Link Search Menu Expand Document
calendar_month 06-May-24

EdgeConnect SD-WAN Reference Design

This section of the guide demonstrates how to design an EdgeConnect SD-WAN deployment based on the customer profile.

Table of contents

Component Selection

This section describes the components of a reference architecture using HPE Aruba’s EdgeConnect SD-WAN solution.

Note: This reference architecture is based on the 9.4 release of Aruba Orchestrator and EdgeConnect SD-WAN gateways.

EdgeConnect Gateways

Follow the steps below to determine which gateway is appropriate at each location:

  • Determine bandwidth requirements.
    • If asymmetric circuits are in place, use the higher number for bandwidth calculations.
  • Determine fiber port, power supply, and HA requirements.
  • Identify if advanced features are required, such as Dynamic Threat Defense (DTD) or Boost.
  • Select the appliance that supports the requirements:
ModelEC-10104EC-10106EC-XSEC-S-PEC-M-HEC-L-HEC-XL-H
Typical DeploymentSmall Branch / Home OfficeSmall BranchSmall BranchLarge BranchHead Office/DC Large HubData Center Large HubData Center Large Hub
Typical WAN Bandwidth2-500 Mbps2-1000 Mbps2-1000 Mbps10-3000 Mbps50-5000 Mbps2-10 Gbps2-10 Gbps
Simultaneous Connections256,000256,000256,000256,0002,000,0002,000,0002,000,000
Recommended WAN Boost up to:200 mbps250 mbps250 mbps500 mbps1 gbps1 gbps5 gbps
Redundant / FRUsNoNoNoSSD and Power (AC or DC)SSD and PowerSSD and PowerSSD, NVMe, Power
Data Path Interfaces4 x RJ45 10/100/10002 x RJ45
2 x Combo
2 x 1/10G SFP+
4 x RJ45 10/100/10008 x RJ45 4 x 1/10G Optical8 x RJ45 4 x 1/10G Opitical6 x 1/10G Optical6 x 1/10/25G Optical

Note: WAN bandwidth assumes bidirectional traffic (symmetric uplink and downlink). For total WAN throughput (Rx+Tx), multiple these numbers times 2.

Transceivers

EdgeConnect SD-WAN gateways have been certified to operate with the following transceivers. Use the table to verify that the selected transceiver(s) supports physical connectivity.

Transceiver SKUDescription
EC-SFP-SRSFP+,1/10G, SR
EC-SFP-LRSFP+,1/10G, LR
EC-SFP28-25G-SRSFR28 Transceiver, 10/25G, SR
EC-SFP28-25G-LRSFR28 Transceiver, 10/25G, LR

Licensing

Follow these steps to license an EdgeConnect SD-WAN deployment. Licensing is purchased on a per-gateway basis.

Step 1 Select a Term based subscription license in intervals of 1, 3, 5, or 7 years. Choose Foundation, Advanced, or On-Premise. Choose the same tier for all gateways in the environment. More information on tiers is provided below.

Step 2 Choose the EdgeConnect gateway (physical or virtual) software bandwidth. The license is based on the aggregate WAN-side bandwidth of the given node and has options up to 8 bandwidth tiers, depending on the subscription tier. More information on these tiers ir provided below.

Step 3 (Optional) Add Boost. licensed in units of 100 Mbps and 10Gbps of WAN optimization, can be deployed flexibly to sites that require application acceleration.

Step 4 (Optional) With the Add Dynamic Threat Defense (DTD) license, the EdgeConnect Platform supports IDS/IPS. In the future, additional security-related features may be tied to the DTD License.

Tiered Subscription Licensing Model

HPE Aruba provides three licensing tiers for EdgeConnect SD-WAN deployment: Foundation, Advanced, and On-Premise.

  • Foundation provides a value-centric option including essential SD-WAN features and advanced NGFW features. It includes Cloud Orchestrator.
  • Advanced provides maximum performance with advanced SD-WAN features and advanced NGFW features. It includes Cloud Orchestrator.
  • On-Premise provides maximum performance for on-premise deployment with advanced SD-WAN features and advanced NGFW features.

Advanced is the recommended tier for most customers because it supports all the SD-WAN features and provides the most flexibility,

The table below outlines the differences in the tiers

 Foundation (AAS)Advanced (AAS)On-Prem
Bandwidth Tiers3 tiers (100M, 1G, 10G)20M/50M/100M/200M/500M/1G/2G/Unlimited20M/50M/100M/200M/500M/1G/2G/ Unlimited
BIOs3 (RealTime, Critical & Default)77
Network Segments/VRF2 (auto-enabled, default & guest only)6464
RoutingBGP, OSPF, Subnet SharingBGP, OSPF, SSBGP, OSPF, SS
Mesh NetworkingNoYesYes
Multi-region TopologyMax 4 regions, 4 hubs/regionYesYes
AppExpressNo (Monitor only)Yes (Monitor and Steer)Yes (Monitor and Steer)
OrchestratorCloud Orchestrator FoundationCloud Orchestrator AdvancedOn-premises
Orchestrator Stats Retention24h/7d/1mo (m/h/d)72h/14d/3moCustom

Common features in all licensing tiers include:

  • Unconstrained site count
  • Path Conditioning
  • NGFW
  • Firewall protection profiles
  • AVC/1st packet iQ
  • Zero Trust Segmentation (Roles)
  • DDOS detection/mitigation
  • EC SD-WAN Fabric Orchestration
  • Advanced Crypto
  • EdgeHA
  • ZTP / Templates.

Bandwidth License

Each site must be licensed for the appropriate bandwidth.

To calculate the throughput licenses required for a given gateway, determine the total WAN bandwidth the gateway will use. For example, for a 100 mbps Internet circuit and a 20 mbps MPLS circuit, the total is 120 mbps. For asymmetric circuits, such as a 50 mbps download and 5 mbps upload Internet circuit, use the largest number for the calculation. Since cellular back-up is used as path-of-last-resort only, it is not used for throughput license calculation.

Boost Licensing

Boost, though not currently used in this design, is sold in blocks of 100 mbps and allocated to the gateways in 1kbps increments. To determine the amount of boost licensing required, follow these steps:

  • Determine the applications to accelerate.
  • Determine the number of sites needed to accelerate the applications.
  • Determine how much bandwidth the specific applications require to work optimally at each site.
  • Purchase the total amount of boost to apply at the sites.

Dynamic Threat Defense

The advanced security license provides IDS capabilities in EdgeConnect. The example design does not include this feature. To determine the advanced security licensing required, use the guidance below.

Example Hub Design

The illustration below shows an example hub.

RA - Hub

Key elements of the design include:

  • Gateways are placed inline.
  • WAN connections plug into the upstream WAN side switch and are then connected to gateways to allow for traditional high availability. This requires additional IP space on the WAN transports.
  • Gateways connect via L3 to the LAN, into a WAN aggregation block and peer OSPF.
  • BGP adjacency is maintained with the MPLS provider to facilitate migration.
  • A hub summary route and default route are advertised with Subnet Sharing.
  • All branches use a template with peer priority to select a hub when the same route is presented from multiple hub gateways.
  • High OSPF can be set when redistributing from Subnet Sharing (WAN) to OSPF (LAN).
  • The design ensures that traffic between the data centers uses the Data Center Interconnect (DCI). The OSPF can be adjusted as needed.
  • When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign a higher value to one gateway to ensure flow symmetry.

The following components are selected to meet the hub requirements. Hubs are purchased in five-year terms.

Hardware

QuantitySKUConsideration
4EC-L-H (Recommended)Two per hub. Provides high levels of hardware HA
 EC-XL-H (Alternative)Use if high levels of Boost are required or 25G connectivity to the LAN / WAN
 EC-M-H (Alternative)Use if less bandwidth is needed
1  
12EC-SFP-SR (Recommended)Customer currently has SR fiber plant
 EC-SFP-LR (Alternate) 

Licenses

If planning to replace MPLS circuits with higher-speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

QuantitySKUConsideration
4HPE ANW EC Adv UL 5yr Sub SaaSCustomer bandwidth above 2 Gbps at the hubs
 HPE ANW EC Adv 2Gb 5yr Sub SaaS (Alternate)Can be used when customer has lower bandwidth needs
 HPE ANW EC Adv 1Gb 5yr Sub SaaS (Alternate)Can be used when customer has lower bandwidth needs
 HPE ANW EC Adv 500mb 5yr Sub SaaS (Alternate)Can be used when customer has lower bandwidth needs

Example Branch Design

Small Site Design

The illustration below shows an example hub for a small site.

Small Branch

Key elements include:

  • The gateway is placed inline.
  • The gateway is connected to the switch via a single L2 connection.
  • The gateway acts as default gateway for any subnnet at the branch.

The following components were selected to meet small site requirements, purchased in five-year terms.

Hardware

QuantitySKUConsideration
1EC-10104 (Recommended)Cost efficent for low bandwidth / user count
 EC-10106 (Recommended)Use for higher bandwidth applications or SFP+ is required

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

QuantitySKUConsideration
1HPE ANW EC Adv 500mb 5yr Sub SaaS (Recommended)Based on customers current needs, with room for growth
 HPE ANW EC Adv 200mb 5yr Sub SaaS (Alternate)Can be used when customer has different bandwidth needs
 HPE ANW EC Adv 100mb 5yr Sub SaaS (Alternate)Can be used when customer has different bandwidth needs
 HPE ANW EC Adv 50mb 5yr Sub SaaS(Alternate)Can be used when customer has different bandwidth needs

Medium Site Design

The illustration below shows an example hub for a medium site.

