Fortinet white logo
Fortinet white logo

SD-WAN Deployment for MSSPs

Deploying individual regions

Deploying individual regions

Start by deploying each of your regions, as described in the previous chapters. As shown in our example, it can be a mix of Single Hub and Dual Hub regions.

Pay attention to the following guidelines:

  • When filling in the value of lan-summary Meta Field, use the LAN summary of the particular region.
  • Later we will advertise these summaries between the regions, to provide inter-regional connectivity. This advertisement will be performed by the Hubs. Hence, fill in the right value of lan-summary not only on the Edge devices, but also on the Hubs!
  • Use a unique BGP Autonomous System (AS) number per region.

The following tables summarize the Meta Field values for all the devices in our example:

Hub devices:

Meta Field

site1-H1

site1-H2

site2-H1

as

65001

65001

65002

inet-id

11

21

41

inet-intf

port1

port1

port1

inet-tunnel-net

10.201.1.0/24

10.201.2.0/24

10.201.4.0/24

mpls-id

12

22

42

mpls-intf

port4

port4

port4

mpls-tunnel-net

10.202.1.0/24

10.202.2.0/24

10.202.4.0/24

tunnel-mask

255.255.255.0

255.255.255.0

255.255.255.0

lan-summary

10.0.0.0/14

10.0.0.0/14

10.4.0.0/14

lan-net

10.1.0.0/24

10.2.0.0/24

10.4.0.0/24

Edge devices:

Meta Field

site1-1

site1-2

site2-1

as

65001

65001

65002

inet-intf

port1

port1

port1

mpls-intf

port4

port4

port4

h1-inet-id

11

11

41

h1-inet-ip

100.64.1.1

100.64.1.1

100.64.3.1

h1-inet-tunnel-ip

10.201.1.1

10.201.1.1

10.201.4.1

h1-mpls-id

12

12

42

h1-mpls-ip

172.16.1.5

172.16.1.5

172.16.3.5

h1-mpls-tunnel-ip

10.202.1.1

10.202.1.1

10.202.4.1

h2-inet-id

21

21

-

h2-inet-ip

100.64.2.1

100.64.2.1

-

h2-inet-tunnel-ip

10.201.2.1

10.201.2.1

-

h2-mpls-id

22

22

-

h2-mpls-ip

172.16.2.5

172.16.2.5

-

h2-mpls-tunnel-ip

10.202.2.1

10.202.2.1

-

lan-summary

10.0.0.0/14

10.0.0.0/14

10.4.0.0/14

lan-net

10.0.1.0/24

10.0.2.0/24

10.4.1.0/24

By the end of this step, all your regions will be fully operational with SD-WAN/ADVPN configuration, but they will not be interconnected in any way.

The goal of the rest of this chapter is to describe how to interconnect them properly, in order for them to become part of a single SD-WAN solution. See Interconnecting regions.

Deploying individual regions

Deploying individual regions

Start by deploying each of your regions, as described in the previous chapters. As shown in our example, it can be a mix of Single Hub and Dual Hub regions.

Pay attention to the following guidelines:

  • When filling in the value of lan-summary Meta Field, use the LAN summary of the particular region.
  • Later we will advertise these summaries between the regions, to provide inter-regional connectivity. This advertisement will be performed by the Hubs. Hence, fill in the right value of lan-summary not only on the Edge devices, but also on the Hubs!
  • Use a unique BGP Autonomous System (AS) number per region.

The following tables summarize the Meta Field values for all the devices in our example:

Hub devices:

Meta Field

site1-H1

site1-H2

site2-H1

as

65001

65001

65002

inet-id

11

21

41

inet-intf

port1

port1

port1

inet-tunnel-net

10.201.1.0/24

10.201.2.0/24

10.201.4.0/24

mpls-id

12

22

42

mpls-intf

port4

port4

port4

mpls-tunnel-net

10.202.1.0/24

10.202.2.0/24

10.202.4.0/24

tunnel-mask

255.255.255.0

255.255.255.0

255.255.255.0

lan-summary

10.0.0.0/14

10.0.0.0/14

10.4.0.0/14

lan-net

10.1.0.0/24

10.2.0.0/24

10.4.0.0/24

Edge devices:

Meta Field

site1-1

site1-2

site2-1

as

65001

65001

65002

inet-intf

port1

port1

port1

mpls-intf

port4

port4

port4

h1-inet-id

11

11

41

h1-inet-ip

100.64.1.1

100.64.1.1

100.64.3.1

h1-inet-tunnel-ip

10.201.1.1

10.201.1.1

10.201.4.1

h1-mpls-id

12

12

42

h1-mpls-ip

172.16.1.5

172.16.1.5

172.16.3.5

h1-mpls-tunnel-ip

10.202.1.1

10.202.1.1

10.202.4.1

h2-inet-id

21

21

-

h2-inet-ip

100.64.2.1

100.64.2.1

-

h2-inet-tunnel-ip

10.201.2.1

10.201.2.1

-

h2-mpls-id

22

22

-

h2-mpls-ip

172.16.2.5

172.16.2.5

-

h2-mpls-tunnel-ip

10.202.2.1

10.202.2.1

-

lan-summary

10.0.0.0/14

10.0.0.0/14

10.4.0.0/14

lan-net

10.0.1.0/24

10.0.2.0/24

10.4.1.0/24

By the end of this step, all your regions will be fully operational with SD-WAN/ADVPN configuration, but they will not be interconnected in any way.

The goal of the rest of this chapter is to describe how to interconnect them properly, in order for them to become part of a single SD-WAN solution. See Interconnecting regions.