So recall this concept of services and service insertion. The idea here is I
might have something like a firewall or an IPS, something that I want to direct
my traffic through. And certainly I could do this from a layer 3 perspective and I
could force traffic into a firewall maybe by just putting it literally in
the path or maybe logically in the path physically or otherwise and then that
traffic gets directed towards whatever the destination is from there. So that's
one way of doing it. But in SD-WAN we can be a whole lot more sophisticated. So
recall this concept here. We can have an edge that has a firewall that's attached
to it and it can be directly attached but it needs to be at least layer 2
adjacent. So that means that it's on the same VLAN let's say as this interface
here on the edge. And now we might have another pair of edges here and these
edges have networks behind them and we have a pair of hosts. And we want these
hosts to be able to communicate to one another but we want them to go through
this firewall first. So how can we do this? With SD-WAN we can't insert this
directly into the path either physically or logically. But instead what we can do
is we can configure service insertion in order to make this happen. So all of
these edges have a connection into a transport network and what ends up
happening here is that when we send traffic again we're sending directly
here so if this is host 10 and this is host 20 I'm going to send my packet to
my upstream edge with a destination address of host 20. So in some fashion
we're going to match, that's a keyword there, we're going to match on that
traffic and we're going to set ourselves to use this service. In our case it's
going to be a firewall service. So what we'll do is we will forward this to not
this T-lock but this T-lock. So we get a new T-lock here as a next hop and so
that's an important part of how this all works. I send it to this T-lock and I
include inside of it a label. This label tells this edge what exactly is going on
because maybe I'm trying to send to a host that's off of another interface
down here with another network and other sort of hosts but that label is going to
tell it to send it to this firewall and when the traffic comes back it will know
to send it now to the appropriate T-lock or at least the T-lock that it was
originally should have been destined towards. So we're sort of overriding our
next hop behavior here at the T-lock level in order to get it to go through a
service before getting delivered to the edge that's at the destination site. Now
how all this works is we've got OMP at the center of it and so we have our SD
WAN controller, we have the edge with the service, and we have all of our other
edges. What's going to happen here is we're going to advertise this service
using an OMP type of route. I won't write OMP route because that could be
confusing. It's just a service route that's part of our OMP architecture. So
we have three different routes, this is that third route, route number, route type
number three we'll say, and I'm basically just saying hey I've got a service and
here's the IP address 10.10.whatever.whatever. Alright so that's my
service. It's also part of a specific VPN or VRF and it is important to
recognize that this cannot bridge a bunch of different VPNs or VRFs, at least
not natively, we'd have to jump through some hoops to do that. It's intended for
use within a specific service VPN. And so that makes sense because these hosts
over here and these hosts over here might be part of two different
organizations and they shouldn't be using the same firewall. They should each
have their own firewall if that's what's required. And so we advertise this
service route that includes this information and then what we do is we
modify next hops based on a policy. So those are going to be some key words
there as far as what we need to do to accomplish things because the policy
here is defined on the SD-WAN controller and at this point we've configured
several policies so we should be comfortable with the concept here. We're
going to want to create a centralized control policy that's going to do this
for us and then we need configuration on the edge. Well where does configuration
on edges come from? Well in our configuration we are going to use those
templates. So we've got the device templates that are pushed down. We're
gonna want to modify one of the feature templates in order to make that happen.
So our configuration will come in two steps. First of all we need to modify the
edge via the template and this is going to include the service itself. It's going
to include the type of service. We talked earlier about how there are different
types of service routes. So we're going to specify this is a firewall service
for example or an IPS service or some custom service. We're going to include
the IP address and it's going to be including in some way the VRF or VPN
and we'll see how we accomplish that using the template itself. Next, number
two, we're going to create on the controller or our vSmart. We're going to
create a control policy and remember how control policies are architected. These
have the match action statements. So we're going to match on particular
traffic. We can use site lists for this. We can use prefix lists. We can use all
kinds of different ways of matching traffic. From there we're going to create
our action statement and we're going to set our action first of all to accept
and then second of all we're going to modify it by saying set service. And so
we're going to set our service specifically to be the firewall service
that we specified up here which is the glue that connects them. So with our
understanding of how this all comes together as well as our two configuration
steps that's going to be important we're going to go ahead and jump into the CLI
and take a look at the graphical user interface as well to make sure we know
how to configure service insertion in SD-WAN.