Cisco SDWAN Dynamic On-Demand Tunnels configuration

hi guys in this video i'm going to discuss about cisco sd van dynamic on-demand tunnels this is a new feature introduced in release 20.3.1 this feature enables you to configure an inactive state of tunnel between the edge devices reducing the performance demands on devices and reducing the network traffic so this is the lab topology i have i have vh1234 and vh22 when you onboard all these vhs and chs um it comes with the full mesh topology and each device establishes uh ipsec tunnel and also a bfd session with other vegs before it start forwarding the traffic between them so this is my vmanage when i go into my vh1 for example and when i click on the real time say bfd sessions you can say i have five branch devices so i established bfd session with other four and also you will see the ipsec sessions so there will be four ib6 sessions so imagine you have like some 500 branch devices you have to create a 499 session with other branches in order to forward traffic between them so that is the um you know uh problem having full mesh uh your lower end devices performance might be impacted if you have like a thousand thousand finder tunnels with other branch devices so we go for the hub and spoke but in up and spoke so in urban spoke what happens uh let's say if i make a vh20 as a hub router and all the other as a spoke so the traffic if i from vh1 if i want to reach the ch4 i have to send the packet to hub and hub will forward back to your ch4 so instead of reaching directly i extend one hop and then reaching to my ch4 so it while i have i mean instead of reaching directly if i go via hub a slight latency increase you can see you know when you have open spoke setup and also the hub router will have more traffic and you know performance because all the vhs will form a ipsec tunnel to the hub router so with cisco sd1 dynamic on demand tunnels between the cisco spoke devices you know the tunnels are triggered to set up only when the traffic between the two devices that is uh let's say you have a happen spoke topology vh1 and vh22 that is your hub router will by default have ip67 i mean all the spokes will have ipsy can be a decision only to our hub router and let's say when you enable this dynamic on-demand tunnel feature in your sd-wan topology uh the vh1 wants to send a traffic to let's say vh2 it will generate uh ipsec uh session and bfd session between vh1 and vh2 and then start sending the traffic after the flow of traffic between the device stops between vh and vh2 a user configurable inactive timer starts and after the configure timer the tunnel between the device is remote the on-demand link between the two devices is then considered to be inactive so in this inactive state it does not use network bandwidth and does not affect device performance so by doing this it improves the performance especially on less powered you know platforms operating in full mesh network also it uh you know improves the latency in the up and spoke deployment when on-demand tunnels are used between the spokes so now let's see uh the dynamic on-demand uh tunnel uh future and the process how it works let's see a sample topology like this we have branch one connected to the hub that is edge two and then it goes to branch four let's see um when there is no uh traffic passing between your branch one and branch four there will be no active tunnels between the uh edge one and h four there is nothing but your branch one and uh branch four is or h4 and when a host behind your edge one sends a traffic destined to your host that is behind your edge four the first packet goes to your hub router the hub router passes it to a branch four and then reaches your host behind the h4 so now your edge one provisions the tunnel and start the bfd session now the packet uh will come back from your hg4 the reverse traffic will go to your hub and then hub forwards to your edge one so now your branch four there is a g4 also provisions a tunnel and it starts the bfd session so at this point of time where both the h1 and h4 initiated the tunnels the on-demand tunnel between the h1 and ag4 will be coming up and the bfd session will also come up once the tunnels uh comes up and the bf session also comes up the packet will not go to your hub router the packet will directly go from branch one to your branch four that is from edge one to hg4 so until the traffic passing between your edge one and a g4 the dynamic on demand tunnel will be up and in this future uh the traffic that is the traffic going in uh on demand tunnel will be tracked when there is no traffic passing between your h1 and h4 uh there is a on-demand tunnel time-out countdown that begins by default it is like 10 minutes for 10 minutes um when there is no traffic the tunnel will be active and for 10 minutes continuously let us say there is no traffic going between your h1 and h4 the timer stops and the tunnels will be [Music] you know it will be inactive and the bfd session also will be coming down so basically um we create the dynamic on-demand tunnel only when the interesting traffic passing between your