config difference side by side okay now you can see this ip networt vrf 10 a default towards cobble is getting added just everything is same only i will give configure it is getting applied now this access now we will go to the cli and confirm that pin at okay now you can see it got added and now we'll see we'll try to ping so i'm picking the uh the internet ip public ip using vrf10 from uh the source ip i'll give it 192.168.6.1 now i'm able to ping i should be able to ping from 60 also because this is applied on the uh vr of 10 itself as you can see here ipnet we are of 10 so all the prefix under vr of 10 that is your vpn service vpn 10 now we will get the internet access now we will vary from the machine as well we will verify from the the pc also just refresh the pages and see whether it's going through yeah we're able to see its opening try to open some different pages yeah google also opening let's verify so we are doing it from 6.4 this one and we should be able to ping metadata should be able to ping our 19216.1 that is my vh1ip address in the oral network and now we will also verify from our monitors network ch4 real time you can click on that translations you can see still the traffic coming from the same ip64 and the translations are happening so that's the procedure how you can configure the uh direct internet access for ch router using a nat dai root method so in this method we just simply added a default route pointing to the vpn so this is the config actually we have added ip so i p nat root vrf10 that is your service vpn towards global so this is ios xcsd image so it is showing like global so in vh we will see ip root uh you know towards vpn0 uh this is ios xc image so it is showing us global and also we can check the roots show ip root vrf10 we can see a default route that is showing in asterisk md there is nothing but a small n stands for nat and also you can see dnd is nothing but nat dia so it simply says there is an ada root added under this vr of 10. so that's the procedure how you can configure the nat dia root method under ch4 so in this method like i said earlier all the prefixes under vpn 10 will get internet access when you are using the centralized data policy whatever prefix that you are mentioning under the source data prefix only that prefix will get a direct return access like in this example we enabled it for 192.168.6.0 subnet this one thanks for watching the video don't forget to subscribe and share with your friends have a nice day you

Channel: SivakumarNetLabs

Views: 2,016

Keywords: cisco sdwan dia, cisco sdwan dia configuration, cisco sdwan dia configuration videos, cisco sdwan dia configuration guide, cisco sdwan dia video tutorials, cisco sdwan direct internet access configuration, cisco sdwan local internet breakout configuration, cisco sdwan dia guest user internet traffic, sdwan direct internet access, cisco sdwan dia using Nat dia route, cisco sdwan dia configuration using Centralized data policy, cEdge dia configuration, best sdwan video on youtube

Id: ZDHG0XbR8qE

Length: 22min 57sec (1377 seconds)

Published: Wed Nov 18 2020