Jason Gooley, CCIE No. 38759 (RS and SP), is a very enthusiastic and spontaneous person who has more than 25 years of experience in the industry. Currently, Jason works as a Technical Evangelist for the Worldwide Enterprise Networking Sales team at Cisco Systems. Jason is very passionate about helping others in the industry succeed. In addition to being a Cisco Press author, Jason is a distinguished speaker at Cisco Live, contributes to the development of the Cisco CCIE and DevNet exams, provides training for Learning@Cisco, is an active CCIE mentor, is a committee member for the Cisco Continuing Education Program (CE), and is a program committee member of the Chicago Network Operators Group (CHI-NOG), www.chinog.org. Jason also hosts a show called MetalDevOps.Dana Yanch, CCIE No. 25567 (RS,DC) CCDE No. 20130071, at the time of writing content for this book was a Global Technical Solutions Architect at Cisco focused on designing and deploying SD-WAN solutions for large enterprises around the world. Prior to spending the last six years working with Viptela and other SD-WAN technologies, Dana had a focus on fabric-based data center technologies. Dana has presented at several Cisco Live Events worldwide and has a passion for public speaking and mentorship. Dana can now be found at Aviatrix, the multi-cloud networking platform, designing cloud connectivity architectures every single day.Dustin Schuemann, CCIE No. 59235 (R&S), is a Technical Solutions Architect at Cisco Systems. Within the Demo CoE organization, Dustin is a subject matter expert on all things SD-WAN, including development of SD-WAN demo offerings and CPOC labs for some of Cisco’s largest customers. He has been a distinguished speaker at Cisco Live multiple times, where he has presented on multiple topics around Cisco SD-WAN. Dustin has more than 17 years of experience in the network engineering field, and before Cisco he was a network architect for multiple firms within the manufacturing and financial industries. He is very passionate about giving back to the IT community and helping to mentor other network engineers. Dustin currently resides in Raleigh, North Carolina.John Curran is a Technical Solutions Architect with Cisco’s Global Virtual Engineering team, where he assists customers and partners with the design of their next-generation networks. John is a subject matter expert in routing and SD-WAN and is excited to spend time teaching and training on these topics. John presents regularly at Cisco Live events around the world and has been repeatedly recognized as a Distinguished Speaker. In his prior role at Cisco, John worked as a Network Consulting Engineer for Cisco’s Advanced Services team, supporting government and education customers. John holds a Bachelor of Science degree in Computer Engineering Technology from the University of Cincinnati.

• Introduction xixChapter 1 Introduction to Cisco Software-Defined Wide Area Networking (SD-WAN) 1Networks of Today 1Common Business and IT Trends 4Common Desired Benefits 5High-Level Design Considerations 7Introduction to Cisco Software-Defined WAN (SD-WAN) 9Transport Independence 10Rethinking the WAN 12Use Cases Demanding Changes in the WAN 13Bandwidth Aggregation and Application Load-Balancing 13Protecting Critical Applications with SLAs 14End-to-End Segmentation 15Direct Internet Access 15Fully Managed Network Solution 16Building an ROI to Identify Cost Savings 17Introduction to Multidomain 18Cloud Trends and Adoption 19Summary 21Review All Key Topics 22Key Terms 22Chapter Review Questions 22Chapter 2 Cisco SD-WAN Components 25Data Plane 27Management Plane 32Control Plane 34Orchestration Plane 36Multi-Tenancy Options 38Deployment Options 38Summary 39Review All Key Topics 39Key Terms 40Chapter Review