Aruba SD-Branch Network Deployment Overview

This section provides details for the SD-Branch deployment used in subsequent sections.

It is best practice to standardize the branch design for all sites to reap the full benefits of Aruba Central configuration. OWL Corp., however, has a requirement for two branch designs.

A pair of VPNCs (VPN concentrators) is configured to facilitate connectivity between the campus network and branch sites using IPsec tunnels and route sharing. VPNCs summarize the campus subnets to a single route of 10.0.X.X/13 and prevent advertising point-to-point links to the branches.

Each remote site has redundant branch gateways, and each gateway is connected to a single WAN transport. Switches at branch provide L2 connectivity for the APs and other client devices. Each branch site is assigned a /21 subnet from the superset address space of 10.14.X.X/16. Within the 10.14.X.X/16 address space, the 10.14.254.X/24 is reserved for Microbranch system IPs.

Hub Site Configuration

• Gateways will be connected to the services aggregation block in the OWL campus network.
• Gateways will use OSPF to peer with the campus service aggregation.
• Gateways will have redundant connections to each aggregation block.
• Gateways will have redundant Internet and MPLS connections.
• Gateways will use eBGP for MPLS connectivity.
• The standby EdgeConnect appliance will have a lower metric than the primary to ensure route symmetry.
• EdgeConnect SD-WAN appliances will summarize campus routes before redistribution into the SD-WAN Fabric.
• Gateways will use the summary address 10.0.X.X/13 to advertise the Campus network to branch sites
• Gateways will summarize all branch sites to 10.14.X.X/16 to advertise to the Campus network.

Note: The equipment listed may not be the same equipment used in the guide; however, the configuration steps are alike.

Branch Site Requirements

• Wi-Fi should be the main connection used by employees. Ethernet connections should be available for use as needed. Ensure that switchport count is available for all users
• Access points should be mounted to the ceiling, not above the ceiling tile in plenum space or behind any barrier that may cause signal reflection or attenuation.
• Wireless coverage is required.
• Employees use Office 365 and Microsoft Teams for communications, along with other business productivity apps (Salesforce, SAP, etc.).
• Sites use IoT devices such as smart thermostats, smart access control, and meeting room kiosk.
• Sites must be able to upgrade with hitless failover.
• Sites have a single MPLS 10 Mbps download 5Mbps upload and Internet connection 100 Mbps download 25Mbps upload. Both are RJ-45 drops.
• Employee and guest SSIDs must be provided.

Low Traffic Site Requirements

OWL’s low traffic site have the logical topology shown below.

Low Traffic Site Characteristics

• 3750 square feet, closed office space
• Low-traffic sites to support up to 30 employees, each with a docking station and a laptop.
• 10 large workspace
• 12 small workspace
• 18 open workspaces
• 4 conference rooms
• 1 IDFs
• 1 MDF/Computer Room

Low Traffic Branch Site Configuration

• Gateway 1 will use GE0/0/0 Port for INET connectivity.
• Gateway 2 will use GE0/0/1 eBGP for MPLS connectivity.
• Gateway will use GE0/0/2 to trunk listed VLANs down to the access switches’ highest ethernet port.
• Gateway will be the default gateway for the site.
• Gateway will enable RADIUS snooping.
• Gateway should be version 10.4 or higher.
• Gateway will use DHCP relay for addressing devices.
• Access switches will use the standard feature template (MOTD, RADIUS, TACACS, User-Roles, STP, etc.).
• The first 12 Ports on access switching will be reserved for the access points.
• All IOT devices will be reserved for the next 24 ports.
• Workstations will be revered for the last 12 ports (special case ports).
• Access points should have two SSIDs for Guest and Corporate access

Required Equipment

Note: The equipment listed may not be the same equipment used in the guide; however, the configuration steps are alike.

Miami Branch Details

Huston Branch Details

High Traffic Site Requirements

OWL’s High traffic site have the logical topology shown below.

HIGH TRAFFIC BRANCH SITE CONFIGURATION

• All network infrastructure should use ZTP for provisioning.
• Gateway 1 will use WAN0 Port for INET connectivity.
• Gateway 2 will use WAN1 eBGP for MPLS connectivity.
• Gateways will be connected using LAN0 to enable WAN HA.
• Gateways will use LAN 1 to trunk listed VLANs down to the access switches’ highest ethernet port.
• Gateways will use VRRP and be the default gateway for the site.
• Gateways will enable RADIUS snooping.
• Gateways should be version 9.2 or higher.
• Gateways will use DHCP relay for addressing devices.
• Access switches will use the standard feature template (MOTD, RADIUS, TACACS, User-Roles, STP, etc.).
• The first 12 ports on access switching will be reserved for the access points.
• All IoT devices will be reserved for the next 24 ports.
• Workstations will be reserved for the last 12 ports (special case ports).
• Access points should have two SSIDs for Guest and Corporate access

Note: The equipment listed may not be the same equipment used in the guide; however, the configuration steps are alike.

San Diego Branch Details

San Francisco Branch Details

---