The Network Times: Cisco SD-WAN - Part II: Manual vEdge Provision Process

Introduction

This chapter explains how we can provision vEdge devices manually. It starts by explaining how to build an initial system and tunnel interface configurations. Then it goes through the various certificate installation steps (CA root certificate, Certificate Signing Request (CSR), and granted certificate). After the initial configuration and certificate process section, this chapter shows how we can verify the Control Plane operation. Figure 2-1 illustrates our example topology. For simplicity, there are only two vEdge devices used in this chapter.

Figure 2-1: SD-WAN Topology.

vEdge Configuration

System Information

The only difference in vEdge initial system configuration compared to vManagem vBond, and vSmart is the device-specific host-name and system-ip values.

vedge# conf t

Entering configuration mode terminal

vedge(config)# system

vedge(config-system)# host-name vEdge-1

vedge(config-system)# site-id 10

vedge(config-system)# system-ip 10.100.100.101

vedge(config-system)# organization-name nwkt

vedge(config-system)# vbond 10.100.0.11

vedgeconfig-system)# ntp server 10.100.0.14

vedge(config-server-10.100.0.14)# vpn 0

vedge(config-server-10.100.0.14)# exit

vedge(config-ntp)# exit

vedge(config-system)# commit

Commit complete.

vEdge-1(config-system)#

Example 2-1: The Initial Configuration of vEdge-1-Step#1: System Configuration.

Underlay Network: VPN 0

VPN 0 is always used only for Underlay Network connections. The VPN 0 is like a Front-Door VRF in Cisco legacy Intelligent WAN (IWAN) SD-WAN solution. In our example, interfaces ge0/0 and ge0/1 on vEdges are attached to VPN 0 and IP addresses are bind to them statically. Both interfaces are working as IPSec tunnel-interface. The definition color identifies the transport connections. The color of the interface ge0/0 is public-internet while the color of interface g0/1 is mpls. The command color [color] restrict means that tunnels are only established between the TLOCs (Transport Locator) belonging to the same color. If the restrict option is left out, the vEdge tries to establish a tunnel with every remote TLOCs (MPLS-to-MPLS and MPLS-Public-Internet, Public-Internet-to-MPLS, and Public-Internet-to-Public-Internet) it learns via Overlay Management Protocol (OMP). These kinds of failed tunnels are shown in Dashboard > Main Dashboard windows in the Side Health field as Partial WAN Connectivity. The Main dashboard is shown in figure 2-4 (without any issues).

Note that there are 22 pre-defined colors which are divided into Public and Private colors based on their Network Address Translation (NAT) solution. If NAT is required (or might later be required) use public colors (3g, lte, biz-internet, public-internet, blue, green, red, bronze, silver, gold, custom1-3). If NAT is not needed, use private colors (metro-ethernet, mpls, private 1-6).

The command max-control-connection 0 under tunnel-interface assigned to the interface ge0/1 means that vEdge doesn’t try to establish control connections to vManage, vBond, or vSmart. Without the command, vEdge-1 and vEdge-3 will try to establish control connections over MPLS without success (no route). These kinds of failures are shown in Dashboard > Main Dashboard windows in the Control Status field as Partial.

I have also configured VPN 512 for Out of Band Management which is used for copying the root certificate file into vEdges by using WinSCP in the same way that was done with control plane devices vBond and vSmart.

vEdge-1(config-system)# vpn 0

vEdge-1(config-vpn-0)# interface ge0/0

vEdge-1(config-interface-ge0/0)# ip address 10.100.0.101/24

vEdge-1(config-interface-ge0/0)# tunnel-interface

vEdge-1(config-tunnel-interface)# color public-internet restrict

vEdge-1(config-tunnel-interface)# encapsulation ipsec

vEdge-1(config-tunnel-interface)# allow-service all

vEdge-1(config-tunnel-interface)# no shutdown

vEdge-1(config-tunnel-interface)# exit

vEdge-1(config-interface-ge0/0)# exit

vEdge-1(config-vpn-0)# interface ge0/1

vEdge-1(config-interface-ge0/1)# ip address 10.200.0.101/24

vEdge-1(config-interface-ge0/1)# tunnel-interface

vEdge-1(config-tunnel-interface)# color mpls restrict

vEdge-1(config-tunnel-interface)# max-control-connections 0

vEdge-1(config-tunnel-interface)# encapsulation ipsec

vEdge-1(config-tunnel-interface)# allow-service all

vEdge-1(config-tunnel-interface)# no shutdown

vEdge-1(config-tunnel-interface)# exit

vEdge-1(config-interface-ge0/1)# exit

vEdge-1(config-system)# vpn 512

vEdge-1(config-vpn-512)# interface eth0

vEdge-1(config-interface-eth0)# ip dhcp-client

vEdge-1(config-interface-eth0)# no shutdown

vEdge-1(config-interface-eth0)# !

vEdge-1(config-interface-eth0)# ip route 0.0.0.0/0 192.168.10.1

vEdge-1(config-vpn-512)# commit

Example 2-2: The Initial Configuration of vEdge-1-Step#2: VPN Specific Interface Settings.