Questions 40References 42Chapter 3 Control Plane and Data Plane Operations 43Control Plane Operations 44Overlay Management Protocol 47OMP Routes 48TLOC Routes 52Service Routes 54Path Selection 56OMP Route Redistribution and Loop Prevention 58Data Plane Operations 65TLOC Colors 66Tunnel Groups 70Network Address Translation 73Full Cone NAT 74Symmetric NAT 75Address Restricted Cone NAT 76Port Restricted Cone NAT 77Network Segmentation 81Data Plane Encryption 83Data Plane Encryption with Pairwise 86Summary 88Review All Key Topics 88Key Terms 89Chapter Review Questions 89References 90Chapter 4 Onboarding and Provisioning 91Configuration Templates 93Developing and Deploying Templates 97Onboarding Devices 101Manual Bootstrapping of a WAN Edge 102Automatic Provisioning with PNP or ZTP 103Summary 105Review All Key Topics 106Chapter Review Questions 106References 107Chapter 5 Introduction to Cisco SD-WAN Policies 109Purpose of Cisco SD-WAN Policies 109Types of Cisco SD-WAN Policies 110Centralized Policy 110Centralized Policies That Affect the Control Plane 111Centralized Policies That Affect the Data Plane 112Localized Policy 112Policy Domains 113Cisco SD-WAN Policy Construction 115Types of Lists 118Policy Definition 119Cisco SD-WAN Policy Administration, Activation, and Enforcement 122Building a Centralized Policy 122Activating a Centralized Policy 125Packet Forwarding Order of Operations 127Summary 128Review All Key Topics 129Define Key Terms 129Chapter Review Questions 129Chapter 6 Centralized Control Policies 133Centralized Control Policy Overview 134Use Case 1: Isolating Remote Branches from Each Other 136Use Case 1 Review 149Use Case 2: Enabling Branch-to-Branch Communication Through Data Centers 149Enabling Branch-to-Branch Communication with Summarization 150Enabling Branch-to-Branch Communication with TLOC Lists 152Use Case 2 Review 168Use Case 3: Traffic Engineering at Sites with Multiple Routers 169Setting TLOC Preference with Centralized Policy 171Setting TLOC Preference with Device Templates 177Use Case 3 Review 179Use Case 4: Preferring Regional Data Centers for Internet Access 180Use Case 4 Review 188Use Case 5: Regional Mesh Networks 188Use Case 5 Review 195Use Case 6: Enforcing Security Perimeters with Service Insertion 195Use Case 6 Review 202Use Case 7: Isolating Guest Users from the Corporate WAN 202Use Case 7 Review 206Use Case 8: Creating Different Network Topologies per Segment 206Use Case 8 Review 210Use Case 9: Creating Extranets and Access to Shared Services 211Use Case 9 Review 222Summary 223Review All Key Topics 223Define Key Terms 224Chapter Review Questions 224Reference 226Chapter 7 Centralized Data Policies 227Centralized Data Policy Overview 228Centralized Data Policy Use Cases 228Use Case 10: Direct Internet Access for Guest Users 230Use Case 10 Review 242Use Case 11: Direct Cloud Access for Trusted Applications 243Use Case 11 Review 253Use Case 12: Application-Based Traffic Engineering 253Use Case 12 Review 260Use Case 13: Protecting Corporate Users with a Cloud-Delivered Firewall 261Use Case 13 Review 269Use Case 14: Protecting Applications from Packet Loss 269Forward Error Correction for Audio and Video 270Packet Duplication for Credit Card Transactions 274Use Case 14 Review 280Summary 280Review All Key Topics 281Define Key Terms 282Chapter Review Questions 282References 284Chapter 8 Application-Aware Routing Policies 285The Business Imperative for Application-Aware Routing 286The Mechanics of an App-Route Policy 286Constructing an App-Route Policy 287Monitoring Tunnel Performance 294Liveliness Detection 295Hello Interval 295Multiplier 297Path Quality Monitoring 298App-Route Poll Interval 298App-Route Multiplier 300Mapping Traffic Flows to a Transport Tunnel 304Packet Forwarding with Application-Aware Routing Policies 304Traditional Lookup in the Routing Table 305SLA Class Action 306Summary 315Review All Key Topics 316Define Key Terms 316Chapter Review Questions 316Chapter 9 Localized Policies 319Introduction to Localized Policies 319Localized Control Policies 320Localized Data Policies 334Quality of Service Policies 338Step 1: Assign Traffic to Forwarding Classes 339Step 2: Map Forwarding Classes to Hardware Queues 341Step 3: Configure the Scheduling Parameters for Each Queue 341Step 4: Map All of the Schedulers Together into a Single QoS Map 342Step 5: Configure the Interface with the QoS Map 343Summary 346Review All Key Topics 347Chapter Review Questions 347Chapter 10 Cisco SD-WAN Security 349Cisco SD-WAN Security: Why and What 349Application-Aware Enterprise Firewall 352Intrusion Detection and Prevention 360URL Filtering 367Advanced Malware Protection and Threat Grid 372DNS Web Layer Security 377Cloud Security 381vManage Authentication and Authorization 384Local Authentication with Role-Based Access Control (RBAC) 384Remote Authentication with Role-Based Access Control (RBAC) 387Summary 389Review All Key Topics 389Define Key Terms 389Chapter Review Questions 389Chapter 11 Cisco SD-WAN Cloud onRamp 393Cisco SD-WAN Cloud onRamp 393Cloud onRamp for SaaS 394Cloud onRamp for IaaS 412Cloud onRamp for Colocation 429Why Colocation? 432How It Works 432Service Chaining for a Single Service Node 434Service Chaining for Multiple Service Nodes 436Service Chaining and the Public Cloud 436Infrastructure as a Service 438Software as a Service 438Redundancy and High Availability 440Service Chain Design Best Practices 440Configuration and Management 442Cluster Creation 442Image Repository 449Service Chain Creation 449Monitoring 454Summary 455Review All Key Topics 456Define Key Terms 456Chapter Review Questions 456Chapter 12 Cisco SD-WAN Design and Migration 459Cisco SD-WAN Design Methodology 459Cisco SD-WAN Migration Preparation 460Cisco SD-WAN Data Center Design 462Transport-Side Connectivity 463Loopback TLOC Design 465Service-Side Connectivity 466Cisco SD-WAN Branch Design 469Complete CE Replacement—Single Cisco SD-WAN Edge 470Complete CE Replacement—Dual Cisco SD-WAN Edge 471Integration with Existing CE Router 475Integration with a Branch Firewall 476Integration with Voice Services 478Cisco SD-WAN Overlay and Underlay Integration 480Overlay Only 480Overlay with Underlay Backup 481Full Overlay and Underlay Integration 485Summary 490Review All Key Topics 490Chapter Review Questions 490Chapter 13 Provisioning Cisco SD-WAN Controllers in a Private Cloud 493SD-WAN Controller Functionality Recap 493Certificates 496vManage Controller Deployment 501Step 1: Deploy vManage Virtual Appliance on VMware ESXi or KVM 503Step 2: Bootstrap and Configure vManage Controller 506Step 3/4: Set Organization Name and vBond Address in vManage; Install Root CA Certificate 506Step 5: Generate, Sign, and Install Certificate onto vManage Controller 511vBond Controller Deployment 513Step 1/2/3: Deploy vBond Virtual Machine on VMware ESXi; Bootstrap and Configure vBond Controller; Manually Install Root CA Certificate on vBond 514Step 4/5: Add vBond Controller to vManage; Generate, Sign, and InstallCertificate onto vBond Controller 516vSmart Controller Deployment 518Step 1/2/3: Deploy vSmart Virtual Machine from Downloaded OVA; Bootstrap and Configure vSmart Controller; Manually Install Root CA Certificate on vSmart 519Step 4/5: Add vSmart Controller to vManage; Generate, Sign, and Install Certificate onto vSmart Controller 520Summary 523Review All Key Topics 524Define Key Terms 524Chapter Review Questions 524References 526Appendix A: Answers to Chapter Review Questions 527Appendix B: Example 7-17 539Glossary of Key Terms 553Index 557