edge one and towards your ag4 when there is no traffic your tunnels will be teared down that will be in inactive state now let's see how to configure this dynamic on-demand tunnel feature in our hd1 setup so now configuring the on-demand tunnel it's a four-step process the first step is to configure the centralized control policy in your v-smart then you have to configure the omp settings on your v-smart then half device configuration then on go to the spoke devices let's see them one by one so let's go to the v-smart controller configuration this is the centralized policy that we need to configure so we have to create a sequence i mean a control policy matching the route and matching all the brand sites then accept it then we have to set a t lock action backup under t lock list hub t lock then we have to create one more sequence rule and match the t lock and action will be accept and default also should be accepted these are just the cyclists and the t logs and we apply for all the branches in the outgoing direction so this actually ensures that the backup pass through the hub for communication between all the spoke devices the second is the uh step is the omp settings so the omp settings we have to configure on the vsmart controller itself under omp the send path limit should be system so the explanation given is like when non-demand tunnels are enabled spokes use backup mode through the hub so a higher path limit is necessary to accommodate this increase the cisco v small controllers and path limit to auditize all available paths then we that is the hub device configuration that is a device that you design as a hub or a backup route we have to configure this we have to configure under vpn0 we have to configure the service te so uh this ensures that the cisco sdn overlay management protocol on the spoke devices accept the backup path through the hub which is being added as a intermediate path between the two spoke devices without this the backup pawn through the hub would be considered invalid and unresolved by the spoke devices so in the hub device the traffic engineering services must be enabled so the fourth step is the configuration on your spoke devices so spoke devices uh under omp we have to enable the ecmp limit system when on-demand tunnels are enabled spoke devices create both direct and backup path to accommodate the need for more path increase the ecmp limit and then we have to configure on-demand tunnels we have to enable it under uh systems so under systems we have to enable on demand enable and on-demand idle timeout by default it is 10 minutes but we can configure in the range one two six five three five so on the spoke devices enable on-demand tunnels at the system level in case of multi-home decides enable on demand on all systems in the site that is when you have a site with let's say you have a vrrp site where you have active and standby router on both the routers both active and standby routers we have to enable the on demand so before we start configuring let's understand the topology i have i have one v-bond vmanage and v-smart and i have vh1 vh2 vh3 and vh4 and i have vh22 i'm going to keep vh22 as my hub or backup route and i have vpn 10 in all the vhs and 192.168 10.1 and 20.1 30.1 and 4.1 in respective vlans and i have only one ch that is running cisco ios xc sd1 image and before we start configuring uh we have to make sure we upgrade our controllers there is our vmanage vsmart smart and v1 to version 20.3.1 and the vhs also we upgrade to tonita 3.1 and ch that is cisco ios xcsd and widget we have to upgrade to 17 release because this feature dynamic on demand tunnel feature is supported from that release so these are the releases this feature is supported cisco ios xc release 17.3.1.8 and cisco vmanage release 20. 3.1 so first we need to upgrade all our devices to the appropriate supported image so this is my vmanage console first check the vmanage so we managed running in 20.3.1 and my v-bond that is also running in 20.3.1 and my v-smart that is also running in 23.1 and let's go to the edge devices so i have four v edges that is all running in 20.3.1 and i have one ch there is a csr 1000 v that is running in 17.03.0 so now we have all our controllers and edge routers running in the supported software releases now we can start configuring the dynamic on-demand tunnel feature so let's start with the first step there is a centralized control policy a central control policy we have to configure on cisco vsmod must include the t lock action backup this ensures the backup path through the hub for communication between all the spoke devices and the second is the centralized control policy must accept all spoke prefixes and the control policy must accept t lock of all spoke devices so this is the policy example given and now i'm going to configure this so i'm in my v smart i'm going to policies under policies i'm going to give ad policy we need the sites so i'm going to add a new site list to give all spokes all spoke sites so before we configure the site list i want to show you the site that we have let's go to the main dashboard so i have