Fortinet white logo
Fortinet white logo

SD-WAN Deployment for MSSPs

Hub SD-WAN Templates

Hub SD-WAN Templates

To configure the Hub SD-WAN Template interactively, follow the general steps 1-3, as described in Edge SD-WAN Templates. This includes creating the two SD-WAN Zones named underlay and overlay.

The example below demonstrates a template called Hub-Gold from our example project and is prepared for the Hubs serving the West Region, such as "site1-H1":

Note

On the Hubs, the members of the overlay zone will be the Dial-Up tunnel interfaces.

Regarding the steps 4-5 in Edge SD-WAN Templates (Performance SLAs and SD-WAN Rules), the following guidelines apply:

  • Generally, configuring Performance SLAs and/or SD-WAN Rules on the Hubs is not mandatory. Quite often the Hub can provide Internet access using conventional routing, both for the workloads behind the Hub itself and for the Remote Internet Access from the Spokes.

  • Also for the Spoke-to-Spoke traffic and for the ADVPN exchanges, no SD-WAN configuration is necessary on the Hubs. The steering decisions for this traffic are taken solely by the Spokes. By default, the Hubs implement an "overlay stickiness" principle, preferring to stay within the overlay chosen by the originating Spoke. This principle is implemented using Policy Routes generated by our Jinja Templates.

    Note

    See Overlay stickiness for more details.

  • However, if the Hub has multiple Internet access options (such as multiple ISPs), it is also possible to control the steering using SD-WAN Rules, similar to the Spokes.

  • Additionally, it may be beneficial to monitor generic Internet connectivity from the Hubs (for example, using DNS probes towards 8.8.8.8), if only for the visibility purposes. In this case, it is enough to configure the corresponding Performance SLAs, without any SD-WAN Rules.

  • Finally, there are special cases that may require SD-WAN Rules on the Hubs, such as controlling Hub-to-Spoke traffic.

Once the SD-WAN Templates are ready, assign them to the correct Device Groups. The following screenshot demonstrates the assignment in our example project:

Hub SD-WAN Templates

Hub SD-WAN Templates

To configure the Hub SD-WAN Template interactively, follow the general steps 1-3, as described in Edge SD-WAN Templates. This includes creating the two SD-WAN Zones named underlay and overlay.

The example below demonstrates a template called Hub-Gold from our example project and is prepared for the Hubs serving the West Region, such as "site1-H1":

Note

On the Hubs, the members of the overlay zone will be the Dial-Up tunnel interfaces.

Regarding the steps 4-5 in Edge SD-WAN Templates (Performance SLAs and SD-WAN Rules), the following guidelines apply:

  • Generally, configuring Performance SLAs and/or SD-WAN Rules on the Hubs is not mandatory. Quite often the Hub can provide Internet access using conventional routing, both for the workloads behind the Hub itself and for the Remote Internet Access from the Spokes.

  • Also for the Spoke-to-Spoke traffic and for the ADVPN exchanges, no SD-WAN configuration is necessary on the Hubs. The steering decisions for this traffic are taken solely by the Spokes. By default, the Hubs implement an "overlay stickiness" principle, preferring to stay within the overlay chosen by the originating Spoke. This principle is implemented using Policy Routes generated by our Jinja Templates.

    Note

    See Overlay stickiness for more details.

  • However, if the Hub has multiple Internet access options (such as multiple ISPs), it is also possible to control the steering using SD-WAN Rules, similar to the Spokes.

  • Additionally, it may be beneficial to monitor generic Internet connectivity from the Hubs (for example, using DNS probes towards 8.8.8.8), if only for the visibility purposes. In this case, it is enough to configure the corresponding Performance SLAs, without any SD-WAN Rules.

  • Finally, there are special cases that may require SD-WAN Rules on the Hubs, such as controlling Hub-to-Spoke traffic.

Once the SD-WAN Templates are ready, assign them to the correct Device Groups. The following screenshot demonstrates the assignment in our example project: