EdgeConnect SD-WAN Reference Design

This section of the guide demonstrates how to design an EdgeConnect SD-WAN deployment based on the customer profile.

Table of contents

• EdgeConnect SD-WAN Reference Design
  • Component Selection
  • EdgeConnect Gateways
    • Transceivers
  • Orchestrator Selection
  • Throughput Licensing
  • Boost Licensing
  • Advanced Security Licensing
  • Hub Design
  • Branch Design
    • Small Site Design
    • Medium Site Design
    • Large Site Design
  • Overlay Design

Component Selection

This section describes the components of a reference architecture using Aruba’s EdgeConnect SD-WAN solution.

Note: This reference architecture is based on the 9.1 release of Aruba Orchestrator and EdgeConnect SD-WAN gateways.

EdgeConnect Gateways

Follow the steps below to determine which gateway is appropriate at each location.

• Determine bandwidth requirements
  • If asymmetric circuits are in place, use the higher number for bandwidth calculations.
• Determine fiber port, power supply, and HA requirements.
• Identify if advanced features are required, such as advanced security or Boost.
• Select the appliance that supports the requirements:

Note: WAN bandwidth assumes bidirectional traffic (symmetric uplink and downlink). For total WAN throughput (Rx+Tx), multiple these numbers by 2.

Transceivers

EdgeConnect SD-WAN gateways have been certified to operate with the following transceivers. Use the table below to verify selected transceivers support physical connectivity.

Orchestrator Selection

The table below lists Orchestrator as a Service options.

Throughput Licensing

Each site must be licensed for the appropriate bandwidth.

To calculate the throughput licenses required for a given gateway, determine the total WAN bandwidth the gateway will use. For example, for a 100 mbps Internet circuit and a 20 mbps MPLS circuit, the total is 120 mbps. For asymmetric circuits, such as a 50 mbps download and 5 mbps upload Internet circuit, use the largest number for this calculation. Since cellular back-up is used as path-of-last-resort only, it is not used for throughput license calculation.

Note: When using EdgeHA or Traditional HA, devices must be licensed for all circuits.

The table below shows bandwidth tiers.

The table below summarizes which bandwidth tiers are supported on each device.

Boost Licensing

Boost, though not currently used in this design, is sold in blocks of 100 mbps and allocated to the gateways in 1kbps increments. To determine the amount of boost licensing required, follow the below steps:

• Determine the applications to accelerate.
• Determine the number of sites needed to accelerate the applications.
• Determine how much bandwidth the specific applications require to work optimally at each site.
• Purchase the total amount of boost to apply at the sites.

Advanced Security Licensing

The advanced security license provides IDS capabilities in EdgeConnect. The example design does not include this feature. To determine the advanced security licensing required, use the guidance below.

Note: Locations serving as a Data Center, Large Campus, Hub, or Network Gateway that require the Advanced Security License must have an Unlimited license.

Hub Design

The following components are selected to meet the hub requirements. Hubs are purchased in five-year terms.

Hardware

Licenses

If planning to replace MPLS circuits with higher-speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

The following list summarizes the recommend hub design elements.

• Gateways are placed inline.
• WAN connections plug into the upstream WAN side switch and are then connected to gateways to allow for traditional HA. This requires additional IP space on the WAN transports.
• Gateways connect via L3 to the LAN, into a WAN aggregation block and peer OSPF.
• BGP adjacency is maintained with the MPLS provider to facilitate migration.
• Advertise a hub summary route and default route into the Subnet Sharing.
• All branches will leverage a template with peer priority to select a hub when the same route is presented from multiple hub gateways.
• Set high OSPF metric when redistributing from Subnet Sharing (WAN) to OSPF (LAN).
• Ensure traffic between the data centers uses the Data Center Interconnect (DCI). Adjust OSPF metric as needed to achieve this.
• When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign one gateway a higher metric to ensure flow symmetry.

Branch Design

Small Site Design

The following components were selected to meet small site requirements, purchased in five-year terms.

Hardware

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

The following list summarizes the recommend small site elements.

• Gateway is placed inline.
• Gateway is connected to switch via single L2 connection.
• Gateway acts as default gateway for any subnnets at branch.

Medium Site Design

The following components are selected to meet medium site requirements, purchased in five-year terms.

Hardware

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

The following list summarizes the recommend medium site elements.

• Gateway is placed inline.
• EdgeHA is used for high availability.
• Gateway is connected to collapsed core via L3 link and peer OSPF.
• When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign one gateway a better metric to ensure flow symmetry.
• When redistributing from OSPF to Subnet Sharing, assign one gateway a better metric to ensure flow symmetry.

Large Site Design

The following components are selected to meet large site requirements, purchased in five-year terms.

Hardware

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

The following list summarizes the recommend large site elements.

• Gateway is placed inline.
• EdgeHA is used for high availability.
• Gateway is connected to collapsed core via L3 link and peer OSPF.
• When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign one gateway a better metric to ensure flow symmetry.
• When redistributing from OSPF to Subnet Sharing, assign one gateway a better metric to ensure flow symmetry.
• LTE connection, which requires a third-party device to terminate the LTE with an ethernet handoff, is used as a path-of-last resort, forwarding traffic only if both circuits are down.

Overlay Design

The following list summarizes the recommend overlay design elements.

• Cloud firewall integration are used to tunnel specific to cloud filtering.
• EC-V is deployed in IaaS providers to facilitate better access to services hosted there.
• Zone-Based Firewalling is configured on the gateways to provide basic filtering of Internet traffic when cloud firewalling is not used.

The table below illustrates the BIO design elements. All traffic matches start with the default overlay ACL and are modified as necessary.

---