five devices so i'm going to keep vh22 that is with site22 as my hub so i'm going to configure uh a site list with all the other vhs that is vh1 with site id 10 2 with 23 with 30 and ch4 with 40. so now let's go to our policies add policy i'm going to add only the sites and add new sites so all spoke sites will be like 10 20 30 140. so my site is added and we also need the t lock of a hub that i already configured so my t lock ip for my hyper router is 22 22.1 caller is business internet and ipsec so site is configured and t-log is configured going to give nest so now click on add topology go to custom control so this is like so now let's click on the sequence type select the root add a sequence tool so here we are going to match the sites besides all your all all spoke sites that is 10 20 30 40. so i have selected all the sites now let's go to the action action will be accept and first which click on the t log action t log action you have to select backup now next is t log we have to select the t log list for the hub hub backup site that we have created so i have selected all spoke sites and then clicked on accept and backup taylor action backup until log list the hub list so that is the first control policy that we configure sequence 100 match root that's it then second is to match the t locks so before that i want to save this save match in action now i have to again click on sequence type this time i'm going to select t lock click on the sequence rule i'm not matching anything i'm going to match all the t lock i'm going to click on action just click accept and then save action imagine action then the default action will be reject that i have to make it accept save match in action so this is for the root matching the side and then d lock back up back up until the list is also added okay and save the control policy next so here we are not doing anything nest so here i give the name dynamic on demand policy and how to give a site list so in the outbound side we have to give all spoke sites all spark sites i selected and then click on add so now let's preview the policy before we apply so this is my control policy dynamic condiment tunnel one and sequence one match routes all the sites four sites action accept set t lock action backup t-lock is the hub backup site then another uh sequence i'm matching the t lock all the t lock and action accept and default action accept this is just a list of all spokes in hub i have only one uh t locks and we are applying for all the spoke sides in the outbound direction this control policy dynamic on demand tunnel one let's confirm the same in the example whether i configure correctly so matching the route for all branches set action at served and set action back t-lock action backup t-lock list habit t lock then match t lock action accept default action accept and apply it in the outbound direction we can save the policy so now the policy is configured the next step is the omp setting on your v-smart so under v-smart in omp we have to give send path limit system so right now in my v smart uh that configuration is not there vsmart i have onboard using a device template so i have to create a feature template for omp and then call it under my vsmart template which you can see here so i'm going to feature template to select the device sv smart and then i have to click on the feature template omp just name it vsmart omp template so everything uh is going to be same the only thing i'm going to change is here the number of path advertised per prefix i'm going to give globally system rest everything i'm keeping as it is i'm going to save this and now i'm going to the device template and under v smart template you can see it is already applied to your uh vsmod going to edit this so you can see omp is using a default template so now i'm going to call the vsmart omp template which i just created i'm going to update the vismod let's see the config diff you can see under omp center path limit system is getting added i'm going to push it now so the configuration is pushed now let's verify in the cli ok now you can see the send path limit system in the vsmart so the second step is over so the third step is to configure the hub device the hub device uh i'm using a vh device only so this is the config we need to enter under vpn 0 i have to configure the services t that is a traffic engineering services so in our topology um the hub router is vh22 i have already onboarded this vh22 using a separate device template so you can see so dod hub i given that is attached to your device vh22 so i'm just going to edit i mean create a new vpn 0 template and then attach to this one i'm going to feature template add a new template for vh cloud so i'm to configure a separate vpn template so i'm going to just call it a dod hub vpn0 template so you can see vpn0 is already there [Music] omp i period i need to configure now default i'll give a device specific so vpn0 desktop ip address that we can add later and then okay now under services we have to choose uh te that is traffic engineering service and then click on add so under vpn 0 now we added this t that is what we are supposed to do now and rest everything is same i'm going to save this now i'll go to my device template the dod hub i'm going to edit this and i'm going to my transport and management vpn directly so you can see under transport and management vpn i have vpn 0. i'm just going to change this template and configure the one just now dod hub vpn0 template rest everything i'm going to keep as it is i'm going to update this so we have to edit this so all the information is only there only the vpn nest of iprs have to give so the next top ip address will be [Music] 4242.1.1 that is for our default root so my interface ip is this 4242.2 and 4242.1.1 will be my stop ip address let's see the config div just want to make sure that service t is added you can see it is getting added i'm going to configure this now so i'm in my vh22 right now the config is not pushed i'm just checking here okay now we can see under vpn zero service te is added so now our step 3 is completed that is adding your vpn services te now the fourth step is to configure your spoke devices that is under the spoke devices under omp we have to give the ecmp limit system for all my spoke devices i am running them through the template all vhs so you can see all the vhs running in this template i'm going to create a new omp template feature template and then attach it to your existing device template itself so now i'm going to configure a new feature template for omp for all spoke routers i'm going to vh cloud and under basic information i have omp so i'm going to name it all spoke omp so the grade rule is released on so everything will be default only this ecmp limit i have to increase to 16 and then ipv4 i'm just enabling osp of bgp just everything is same so our main goal is to keep this ecm limit to system so i'm going to save this so now i'm going to the device template you can see all vhs template so that i'm going to edit and add this omp template so you can see omp there's a whole template here i'm going to replace that with all spoke omp and then um so we have to configure two things in our spoke routers one is this omp ecmp limit system the other thing is the on demand feature we have to enable under systems so under systems we have to enable on demand enable command and on demand idle timeout so now i'm going to configure a system template for all spoke this one is for vh page cloud and then the system so i'm going to name it all spoke system template this is for the duty dynamic on demand so everything i'm going to keep as it is default rate we give always 11520 and rest everything again is same under advance in the bottom if you see you will have this feature enabled on demand tunnel so that i'm going to globally make it on and the idle timeout is default 10 i'm going to reduce it let's say let's say we'll give 5 minutes so that's it we have enabled a on-demand tunnel and given the idle timeout and then we save this so now we go to the device template all vhs then we'll give the edit so under systems there is already one um feature template is there i'm going to remove that with the alt spoke template for dod we just created that and also okay omp it's not a change let's change this all spoke omp which we created earlier for giving the ecmp limits of system so that's it let's update this on your spoke okay so you can see green tick i'm going to give nest let's see what's it changing in vh1 so under systems on demand enabled on demand identimate five and under omp uh we can see the ecmp limit system is there that is for your vh1 and vh2 let's confirm so vht also you can see on demand enabled vh3 let's confirm that so vh3 configuration also we have this and let's confirm the omp also ecmp limit system okay i'm going to push this configuration to the vhs now so the validation is success it is getting pushed to our v edges uh now the config is pushed to all the three v edges let's verify in the cli also so now i'm in vh1 i'm giving show run so under systems i have on demand enable idle timeout 5 and under omp let's confirm the ecmp is there he simply bit 16 is there same with vh2 on demand is enabled omp session is enabled i'm in vh3 now on demand is enabled and omp system is also enabled so ch4 on ch4 i'm going to configure via the cli go into the config mode going to systems on demand first i'm going to enable and it on demand ideal timeout i'm going to give five then i will go under sd van omp we have that ecmp i fan limit i'm going to give system that's it i'm going to commit this i'm giving show steve and run okay so in this you can see the system config we can see on demand enabled on demand rl timeout 5 also under sd-wan you can see the ecm under omp ecmp limit system so with that we have configured all the four uh required configuration so now i'm going to my we manage and activate the policy that i created for dynamic on demand so this is the one dynamic on demand policy now i'm going to activate this policy so it's in progress now now the policy is posed successfully let's uh go into our vhs i'm in vh1 let's check the uh show ip route let's that's the omp routes so you can see i'm