Monday, 10 January 2022

SDWAN Technology insight

 

SDWAN technology is now instigated by more and more Corporates. More Specifically SDWAN solutions are called as WAN edge infrastructure. There were some buzz words revolving around SDWAN like full automation, Zero touch provisions, Dynamic path control , Applications awareness , application visibility, real time monitoring, Cloud Support, WAN optimization, etc. There are more than at least 15 players who are offering SDWAN technology. So as SDWAN technology is quite new and more and more OEM are offering the service, adopting the technology is a daunting task.

     From the management perspective, SDWAN can give better redundancy, optimal use of multiple link, cost reductions and ease of management, hence most of the management really wanted to adopt SDWAN technology. More and more OEMs are also already entering to provide SDWAN solutions. What is observed that most of the OEMs like those who were in the field of networking, Security gateway, WAN Optimization, Load balancer are providing SDWAN solutions. The networking OEMS are under pressure to provide SDWAN solutions as traditional WAN (routers) has been their bread and butter for so many years. The security gateway OEMs are also eager to provide SDWAN solutions as these also provide security over WAN and the internet. Of course the WAN optimization and LB vendors are also jumping in to SDWAN solutions as their business over WAN is getting affected. So currently there are provide many OEMs in the market who are providing SDWAN solutions. Due to all of this there is a real competition whether to choose security provided by network OEM's or network provided by Security OEMs over SDWAN. So it is really tough to choose the right SDWAN solutions.

   Therefore, it is better to choose a product which suits your own requirement. There are some facts that have to be taken into consideration. The current network devices like router, Firewall, Wan optimizer, LB have matured over time. The routing protocols like RIP, OSPF, EIGRP and BGP are known as IP and TCP protocols and these are mostly used for handling multiple links for engineering traffic like bandwidth optimization, Quality of service, Load balancing of traffic. All these protocols have been developed according to the industry standard IEEE. Most of the protocols evolve over the time and have been updated and now have  many versions with many features. For example QOS parameter is embedded in the IP packets throughout the network path. So QOS marking is maintained across the WAN and LAN path. The troubleshooting of these protocols is also pretty easy and can be configured or designed by networking engineers as per the requirement. SDWAN is taking control over these protocol even though TCP and IP protocols are still being used. There is also no standard like IEEE is followed by SDWAN OEMs. Its software takes full control over the hardware and intelligence to manage Links for jitter, latency and packet drop. QOS, Routing switching is also somewhat controlled by SDWAN. SDWAN mostly creates IPSEC tunnel over MPLS, internet and broadband links and manages them with software. Hence using routing protocol over SDWAN is not ideal but may be used if any specific requirement is there. The internet mostly uses BGP protocol which means that when SDWAN works over the internet it cannot take control over the link which is controlled by BGP protocol. In addition, dual link active passive or active active configure with routing protocol like OSPF or BGP cannot be controlled by SDWAN Overlay. Also please note that there are certain SDWAN solutions where the edge devices are managed centrally from the cloud and have been a drawback, e.g. fundamentally cloud should be measured from internet IPsec VPN gateway but for internet link SDWAN measures latency from the cloud . For some SDWAN solution IPSEC VPN parameter is not configurable. So if an organization has a certain security standard policy for IPsec they would have to recheck this function. If you want to get rid of MPLS link then the fact is that SDWAN is not going to help improve latency. In other words, over internet Latency is not guaranteed. Moreover, if you are going to use SDWAN over high latency link then please consider WAN optimization features are available. For some SDWAN solutions, QOS parameters are pre-configured where nothing can be customized much like packet marking in IP packets. Not to mention, underlay and overlay (IPsec tunnel) parameters must considered at the time of SDWAN design. It is recommended to use in house devices for large enterprises for control plane. On the account while designing it must be kept in mind to build a parallel architecture with underlay networking ready in place. If something goes wrong on the overlay network then the traffic must be rerouted to underlay network without any delay. It will reduce the production downtime. Furthermore, if it is required to extend VXLAN over WAN, it should be checked if the particular OEM supports VXLAN. The monitoring is also an important parameter to be considered, as external monitoring tool uses various network paths for monitoring the WAN and internet Link. So a path must be chosen(over SDWAN or over MPLS/Internet) for monitoring specific internet link or WAN link with a network monitoring tool. It is better to choose underlay network path than overlay for monitoring MPLS/Internet Link.

  For adopting SDWAN, it is important that the above points are examined carefully. Design is the key for implementing SDWAN solutions and thus, it must be reviewed during implementation, so the production is not hampered.

Thursday, 26 January 2017

How to stop Policy Route which rules the router



We all know policy route rules the router. It has even greater priority than  connected route. How to make other routes on the routing tables which can have greater priority than policy route. How to do it?

Following the scenario to do the above difficult but possible stuff.