Certification enrollment

The CA root certificate enrollment process follows the same principles as what was introduced in chapter 1 with vBond and vMange. I have already copied the PKI.pem file into the vEdge directory home/admin, where it can be installed.

vEdge-3# request root-cert-chain install home/admin/PKI.pem

Uploading root-ca-cert-chain via VPN 0

Copying ... /home/admin/PKI.pem via VPN 0

Updating the root certificate chain..

Successfully installed the root certificate chain

Example 2-3: Certificate Enrollment-Step#1: Installing the CA Root Certificate.

Next, we generate a Certificate Signing Request (CSR) with the name csr.txt into the home/admin directory.

vEdge-3# request csr upload home/admin/csr.txt

Uploading CSR via VPN 0

Enter organization-unit name : nwkt

Re-enter organization-unit name : nwkt

Generating private/public pair and CSR for this vedge device

Generating CSR for this vedge device ........[DONE]

Copying ... /home/admin/csr.txt via VPN 0

CSR upload successful

Example 2-4: Certificate Enrollment-Step#2: Generating CSR.

Then we go into the Linux shell and verify that the file is created. After that, we printed it out and copy it to the clipboard.

vEdge-3# vshell

vEdge-3:~$ ls

PKI.pem archive_id_rsa.pub csr.txt

vEdge-3:~$ more csr.txt

-----BEGIN CERTIFICATE REQUEST-----

MIIDQjCCAioCAQAwgcExCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh

MREwDwYDVQQHEwhTYW4gSm9zZTENMAsGA1UECxMEbndrdDEUMBIGA1UEChMLVmlw

dGVsYSBMTEMxQTA/BgNVBAMTOHZlZGdlLTg3NzAwZDE0LTBiNGItNGRjYi1hOTNk

LTQ3YzEyYTViYzMyMS0wLnZpcHRlbGEuY29tMSIwIAYJKoZIhvcNAQkBFhNzdXBw

b3J0QHZpcHRlbGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA

qrdJX6GajIK9kZY1Go358nYcyCxh6ie8w6uXvefUhXytsMc2cIVbiTimhYTrRB5+

0Ag2R6WjoohJrlpvDom/mJuNo6GuNjzJOXEhEOLVH2zDwvTnI3nhMmiCWLTNMkGe

NeQSKbHu7VwJ9/zbpPYJgmtsTVF4pzXVN3XVIRAq65VaZ9Tlg4kZUdFXnrKolx0p

hW8DB9QhIL9CO5fGmXuK+Ahc810gV6ObAy+fS4Gbt9fAZToXUK65ToeHWjTzgIsD

3OV4Wieae9PAJd2TZEGismiSONv8JeYVjxXIpzdk+j4NXBv9QgpZxOoEnRpTl/ds

nEfjNpAmHL4m6eaQh2XrJwIDAQABoDswOQYJKoZIhvcNAQkOMSwwKjAJBgNVHRME

AjAAMB0GA1UdDgQWBBSnmgfFMK/zFlb0zYjfdgMZojPhzDANBgkqhkiG9w0BAQsF

AAOCAQEAUsxQlaor8Clt4aDhK3S+t/jo+48i2f1WvKro7CLMC5mB9cKrmugM+fhl

F33mnQtR6/F08yAnMXzaPQuHIN7P6f4nZ0lYNGa8HWXAanlkjqKILoYBfB4LJ7G8

z9UZM03e/0myjCdik2oLhPO0tza/fZ0izf5UzBKcgGWJzn9fPhbgKD+g5ejaF4Vk

kyYYZGnWK7C5okdGqsEv6MMkWxmS5u7hAI3j82gmV7drFL/qK/z23NngBq9Rtz3B

8pCjQDOIUvpWrJQRgY2yAHDsp0kOgQ2UuJdRAvmuaUPr1krmrjdM2+EpItfl2SB4

+5SVRtKDDRiQQG/hLKBGsX+OSMS7zA==

-----END CERTIFICATE REQUEST-----

vEdge-3:~$

Example 2-5: Certificate Enrollment-Step#3: printing the CSR.

Use the command crypto pki server PKI request pkcs10 terminal in order to paste CSR into our IOS-XE CA-Server. When done, type quit and then press enter to get Granted Certificate. Copy the Granted Certificate into the clipboard.

CA-Server#crypto pki server PKI request pkcs10 terminal

PKCS10 request in base64 or pem

% Enter Base64 encoded or PEM formatted PKCS10 enrollment request.

% End with a blank line or "quit" on a line by itself.