RA - Medium Branch

Key elements include:

  • The gateway is placed inline.
  • EdgeHA is used for high availability.
  • The gateway is connected to a collapsed core using an L3 link and peer OSPF.
  • When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign one gateway a better metric to ensure flow symmetry.
  • When redistributing from OSPF to Subnet Sharing, assign one gateway a better metric to ensure flow symmetry.

The following components are selected to meet medium site requirements, purchased in five-year terms.

Hardware

QuantitySKUConsideration
2EC-10106 (Recommended) 
 EC-S-P (Alternative)Use for higher bandwidths and more hardware HA

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

QuantitySKUConsideration
1HPE ANW EC Adv 1gbps 5yr Sub SaaS (Recommended)Based on customers current needs, with room for growth
 HPE ANW EC Adv 500mb 5yr Sub SaaS (Recommended)Can be used when customer has different bandwidth needs
 HPE ANW EC Adv 200mb 5yr Sub SaaS (Alternate)Can be used when customer has different bandwidth needs
 HPE ANW EC Adv 100mb 5yr Sub SaaS (Alternate)Can be used when customer has different bandwidth needs
1HPE ANW EC Adv HAHA license for the second gateway at the site. Be sure to match tier, bandwidth, and term.
1HPE ANW EC DTD 5yr Sub SaaSOptional DTD license
1HPE ANW EC DTD HA 5yr Sub SaaSOptional DTD HA license

Large Site Design

The illustration below shows an example hub for a large site.

RA - Large Branch

Key features include:

  • The gateway is placed inline.
  • EdgeHA is used for high availability.
  • The gateway is connected to a collapsed core via L3 link and peer OSPF.
  • When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign one gateway a better metric to ensure flow symmetry.
  • When redistributing from OSPF to Subnet Sharing, assign one gateway a better metric to ensure flow symmetry.
  • LTE connection, which requires a third-party device to terminate the LTE with an ethernet handoff, is used as a path-of-last resort, forwarding traffic only if both circuits are down.

The following components are selected to meet large site requirements, purchased in five-year terms. The large site has the highest bandwidth, serving a large amount of users, with HA implemented.

Hardware

QuantitySKUConsideration
2EC-S-P (Recommended)Cost efficent for low bandwith / user count
 EC-M-P (Alternative)Use for higher bandwidths

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

QuantitySKUConsideration
1HPE ANW EC Adv 2gbps 5yr Sub SaaS (Recommended)Based on current needs, with room for growth
 HPE ANW EC Adv 1gbps 5yr Sub SaaS (Recommended)Based on customers current needs, with room for growth
 HPE ANW EC Adv 500mb 5yr Sub SaaS (Alternative)Can be used when customer has different bandwidth needs
1HPE ANW EC Adv HAHA License for second Gateway at site, ensure to match tier, bandwidth, and term
1HPE ANW EC DTD 5yr Sub SaaSOptional DTD license
1HPE ANW EC DTD HA 5yr Sub SaaSOptional DTD HA license

Example Overlay Design

The illustration below shows an example overlay.

Features include:

  • Cloud firewall integration is used to tunnel specific to-cloud filtering.
  • EC-V is deployed in IaaS providers to facilitate better access to the services hosted there.
  • Zone-Based Firewalling is configured on the gateways to provide basic filtering of Internet traffic when cloud firewalling is not used.

The table below illustrates the BIO design elements. All traffic matches start with the default overlay ACL and are modified as necessary.

BIO NameTraffic MatchTopologyLink BondingInternet Egress
Real TimeReal-time communication applicationsMesh topology provides optimal traffic flows between branchesThe High Availability link bonding policy should provide 1:1 FEC to ensure no loss of voice / video trafficDirect-to-net is primary, with hub fallback
Critical AppsBusiness-critical internal apps, such as the inventory system, and SaaS apps such as SalesforceHub and spokeHigh QualityCloud firewall is primary, with a fallback to the hubs which host a backup security stack
BulkAppsLarge internal traffic flows, such as FTP and cloud-hosted file repositoriesHub and spokeHigh Quality. Within the QOS policy ,this BIO is allotted only a certain percent of WAN bandwidth during times of congestion, ensuring that large flows do not saturate the WAN transports.Direct-to-net is primary, with hub fallback, as these flows are large and must go direct to their destinations
DefaultMatch all other traffic, including guestHub and spokeHigh QualityDirect-to-net with a fallback of the data center, since guest traffic is critical to the business

Note: If the Foundation licenses are used, only three BIOs are possible: real-time, critical, and default.


Back to top

© Copyright 2024 Hewlett Packard Enterprise Development LP. The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Aruba Networks and the Aruba logo are registered trademarks of Aruba Networks, Inc. Third-party trademarks mentioned are the property of their respective owners. To view the end-user software agreement, go to Aruba EULA.