Branch Mesh Topology in SD-Branch

Branch Mesh configuration is supported from SD-Branch version ArubaOS and later.

The Aruba SD-Branch branch mesh topology configuration allows Branch Gateways to establish secure overlay tunnels with Branch Gateways those are part of a same group or different group. When a branch mesh topology is configured between two or more Branch Gateways, a branch mesh link is established to securely transport traffic between the Branch Gateways. The branch mesh link is a point-to-point link that allows traffic to flow from one Branch Gateway to another based on the subnets Subnet is the logical division of an IP network. advertised by the destination Branch Gateway to the cloud orchestrator. Note that a destination Branch Gateway in a branch mesh topology never acts as a transit gateway. It is not necessary for Branch Gateways to be part of a same group to form a branch mesh tunnel. The Branch Gateways can be part of a same group or different group, and each Branch Gateway establishes a point-to-point secure tunnel with the other Branch Gateways which are part of the same branch mesh topology. The branch mesh links are displayed in the SD-WAN Software-Defined Wide Area Network. SD-WAN is an application for applying SDN technology to WAN connections that connect enterprise networks across disparate geographical locations. overlay map view of Overlay Tunnel Orchestrator. For more information, see Route and Tunnel pages. To form a branch mesh topology, following mechanisms are involved:

The STUN server's response to each message contains the post-NATed public IP information as seen by the STUN server. This IP could be different on all uplinks. The STUN protocol keeps the external-facing post-NAT port open and maintains the current mapping until the branch mesh tunnels using this port come up, ensuring that the port mapping does not expire on the NAT devices.

The following uplink data for the branch gateways is exchanged with OTO through the uplink AMON Advanced Monitoring. AMON is used in Aruba WLAN deployments for improved network management, monitoring and diagnostic capabilities. message so that OTO can bring up branch mesh tunnels:

  • Private Uplink IP
  • Source Port used by STUN for public IP discovery
  • Public IP
  • External facing post-NAT port discovered by STUN

When Branch-HA and branch mesh topologies intersect, the Branch Gateway is restricted from mistaking a branch mesh tunnel with a Branch-HA peer and does not set up IPsec tunnels between the Branch-HA peers.

The following figure illustrates a branch mesh topology between two Branch Groups:

Figure 5  Branch Mesh Topology

Configuration Recommendations

The Aruba SD-WAN Wide Area Network. WAN is a telecommunications network or computer network that extends over a large geographical distance. branch mesh topology requires to manage the Branch Gateways through Aruba Central.

Important Points to Note

  • Branch mesh supports branches with HA and uplink sharing (virtual uplinks).
  • To establish a branch mesh, a branch group does not require to be connected to a hub or data center VPNC.
  • You can configure up to 128 Branch Gateways in a branch mesh topology.
  • You can configure up to 256 branch mesh topologies.
  • You can include a Branch Gateway in multiple branch mesh topologies.

For more information, see the following sections: