Loading

×Sorry to interrupt
This page has an error. You might just need to refresh it.
[NoErrorObjectAvailable] Uncaught ReferenceError: addCTracking is not defined
Failing descriptor: {markup://c:KM_ArticleThemeLayout}

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Deployment Guide for Direct Branch-to-Azure Virtual WAN connections using VMware SD-WAN (79000)

Last Updated: 3/22/2021Categories: InformationalTotal Views: 8710Language:
English

6 like this article

Subscribe to get an email
newsletter with new updates

6 people found this helpful Please provide article feedback:

Details

Disclaimer

This feature is currently in the limited preview stage. The goal is to demonstrate how Branch- to-Azure Virtual WAN via direct IPsec can be simplified using VMware SD-WAN™ automation. VMware SD-WAN may further enhance the capabilities outlined below in our General Availability launch.

Introduction

During cloud migration, VMware SD-WAN has heard a common request: connecting remote locations to workloads in Azure in a simple, optimized, and secure way across a myriad of connectivity options. VMware SD-WAN simplifies the connectivity to Azure by providing a fully automated, simple, and intuitive GUI process for connecting remote locations to the Azure cloud.

To meet different deployment scenarios for those who deploy Azure Virtual WAN, VMware SD-WAN has been progressively adding more capabilities to the solution via automation. This guide provides step-by-step instructions for building direct IPsec connectivity from VMware SD-WAN branches to vWAN hubs. While this document focuses on option 1b, option 1a (which focuses on last mile optimization and link aggregation) is covered in Azure Virtual WAN automation via VMware SD-WAN hosted cloud Gateways.

Solution

Deployment Steps

The automation workflow will simplify the connectivity from VMware SD-WAN Branch Edges to Azure Virtual WAN. By using the VMware SD-WAN Orchestrator, a user can configure, manage, and troubleshoot SD-WAN branch connectivity to Virtual WAN.

Prerequisites

To enable the automation, a few steps are needed. This is a onetime configuration per Azure subscription:
1. Generate Application credentials in Azure for the target subscription and store them on the Orchestrator. For details, see: Prerequisite Azure Configuration
2. Make sure Azure virtual WAN resources are configured. For details, see: Configure Azure Virtual WAN for Branch-to-Azure VPN Connectivity.

Configuration Steps

1.   On the Orchestrator, create a construct “Non SD-WAN Destination via Edge” under Configure→Network Service.  This is configured once per Azure virtual hub.

2.        There are two ways to implement direct IPsec automation for the VMware SD-WAN Edge to an Azure Virtual WAN hub.

Profile level automation: This method is for when the user wants to mass configure many branch sites at once. In this method, the automation is triggered through the profile configuration. All branch Edges in the profile inherit the vWAN configuration from the profile and triggers the automation process to build direct IPsec tunnels to Azure vWAN hubs.

Example: 100 retail stores in a region are using VMware SD-WAN and are assigned to a single profile.  Each store’s VMware SD-WAN Edge appliance using this profile will inherit all Virtual WAN configuration and completely automate the connectivity to the virtual WAN hubs.

To configure Profile level automation, please go to step 3.

Edge level automation: In this method IPsec automation is configured per site and is useful for customers who have different WAN interface requirements on the VMware SD-WAN Edge appliance.

Example: At branch site A, the Edge has GE1 connected to a public WAN link, while at branch site B, the Edge has GE2 connected to a public WAN link.

To configure Edge level automation, please go to step 4.

3.   Configuring Profile level automation: On the Orchestrator, go to Configure→Profile→CloudVPN and enable “Branch to Non SD-WAN Destination via Edge” and select the vWAN hub site created in step 1.

Enable Checkbox: Check this option to have all the branch Edges in the profile create Azure Sites under Virtual WAN configuration in the Azure portal and build IPsec tunnels to vWAN hubs. Any new site added to the profile will automatically inherit the profile configuration and trigger the automation.

Allow All WAN Links: Check this box to have all the branch Edges build IPsec tunnels to vWAN on all available WAN links. Any new public WAN link added on a branch Edge will trigger the automation and build an IPsec tunnel to vWAN.

Note: If the user prefers to customize WAN link selection on a per site basis, "Allow All WAN Links" should remain unchecked.  Instead the user should navigate to Configure→Edge→Device for each site.  Under “Branch to Non SD-WAN Destination via Edge”, select WAN links per Edge.

4.  Configuring Edge level automation: On the Orchestrator, go to the Configure→Edge page, select the site created in Step 1 in service column and add the “Links” that need to be used for IPsec connection to Azure, when configuration is saved, automation will kick in to populate IPsec parameters and initiate IPsec connection.

These actions can be validated on the VMware SD-WAN Orchestrator:

•      The Events page on the Orchestrator will display the progress of automation.

•      Tunnel status is displayed under the Monitor→Edge page by hovering over the Cloud Services icon for a branch Edge.

•      The Azure portal will reflect the same information:

5.    Adding Static Routes: VNet routes are automatically populated on the VMware SD-WAN Edges as IPsec tunnels come up. VMware SD-WAN routes on the Azure sites must be added for bi-directional communications.

Azure Portal: Go to home>VirtualWAN>VPN Sites>Edit Site

6. Deleting a Tunnel: To delete a tunnel, on the Orchestrator go to Configure→Edge page, click “Delete” link and Save Changes. This action triggers the Orchestrator to tear down the tunnel and remove the configuration.

Conclusion

The functionality added with this feature streamlines the configuration process in managing hundreds and even thousands of remote locations. VMware SD-WAN automation removes the complexity and accelerates time to deployment for your enterprise network.

Note: BGP will be added for dynamic route updates in a future release.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
VMware AirWatch Zebra MX Service 4.8 for Android リリースのお知らせ (79001)

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

Results 1-2 of 2

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

VMware SD-WAN by VeloCloud

Take Our Survey

Support Assistant