EdgeConnect SD-WAN Reference Design

This section of the guide demonstrates how to design an EdgeConnect SD-WAN deployment based on the customer profile.

Table of contents

• EdgeConnect SD-WAN Reference Design
  • Component Selection
  • EdgeConnect Gateways
    • Virtual Appliances
    • Transceivers
  • Licensing
    • Tiered Subscription Licensing Model
    • Bandwidth License
    • Boost Licensing
    • Dynamic Threat Defense
  • Example Hub Design
  • Example Branch Design
    • Small Site Design
    • Medium Site Design
    • Large Site Design
  • Example Overlay Design

Component Selection

This section describes the components of a reference architecture using HPE Aruba’s EdgeConnect SD-WAN solution.

Note: This reference architecture is based on the 9.4 release of Aruba Orchestrator and EdgeConnect SD-WAN gateways.

EdgeConnect Gateways

Follow the steps below to determine which gateway is appropriate at each location:

• Determine bandwidth requirements.
  • If asymmetric circuits are in place, use the higher number for bandwidth calculations.
• Determine fiber port, power supply, and HA requirements.
• Identify if advanced features are required, such as Dynamic Threat Defense (DTD) or Boost.
• Select the appliance that supports the requirements:

Note: WAN bandwidth assumes bidirectional traffic (symmetric uplink and downlink). For total WAN throughput (Rx+Tx), multiple these numbers times 2.

Virtual Appliances

EdgeConnect SD-WAN appliances can be deployed in a virtual form factor on-prem and in cloud environments. Requirements for virtual deployments can be found here.

Transceivers

EdgeConnect SD-WAN gateways have been certified to operate with the following transceivers. Use the table to verify that the selected transceiver(s) supports physical connectivity.

Licensing

Follow these steps to license an EdgeConnect SD-WAN deployment. Licensing is purchased on a per-gateway basis.

Step 1 Select a Term based subscription license in intervals of 1, 3, 5, or 7 years. Choose Foundation, Advanced, or On-Premise. Choose the same tier for all gateways in the environment. More information on tiers is provided below.

Step 2 Choose the EdgeConnect gateway (physical or virtual) software bandwidth. The license is based on the aggregate WAN-side bandwidth of the given node and has options up to 8 bandwidth tiers, depending on the subscription tier. More information on these tiers ir provided below.

Step 3 (Optional) Add Boost. licensed in units of 100 Mbps and 10Gbps of WAN optimization, can be deployed flexibly to sites that require application acceleration.

Step 4 (Optional) With the Add Dynamic Threat Defense (DTD) license, the EdgeConnect Platform supports IDS/IPS. In the future, additional security-related features may be tied to the DTD License.

Tiered Subscription Licensing Model

HPE Aruba provides three licensing tiers for EdgeConnect SD-WAN deployment: Foundation, Advanced, and On-Premise.

• Foundation provides a value-centric option including essential SD-WAN features and advanced NGFW features. It includes Cloud Orchestrator.
• Advanced provides maximum performance with advanced SD-WAN features and advanced NGFW features. It includes Cloud Orchestrator.
• On-Premise provides maximum performance for on-premise deployment with advanced SD-WAN features and advanced NGFW features.

Advanced is the recommended tier for most customers because it supports all the SD-WAN features and provides the most flexibility,

The table below outlines the differences in the tiers

Common features in all licensing tiers include:

• Unconstrained site count
• Path Conditioning
• NGFW
• Firewall protection profiles
• AVC/1st packet iQ
• Zero Trust Segmentation (Roles)
• DDOS detection/mitigation
• EC SD-WAN Fabric Orchestration
• Advanced Crypto
• EdgeHA
• ZTP / Templates.

Bandwidth License

Each site must be licensed for the appropriate bandwidth.

To calculate the throughput licenses required for a given gateway, determine the total WAN bandwidth the gateway will use. For example, for a 100 mbps Internet circuit and a 20 mbps MPLS circuit, the total is 120 mbps. For asymmetric circuits, such as a 50 mbps download and 5 mbps upload Internet circuit, use the largest number for the calculation. Since cellular back-up is used as path-of-last-resort only, it is not used for throughput license calculation.

Boost Licensing

Boost, though not currently used in this design, is sold in blocks of 100 mbps and allocated to the gateways in 1kbps increments. To determine the amount of boost licensing required, follow these steps:

• Determine the applications to accelerate.
• Determine the number of sites needed to accelerate the applications.
• Determine how much bandwidth the specific applications require to work optimally at each site.
• Purchase the total amount of boost to apply at the sites.

Dynamic Threat Defense

The advanced security license provides IDS capabilities in EdgeConnect. The example design does not include this feature. To determine the advanced security licensing required, use the guidance below.

Example Hub Design

The illustration below shows an example hub.

Key elements of the design include:

• Gateways are placed inline.
• WAN connections plug into the upstream WAN side switch and are then connected to gateways to allow for traditional high availability. This requires additional IP space on the WAN transports.
• Gateways connect via L3 to the LAN, into a WAN aggregation block and peer OSPF.
• BGP adjacency is maintained with the MPLS provider to facilitate migration.
• A hub summary route and default route are advertised with Subnet Sharing.
• All branches use a template with peer priority to select a hub when the same route is presented from multiple hub gateways.
• High OSPF can be set when redistributing from Subnet Sharing (WAN) to OSPF (LAN).
• The design ensures that traffic between the data centers uses the Data Center Interconnect (DCI). The OSPF can be adjusted as needed.
• When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign a higher value to one gateway to ensure flow symmetry.

The following components are selected to meet the hub requirements. Hubs are purchased in five-year terms.

Hardware

Licenses

If planning to replace MPLS circuits with higher-speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

Example Branch Design

Small Site Design

The illustration below shows an example hub for a small site.

Key elements include:

• The gateway is placed inline.
• The gateway is connected to the switch via a single L2 connection.
• The gateway acts as default gateway for any subnnet at the branch.

The following components were selected to meet small site requirements, purchased in five-year terms.

Hardware

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

Medium Site Design

The illustration below shows an example hub for a medium site.

Key elements include:

• The gateway is placed inline.
• EdgeHA is used for high availability.
• The gateway is connected to a collapsed core using an L3 link and peer OSPF.
• When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign one gateway a better metric to ensure flow symmetry.
• When redistributing from OSPF to Subnet Sharing, assign one gateway a better metric to ensure flow symmetry.

The following components are selected to meet medium site requirements, purchased in five-year terms.

Hardware

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

Large Site Design

The illustration below shows an example hub for a large site.

Key features include:

• The gateway is placed inline.
• EdgeHA is used for high availability.
• The gateway is connected to a collapsed core via L3 link and peer OSPF.
• When redistributing from Subnet Sharing (WAN) to OSPF (LAN), assign one gateway a better metric to ensure flow symmetry.
• When redistributing from OSPF to Subnet Sharing, assign one gateway a better metric to ensure flow symmetry.
• LTE connection, which requires a third-party device to terminate the LTE with an ethernet handoff, is used as a path-of-last resort, forwarding traffic only if both circuits are down.

The following components are selected to meet large site requirements, purchased in five-year terms. The large site has the highest bandwidth, serving a large amount of users, with HA implemented.

Hardware

Licenses

If planning to replace MPLS circuits with higher speed internet circuits in the future, consider buying licensing based on future needs or purchasing licenses with shorter terms.

Example Overlay Design

The illustration below shows an example overlay.

Features include:

• Cloud firewall integration is used to tunnel specific to-cloud filtering.
• EC-V is deployed in IaaS providers to facilitate better access to the services hosted there.
• Zone-Based Firewalling is configured on the gateways to provide basic filtering of Internet traffic when cloud firewalling is not used.

The table below illustrates the BIO design elements. All traffic matches start with the default overlay ACL and are modified as necessary.

Note: If the Foundation licenses are used, only three BIOs are possible: real-time, critical, and default.

---