Cisco SD-WAN Service VPN

We have installed Cisco SD-WAN controllers, onboarded vEdge routers, and learned how to use templates.

It’s about time we send traffic between sites. That’s what we can do with a service VPN. We can configure service VPNs from the CLI or with templates. I’ll show you both options in this lesson.

Configuration

This is the topology we have:

I have two vEdge devices, each on its own site. Behind each vEdge router is a switch. I’ll use these switches to ping from one site to another.

system
 host-name               vEdge2
 system-ip               172.16.1.2
 site-id                 2
 organization-name       nwl-lab-sdwan
 vbond 10.1.0.2
!
vpn 0
 interface ge0/0
  ip address 10.65.91.2/24
  ipv6 dhcp-client
  tunnel-interface
   encapsulation ipsec
   color biz-internet
   allow-service all
  !
  no shutdown
 !
 interface ge0/1
  ip address 10.65.92.2/24
  tunnel-interface
   encapsulation ipsec
   color public-internet
   allow-service all
  !
  no shutdown
 !
 ip route 10.1.0.0/24 10.65.91.100

system
 host-name               vEdge3
 system-ip               172.16.1.3
 site-id                 3
 organization-name       nwl-lab-sdwan
 vbond 10.1.0.2
!
vpn 0
 interface ge0/0
  ip address 10.65.91.3/24
  ipv6 dhcp-client
  tunnel-interface
   encapsulation ipsec
   color biz-internet
   allow-service all
  !
  no shutdown
 !
 interface ge0/1
  ip address 10.65.92.3/24
  tunnel-interface
   encapsulation ipsec
   color public-internet
   allow-service all
  !
  no shutdown
 !
 ip route 10.1.0.0/24 10.65.91.100

hostname SW2
!         
no ip routing
!
interface GigabitEthernet0/0
 no switchport
 ip address 10.2.0.102 255.255.255.0
!
ip default-gateway 10.2.0.254

hostname SW3
!         
no ip routing
!
interface GigabitEthernet0/0
 no switchport
 ip address 10.3.0.103 255.255.255.0
!
ip default-gateway 10.3.0.254

CLI

We’ll start with the CLI option.

Create a new VPN, assign the ge0/3 interface to it and configure an IP address:

vEdge2(config)# vpn 10
vEdge2(config-vpn-10)# interface ge0/3
vEdge2(config-interface-ge0/3)# ip address 10.2.0.254/24
vEdge2(config-interface-ge0/3)# no shutdown
vEdge2(config-interface-ge0/3)# commit

vEdge3(config)# vpn 10
vEdge3(config-vpn-10)# interface ge0/3
vEdge3(config-interface-ge0/3)# ip address 10.3.0.254/24
vEdge3(config-interface-ge0/3)# no shutdown
vEdge3(config-interface-ge0/3)# commit

That’s all you have to configure. There aren’t any commands that you haven’t seen before. You can pick any VPN number except 0 or 512.

Templates

Now let’s see how we can configure a service VPN with templates.

Feature Templates

This takes some more work.  Go to Configuration > Templates > Feature and click on Add Template. 

VPN10

In the next screen, select the VPN feature template:

There are two items we need to change here. Under Basic Configuration, set the VPN to 10:

Then, underAdvertise OMP, enable Connected (IPv4):

Click Save to store the template.

Ge0/3 Interface

We need another feature template for the interface that connects to the switch. Click on Add Template and select VPN Interface Ethernet: