Cvd Iwandesignguide Jan15

  • View
    215

  • Download
    0

Embed Size (px)

Transcript

  • 7/21/2019 Cvd Iwandesignguide Jan15

    1/224

    Intelligent WANTechnology Design Guide

    January 2015

  • 7/21/2019 Cvd Iwandesignguide Jan15

    2/224

  • 7/21/2019 Cvd Iwandesignguide Jan15

    3/224

    Table of Contents

    Deploying the Transport Independent Design .............................................................................20

    Design Overview ....................................................................................................................... 20

    DMVPN Hub Routers ............................................................................................................ 20

    Remote SitesDMVPN Spoke Router Selection .................................................................... 20

    VRFs and Front Door VRF ..................................................................................................... 21

    Design Details....................................................................................................................... 23

    EIGRP ................................................................................................................................... 24

    Encryption ............................................................................................................................ 25

    DMVPN ................................................................................................................................ 26

    Deployment Details ................................................................................................................... 27

    Configuring an IOS Certificate Authority ............................................................................... 27

    Configuring DMVPN Hub Router ........................................................................................... 34

    Configuring the Firewall and DMZ Switch ............................................................................. 56

    Configuring Remote-Site DMVPN Router ............................................................................. 65

    Adding Second DMVPN for a Single-Router Remote Site .................................................... 88Adding LTE fallback DMVPN for a single-router remote site ............................................... 100

    Modifying the First Router for Dual Router Design ...............................................................114

    Configuring Remote-Site DMVPN Router (Router 2) ............................................................119

    Deploying an IWAN Remote-Site Distribution Layer .................................................................. 146

    Connecting Remote-site Router to Distribution Layer ..........................................................146

    Connecting Remote-Site Router to Distribution Layer (Router 2) ........................................ 153

    Deploying IWAN Quality of Service ..........................................................................................159

    Configuring QoS for DMVPN Routers ................................................................................. 159Applying DMVPN QoS Policy to DMVPN Hub Routers ........................................................ 164

    Applying QoS Configurations to Remote Site Routers ........................................................ 169

    Deploying IWAN Performance Routing ..................................................................................... 174

    Configuring PfR Hub Master Controller ................................................................................176

    Configuring Performance Routing for Hub Location ............................................................ 182

    Configuring PfR for Remote Site Locations ......................................................................... 190

    Deploying IWAN Monitoring .....................................................................................................203

    Configuring Flexible NetFlow for IWAN Monitoring ............................................................. 203

    Appendix A: Product List .........................................................................................................211

    Appendix B: Technical Feature Supplement ............................................................................. 216

    Front Door VRF for DMVPN ......................................................................................................216

    Appendix C: Device Configuration Files ...................................................................................220

  • 7/21/2019 Cvd Iwandesignguide Jan15

    4/224

    Preface January 2015

    1

    PrefaceCisco Validated Designs (CVDs) present systems that are based on common use cases or engineering priorities.

    CVDs incorporate a broad set of technologies, features, and applications that address customer needs. Cisco

    engineers have comprehensively tested and documented each design in order to ensure faster, more reliable,

    and fully predictable deployment.

    CVDs include two guide types that provide tested design details:

    Technology design guidesprovide deployment details, information about validated products and

    software, and best practices for specific types of technology.

    Solution design guidesintegrate existing CVDs but also include product features and functionality

    across Cisco products and sometimes include information about third-party integration.

    Both CVD types provide a tested starting point for Cisco partners or customers to begin designing and deploying

    systems.

    CVD Foundation SeriesThis CVD Foundation guide is a part of the January 2015 Series. As Cisco develops a CVD Foundation series,

    the guides themselves are tested together, in the same network lab. This approach assures that the guides in a

    series are fully compatible with one another. Each series describes a lab-validated, complete system.

    The CVD Foundation series incorporates wired and wireless LAN, WAN, data center, security, and network

    management technologies. Using the CVD Foundation simplifies system integration, allowing you to select

    solutions that solve an organizations problemswithout worrying about the technical complexity.

    To ensure the compatibility of designs in the CVD Foundation, you should use guides that belong to the same

    release. For the most recent CVD Foundation guides, please visit the CVD Foundation web site.

    Comments and QuestionsIf you would like to comment on a guide or ask questions, please use the feedback form.

    http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-branch-wan/index.htmlhttp://cvddocs.com/feedback/?id=200i-15bhttp://cvddocs.com/feedback/?id=200i-15bhttp://www.cisco.com/c/en/us/solutions/enterprise/design-zone-branch-wan/index.html
  • 7/21/2019 Cvd Iwandesignguide Jan15

    5/224

    CVD Navigator January 2015

    2

    CVD NavigatorThe CVD Navigator helps you determine the applicability of this guide by summarizing its key elements: the use cases, the

    scope or breadth of the technology covered, the proficiency or experience recommended, and CVDs related to this guide.

    This section is a quick reference only. For more details, see the Introduction.

    Use CasesThis guide addresses the following technology use cases:

    Use Case: Secure Site-to-Site WAN Communications This

    guide helps organizations connect remote sites over private

    (MPLS VPN) and public (Internet) IP networks, efficiently and

    securely.

    For more information, see the Use Cases section in this guide.

    ScopeThis guide covers the following areas of technology and products:

    Dynamic Multipoint Virtual Private Network (DMVPN) design

    and deployment over public and private WAN transport

    Transport Independent Design (TID) provides capabilities for

    easy multi-homing over any carrier service offering, including

    MPLS, broadband, and cellular 3G/4G/LTE

    Intelligent Path Control with Cisco Performance Routing (PfR)

    improves application delivery and WAN efficiency

    Secure connectivity protects the corporate communicationsand offloads user traffic directly to the Internet

    WAN quality of server (QoS) design and configuration

    For more information, see the Design Overview section in this

    guide.

    ProficiencyThis guide is for people with the following technical proficiencies or

    equivalent experience:

    CCNP Routing and Switching CCNP Security

    To view the related CVD guides, click the titles

    or visit the CVD Foundation web site.

    Related CVD Guides

    VALIDATED

    DESIGN

    Firewall and IPS TechnologyDesign Guide

    VALIDATED

    DESIGN

    MPLS WAN TechnologyDesign Guide

    VALIDATED

    DESIGN

    VPN WAN TechnologyDesign Guide

    http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-branch-wan/index.htmlhttp://www.cvddocs.com/fw/180-14bhttp://www.cvddocs.com/fw/180-14bhttp://www.cvddocs.com/fw/180-14bhttp://www.cvddocs.com/fw/180-14bhttp://www.cvddocs.com/fw/245-14bhttp://www.cvddocs.com/fw/245-14bhttp://www.cvddocs.com/fw/245-14bhttp://www.cvddocs.com/fw/245-14bhttp://www.cvddocs.com/fw/335-14bhttp://www.cvddocs.com/fw/335-14bhttp://www.cvddocs.com/fw/335-14bhttp://www.cvddocs.com/fw/335-14bhttp://www.cvddocs.com/fw/335-14bhttp://www.cvddocs.com/fw/245-14bhttp://www.cvddocs.com/fw/180-14bhttp://www.cisco.com/c/en/us/solutions/enterprise/design-zone-branch-wan/index.html
  • 7/21/2019 Cvd Iwandesignguide Jan15

    6/224

    Introduction January 2015

    3

    IntroductionThe Cisco Intelligent WAN (IWAN) solution provid