TUTORIAL NO.
: 10
Name: Sarah Bhalla Roll No. : J204
1. Explain the integration of dynamic channels into SD-WAN?
SD-WAN further simplifies and builds upon what DMVPN did. With Overlay Management
Protocol (OMP), dynamic tunnel establishment can be integrated as part of OMP updates in a way
that allows for fast, more scalable tunnel establishment. Because of experience gained from a wide
range of DMVPN deployments over many years, Cisco engineers have learned a lot about the
network dynamics that can impact dynamic tunnel scalability, and many of these learnings have
driven the development of the new IPsec architecture found in Cisco SD-WAN. With OMP, the
control plane is now separated from the data plane, and routes can be advertised to all sites or just
a subset of sites. These OMP routes can be tagged with a number of different attributes. One of
these route attributes can be “Dynamic.” When you want to enable dynamic tunnels, you will use
the route policy workflow in vManage to tag the OMP Transport Location (TLOC) registered by
any site or subset of sites as Dynamic.
You can then filter the TLOCs such that vSmart will advertise only a hub TLOC and a selected
set of TLOCs marked as Dynamic. For TLOCs marked as Dynamic, the VPN tunnel will be
established on demand, rather than statically. You can control the topology and sites where
dynamic tunnels are allowed via vManage policies, minimizing the set of routes that must be
carried at each site.
2. Explain how IPsec secure tunnels are scaled and established in SD-WAN
architechture?
Another key factor when considering an SD-WAN architecture for your network is how IPsec
secure tunnels are established. The method used can have a big impact on your network scale and
may be noticed only at the most critical times – such as when a large companywide videocast is
starting or during an SD-WAN appliance failure at an aggregation site. Events of these types can
drive very high load on the CPU of SD-WAN data plane devices as they struggle to keep up with a
rush of tunnel-establishment requests from remote devices. Some devices may not be able to keep
up or may lose routing connectivity if the load on the control plane CPU becomes too high, starving
other processes. These types of problems come from the peer-to-peer nature of IPsec and Internet
Key Exchange (IKE) tunnel establishment and the fact that in most networks, the far endpoint of
the tunnel is a large-scale aggregation device. This aggregation device often has too many peers to
keep up with if they all want to establish tunnels at the same time. In addition, IKE protocol
negotiation takes time to establish a secure channel for key exchange, and it does this every time
key exchange is required.
In Cisco SD-WAN, this problem is eliminated by creating a highly secure, preestablished control
channel among all SD-WAN devices. The channel is authenticated by Public Key Infrastructure
(PKI) certificate exchange and encrypted with the latest AES265-GCM ciphers. It’s persistent and
thus available for securely exchanging all kinds of information, including IPsec keys for secure
tunnel establishment between SD-WAN peers.
This means that keys can be exchanged and prestaged at SD-WAN peer devices and are available
immediately when needed. This prestaging eliminates the scale issues with peer-to-peer IKE
negotiation described earlier.
Authentication:
It is important to understand how your VPN tunnels are authenticated. Some SD-WAN solutions
do not really automate VPN establishment in a fundamental way. They only automate the
distribution of Preshared Keys (PSKs) among the VPN peers. They still have the weakness of PSK-
based implementations, including management of the PSKs and appropriate selection and rotation
of these keys. PKI methods are a much more secure way of establishing authenticity.