sd-wan zones for mpls and isp links

[doncacciatoconsuting]

Let's say my environment consists of 1 spoke and two hubs. All sites have at least 1 ISP. There is an MPLS link between each spoke and the hub, no MPLS between spokes.

Spokes will route through the Hub via MPLS via OSPF to reach each other.
If an MPLS link fails at the spoke, I'd like to IPSec to the Hub and other spoke
If an ISP link fails at a spoke, I want to use the underlying routing protocol to route through the Hub for internet traffic.

In this scenario, should both the ISP and MPLS links be in the same SD-WAN zone like "underlay"? Or should they be separate zones like "mpls" and "isp" ?

Looking for any best practices on how to create zones based on topology and use case.

Don

[Faiza_Emam_Delhi · Accepted solution]

In the scenario you described, where you have a network with 1 spoke and two hubs, with each site having at least 1 ISP and MPLS link, it is a good practice to separate the MPLS and ISP links into different SD-WAN zones based on their respective use cases. This approach can help in better managing and controlling the traffic flows in your network.

Here is a recommended approach for creating zones based on your topology and use case:

1. *MPLS Zone*:
- Include the MPLS links between the spokes and hubs in a dedicated "MPLS" zone.
- Configure the appropriate routing protocols (e.g., OSPF) for routing between the spokes and hubs over the MPLS links.
- Set up failover mechanisms such as IPSec tunnels to the hubs in case of MPLS link failures at the spokes.

2. *ISP Zone*:
- Place the ISP links in a separate "ISP" zone.
- Configure the underlying routing protocol (e.g., BGP) to route internet traffic through the hubs in case of ISP link failures at the spokes.
- Ensure proper security measures are in place for internet-bound traffic.

3. *Underlay Zone* (Optional):
- You can create an "Underlay" zone that encompasses both the MPLS and ISP links if you want to manage them collectively at a higher level.
- This zone can be used for common policies or configurations that apply to both types of links.

By segregating the MPLS and ISP links into different zones, you can apply specific policies, QoS settings, security measures, and monitoring tools tailored to each type of connection. This segmentation can also help in troubleshooting and maintaining the network more efficiently.

Remember to consider factors such as security, performance, reliability, and scalability when designing your SD-WAN zones based on your network topology and use cases. It's also recommended to consult with your network infrastructure team or a network specialist to ensure that the design aligns with your organization's specific requirements and best practices.

[doncacciatoconsuting]

wonderful advice - makes sense, thanks very much.