receiving um let's say 192.168.20.0 i'm receiving from 2020.1 that is my vh2 and also i'm receiving from 2222.1 that is my vh 22 actually so if i see my topology here you can see this is my destination ip 192.168.20.1 191 says 20.0 24. that is this segment that is actually coming from vh2 so that is getting anodized both from my vh2 as well as vh22 which is my hub backup router you can see the same for uh from vh3 192.1683.1 so 30 also you can see it learned twice uh that is both from 3030.1 that is my vh3 and also from vh22 and also the 660.1 is nothing but my the ch4 that is 40.1 so that 40.00 is coming from ch4 as well as from my hub backup so there is one more command which give more idea on this show omp roots received so in the received you can see from 190 to 160 to 20.0 you are receiving from 22 22 22.1 that is showing under status cir cir is nothing but chosen installed and resolved so the first packet will select this and it will go out of this and from 2020.1 that is uh the actual vh2 from where you are receiving these routes directly that is showing ia you can say it's on demand inactive so when we initiate the traffic when it becomes active you will see cir under this 20 20 20.1 also in current state i just want to show you show bfd [Music] sessions you can see the bfd session is found only between my vh1 and my vh22 and also show ipsec open connections if you see there is only one connection that is towards my 4242 1.2 that is nothing but my vh22 van interface ip address 4242 1.2 and also there is one more command show systems on demand remote systems you can see uh the on demand status uh is inactive with your 2020.1 that is your vh2 site id20 so 22 we are not forming any on different tunnels so that is uh saying no so with 30 we have on demand that is showing s and that is inactive and with 40 i have on demand yes and also the current status is inactive so now i am going to initiate a ping from my vh 1 towards my uh let's say vh82 though both are actually spoke devices and i'm going to ping from 182.168 10.1 towards 192.168.20.1 and let's see what is the current status in vh2 just want to confirm that show vfd sessions so again vh2 also have a pv session only with the vh22 the hub router show ipsec one connection you can see there is only one connections now and also show system on demand remote system so towards the vh1 site id 10 that is 10.10.1 it's showing inactive as of now so now i'm going to initiate a ping from my vh1 ping 192.168.20.1 under vpn 10 that is this ip one into one system 20.1 okay okay now let's see uh whether our on-demand tunnel status came up show system on-demand remote status and you can see with the site id20 22.1 that is my vh2 the tunnel status became active and immediately you can see show bfd sessions you can see i have created a bfd session towards my 4040.1.2 there is nothing but my van iprs of vh2 and also one more command show imp roots received now to just reduce this font so now you can see for 192.168.20.2 so earlier it was showing cir here now for uh vh uh two t-log it is showing cir so right now it is directly taking this path so that you can see here for other uh spokes like 30 and 40 you can see still it is showing ia because we are not initiated in traffic towards that let's check the same in vh2 also so you can see vh2 also towards vh1 it is active and also you can see two ipc connections so that is from 4040.1.2 to 3030.1 that is from this 4041.2 1.2 1ip towards 3030 1.2 ip6 section is established show vfd sessions you can say vivid session also initiated too now let's do from [Music] now if you see this command you can see the timer is kicked in right now there is no ping going on so the timer is kicked in um we have skipped like uh five minutes so 300 seconds was the default timer so it is once it becomes zero the status become inactive and ipc session and bfd session will go down so right now there is no traffic going so the inactive timer will soon kick in once the idle timeout expires in 71 seconds and till the time you can see the ipsec connection is up and also the bfd session is up towards my uh that is from my h1 to my edge vh2 so once the idle timeout becomes zero this bfd session and the ip section uh will be down between vh1 and vh2 that is the first one 202020.1 this 4040.1 ip 4040.1.2 so another 22 seconds it will be going down the status will become inactive so another two seconds okay now it is in inactive state let's check the ipc connection you can see the ipsec connection towards my vh2 is down and let's check the bfd session the beauty session also so right now i have uh ipsec and bfd sessions only between my vh1 and my hub backup router that is vh32 that is with 4242.1.2 this one 424.2 so right now again all the tunnel status is inactive now from my vh1 to vh two three and four now let's do a trace route from my vh1 and towards my ch4 and let's see what happens trace root vpn 10 and then the ipad is 192.168.40.1 that is from from vh1 i'm tracing to 192.168.40.1 this ip so as you can see the first packet goes to my 172.68.10.1 and then goes to 40.1 there is nothing but my hub router 