SDWAN - Region1 Hub to Region2 Hub configs

[rajamanickam]

Hi,

  When we have different region HUB topology in the network. Each Hub will have iBGP peer with its spoke and eBGP peer with the other region Hub. 

So , when we build IPSEC tunnels between the Hubs whether this should be a full mesh tunnel or a dialup tunnel?.  Should we need to add these ipsec tunnel interfaces (Between Hub to Hub) as part of SDWAN interfaces and to write SDWAN rules at hub for a spoke in one region to speak with other spoke??.. Or the other option is , without bringing HUB to HUB ipsec interfaces in SDWAN interface and just play with BGP routing ??. What is the best way to deploy and any documentation available for this. When we add it in SDWAN interface, we get benefit of running performance sla on top of it and to pick the interfaces..

Regards

Raja

[akristof]

Hello,

Thank you for your question. This is pure design question based on what are your requirements.

Usually, tunnels between HUBs of different regions are static. If it is full mesh or only partial mesh, again, it depends on requirements and what kind of network connection you have. My personal experience would be if you have 2 connections between HUBs, 2 tunnels are enough. For your SDWAN question, usually, connection between HUBs of other regions is different from normal ISP link than the spokes are connecting and usually is more reliable. In that case SDWAN and performance SLA does not have much impact as it would negligible difference between link1 and link2. But if you would use normal ISP link, in that case I guess you could utilize performance SLA. But from eBGP perspective, you would need to make sure that you will have ebgp-multipath enabled and you have path to other region via all tunnels always. 

[rajamanickam]

Thanks for your reply.. I am thinking to enable HUB to HUB interfaces as SDWAN interface and add a default route pointing to SDWAN interfaces.. Write SDWAN rules with  source/destinations  which need to be sent over this tunnel interfaces between Hubs.. This avoids eBGP requirement between HUB.. Do we seen any cons with this scenario?? or eBGP is a best approach to follow?

[akristof · Accepted solution]

Hi.

Well, if you want to completely remove eBGP between HUBs, it depends if your spokes are receiving only default-route via iBGP or specific subnets. If spokes are receiving specific subnets in that case you will need to have eBGP between HUBs to redistribute other regions subnets into local region. Or you would need to manually distribute them from the HUB.

On the HUB, you can always use SDWAN and rules to route traffic based on SLA or any other preference.

[rajamanickam]

Thank you Adrian, I will explore further..