The above diagram shows there are two path to reach from router R1 loopback address i.e. 30.30.30.1 to router R3 loopback address 40.40.40.1. One is via R1----R2------R3 & the other is via R1----R2-----R4----R3. We have policy map enforce (next hop for 40.40.40.1 towards R4) on router R2 i.e. on F0/0 interface. Still packet moving towards R3 via f0/1 interface of router R2. Check(Scenario 1) the trace route which is now moving via router R2----R3 even the policy route map enforce on the router R2 interface F0/0.
     Now I will shut down f0/1 interface of router R3 which will stop direct connectivity between Router R2 and R3. Now check Scenario 2. Now the traffic moving via R1-R2-R4-R3. How it is possible. The command “set ip default next-hop” is the do the job for us. If you use the syntax default then Policy route will active in case of there is no route in the routing table for the next hop network. Kindly find the  configuration of all the routers below & try it by yourself.

Scenario 1
interface FastEthernet0/0
 ip address 10.10.10.2 255.255.255.0
 ip policy route-map san
 duplex auto
 speed auto

-------
route-map san permit 10
 match ip address ss
 set ip default next-hop 10.10.30.2

R1#traceroute
Protocol [ip]:
Target IP address: 40.40.40.1
Source address: 30.30.30.1
Numeric display [n]:
Timeout in seconds [3]:
Probe count [3]:
Minimum Time to Live [1]:
Maximum Time to Live [30]:
Port Number [33434]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Type escape sequence to abort.
Tracing the route to 40.40.40.1

  1 10.10.10.2 32 msec 12 msec 12 msec
  2 10.10.20.2 28 msec 24 msec 20 msec

Scenario 2
R3#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R3(config)#int f0/1
R3(config-if)#shut
R3(config-if)#
*Mar  1 01:40:02.099: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 10.10.20.1 (FastEthernet0/1) is down: interface down
R3(config-if)#
*Mar  1 01:40:04.007: %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down
*Mar  1 01:40:05.007: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down
R1#traceroute
Protocol [ip]:
Target IP address: 40.40.40.1
Source address: 30.30.30.1
Numeric display [n]:
Timeout in seconds [3]:
Probe count [3]:
Minimum Time to Live [1]:
Maximum Time to Live [30]:
Port Number [33434]:
Loose, Strict, Record, Timestamp, Verbose[none]:
Type escape sequence to abort.
Tracing the route to 40.40.40.1

  1 10.10.10.2 20 msec 12 msec 12 msec
  2 10.10.30.2 32 msec 20 msec 44 msec
  3 11.11.11.2 44 msec 48 msec 24 msec


R1
R1#sh run
Building configuration...

Current configuration : 1104 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!
!
!
archive
 log config
  hidekeys
!
!
ip tcp synwait-time 5
ip ssh version 1
!
!
interface Loopback0
 ip address 30.30.30.1 255.255.255.0
!
interface FastEthernet0/0
 ip address 10.10.10.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.10.10.2
!
!
no ip http server
no ip http secure-server
!
no cdp log mismatch duplex
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
!
!
end

R2
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
no ip domain lookup
!
multilink bundle-name authenticated
archive
 log config
  hidekeys
!
ip tcp synwait-time 5
ip ssh version 1
!
interface FastEthernet0/0
 ip address 10.10.10.2 255.255.255.0
 ip policy route-map san
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 10.10.20.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet1/0
 ip address 10.10.30.1 255.255.255.0
 duplex auto
 speed auto
!
router eigrp 100
 redistribute static
 network 10.0.0.0
 auto-summary
!
ip forward-protocol nd
ip route 30.30.30.0 255.255.255.0 10.10.10.1
!
!
no ip http server
no ip http secure-server
!
ip access-list extended ss
 permit ip 30.30.30.0 0.0.0.255 40.40.40.0 0.0.0.255
!
no cdp log mismatch duplex
!
route-map san permit 10
 match ip address ss
 set ip default next-hop 10.10.30.2
!
control-plane

!

line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
!
!
end

R3
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R3
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
!
!
!
no ip domain lookup
!
multilink bundle-name authenticated
!

archive
 log config
  hidekeys
!

ip tcp synwait-time 5
ip ssh version 1
!

interface Loopback0
 ip address 40.40.40.1 255.255.255.0
!
interface FastEthernet0/0
 ip address 11.11.11.2 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 10.10.20.2 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet1/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
router eigrp 100
 network 10.0.0.0
 network 40.0.0.0
 auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 11.11.11.1
!
!
no ip http server
no ip http secure-server
!
no cdp log mismatch duplex
control-plane
!
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
!
!
end
R4
R4#sh run
Building configuration...

Current configuration : 1111 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R4
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
!
no ip domain lookup
!
multilink bundle-name authenticated

!
!
archive
 log config
  hidekeys
!

!
ip tcp synwait-time 5
ip ssh version 1
!
interface FastEthernet0/0
 ip address 11.11.11.1 255.255.255.0
 duplex auto
 speed auto
!
interface FastEthernet0/1
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface FastEthernet1/0
 ip address 10.10.30.2 255.255.255.0
 duplex auto
 speed auto
!
ip forward-protocol nd
ip route 30.30.30.0 255.255.255.0 10.10.30.1
ip route 40.40.40.0 255.255.255.0 11.11.11.2
!
!
no ip http server
no ip http secure-server
!
no cdp log mismatch duplex
!
control-plane
!
line con 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 login
!
!
end