172.160 10.1 ip so the first packet always goes to my hub and then goes to my ch4 so now let's see the second packet so you can see the trace root directly goes to 40.1 so after that whenever i do a trace it will go to 40.1 directly and if you check the show system on demand remote system status you can see it is uh active with the site id 40 that is st dot system system.1.1 and that is active now also now if you check the bfd session again you can see the public session is established towards my system.one and also ipsec session connection is established towards sys26.1 there is 60.1.2 ip there is a van ipo or ch4 system 1.2 now let's check in ch4 also so the command is show as divine system on demand remote system so now if you see only with site id 10 that is my vh1 the status is active now and here also if you check show sd1 ipsec connection you will see two connection one with the hub router and one with your vh1 and also the bfd session so bfd session also with the hub and also with my vh1 so earlier when i checked it was showing only with my hub router and if you see there is no packet coming in and the timer would have kicked in already and you can see it's a 226 and here also the command to check show is given omp root vpn 10 if you give you can check that so for 192.168.10.0 so the cir comes from tender tender 10.1 that is my vh one t lock and since cir is there it will be directly going to that uh vh1 car nothing but choose an installed result and you can see for from ch4 for 20.0 you can see cir is your hub so that's why the first packet always goes to the hub and you can see from vh2 from which actually you're receiving this packet it's showing ia that is on demand inactive because there is no traffic passing between them so right now in our topology from vh1 towards the ch4 we have active tunnels let's check the same in our vmanage let's go to monitor networks then i select a vh1 from vh1 real time if i go let me check the bfd sessions you can see uh it is established towards your assist 360.1 that is nothing but my ch4 and also the ipsec outbound connections there is also only between my local router towards my hub undone to a ch4 we can also check the tunnel status under van click on tunnels and in the chat option click the drop down and select the option on demand tunnel status you can see whenever the tunnel goes active and you can see it goes inactive so in this section is showing inactive so whenever basically it gives you the status when the tunnel between which router uh it goes active and inactive so now i'm in ch4 you can see the timer is getting expired yeah so now it is became inactive and let's say vh1 also so there is no ip68 i mean the ipsec connection between the vh1 and ch4 gone down now the ip6 session is only between vh1 and router also the pv session now if you see in the vmanage also i mean my vh1 so the ip6 tunnel you can see it's up only between my vh1 and vhl2 for others it is showing down so that's the procedure how you configure the uh cisco sd van dynamic on demand tunnel establishment and if you see from right now there won't be any so everything is inactive now let's say when i ping all the ips 192 168 10.1 vpn 10 let's say i ping 20.1 now my ping 30.1 i'm just initiating a pink between all the uh branches so that i'm bringing up all the tunnels so now you can see all of them are active and you can say it creates a ipsec session with all the other branches so from vh1 i initially ping to all the other uh vh2 3 and 4 other spoke routers so i can see the outbound ipc connections with all the others now let's check in vh2 vh2 ip6 session i can see it's forming only with my hub and also with my vh1 because i am not initiating with 30 and 40 ips with that we come to end up the lab demo video about uh how to configure cisco's demand dynamic on-demand tunnels so like how we saw in the sample topology we made uh vh tonita as a hub backup router and uh all other routers like vh one two three and four are spoke and we managed to configure on-demand tunnels between them that is we configure the inactive tunnels between these spoke devices and whenever there is a traffic coming from vh1 to two or four the tunnel status from inactive to active it changes and then the traffic directly goes between the spokes and when there is no traffic the idle time mode starts after the idle time mode it again comes back to the inactive state share this video with your friends and colleagues who are interested also don't forget to subscribe to the channel have a nice day you

Channel: SivakumarNetLabs

Views: 1,577

Keywords: cisco sd wan dynamic on-demand tunnels video training, cisco sd wan dynamic on-demand tunnels, cisco sd wan dynamic on demand tunnels, cisco sd wan dynamic on demand tunnels configuration, cisco sd wan dynamic tunnels, cisco sd wan on-demand tunnels, cisco sd wan TE tunnels, cisco sd wan tutorial, how to configure cisco dynamic on-demand tunnels, Dynamic On-Demand Tunnels configuration, cisco sd wan dod, cisco sdwan dod, dod, best sdwan video on youtube

Id: luY6bdLT1d4

Length: 49min 45sec (2985 seconds)

Published: Mon Sep 14 2020