Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

Link Path Selection and PSK usage for an SD-WAN Cloud Security Service (CSS) or Non SD-WAN Destination via Edge (78826)

Last Updated: 2/9/2024Categories: InformationalTotal Views: 6035Language:
English

1 like this article

Subscribe to get an email
newsletter with new updates

1 people found this helpful Please provide article feedback:

Details

When using the Cloud Security Service (CSS) or Non SD-WAN Destination (NSD) via Edge feature on a VMware SD-WAN Edge, tunnels are formed between the Edge's eligible links and the NSD.

This allows the Edge to have an Active/Active connection to the NSD using its available interfaces. The Edge is then able to provide flow-based load balancing.

Note: A Cloud Security Service is also understood as a type of Non SD-WAN Destination that connects out through the Edge. So when the article uses the generic NSD term, this is understood as either a CSS or an NSD via Edge.

Solution

The CSS and NSD via Edge WAN link path selection workflow:

The way the Edge determines if a link is eligible for a Non SD-WAN Destination (NSD) tunnel is as follows:

Skip link if this is NSD traffic and the NSD is down.

Skip this link if the interface is down.

Skip this link if it is Private.  Note: this is because CSS traffic is direct to the cloud traffic and thus cannot use private links.

Skip this link if it is unstable.

Skip this link if it is a hot standby.

Skip this link if the QoE is yellow or red. Note: This refers to the QoE link quality graph found on Monitor > Edge > QoE tab.

Skip this link if the Business Policy indicates a different Transport Group.  Note: for example, if a business policy specifies that CSS traffic only use the public wired link group and the WAN link being checked is a public wireless link, then that link would be skipped.

If the listed criteria are all satisfied and the WAN link is marked as eligible, the Edge will pick the WAN link with the most available downstream bandwidth and use it to form the tunnel and send data.

If no WAN link satisfies the listed criteria, the Edge would relax the QoE criteria in step 6 and select the link with best QoE available, even if that QoE is yellow or even red.

CSS and NSD via Edge pre-shared key (PSK) usage behavior when there are multiple eligible WAN links:

When the Edge has multiple eligible WAN links it will try to establish tunnels to an NSD on all WAN links.
The Edge will always create tunnels based on the number of configured PSK, using one PSK per tunnel. PSK will also be used on a per-segment basis.

If the amount of WAN links number is higher than the number of PSK configured, then the number of tunnels created will only be that of the configured PSK.

If the amount of WAN links and PSK configured is the same, each link will use one PSK to create a tunnel. There is no specific PSK to specific WAN link mapping.

If the amount of WAN links is less than the PSK configured, each link will use one PSK to create a tunnel and the remaining PSKs will remain in the device but will not be used.

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
English

Attachments

Additional Resources

KB
•
在升级到 vRealize Log Insight 8.x 之后，主机名将恢复为 "localhost" (78761)

KB
•
VMware AirWatch App Wrapping Engine 6.0 for iOS/Android リリースのお知らせ (78886)

KB
•
域用户无法筛选 vRealize Log Insight 8.x 中的警示查询 (78784)

KB
•
vRealize Log Insight 8.x にアップグレードした後にホスト名が「localhost」に戻る (78761)

Results 1-4 of 4

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

Related Versions:

VMware SD-WAN by VeloCloud

VMware SD-WAN

Take Our Survey

Support Assistant