SD-WAN CLI configuration
The config system sdwan command is used to configure ADVPN 2.0 on the spokes:
config system sdwan
config zone
edit <zone-name>
set advpn-select {enable | disable}
set advpn-health-check <health-check name>
next
end
config members
edit <integer>
set transport-group <integer>
next
end
config service
edit <integer>
set shortcut-priority {enable | disable | auto}
next
end
end
|
set advpn-select {enable | disable} |
Enable or disable SDWAN/ADVPN-2.0 (default=disabled). |
|
set advpn-health-check <health-check name> |
Specify the health check for the spoke whose info will be sent to the peer spoke. |
|
set transport-group <integer> |
Specify different group ID between (1 -255) to differentiate link-type, such as Internet, MPLS, LTE, Satellite. |
|
set shortcut-priority {enable | disable | auto} |
Enable or disable making ADVPN shortcut a high priority over overlay parent interfaces, if SLA mode or link cost factor mode conditions are met:
|
|
diagnose sys sdwan advpn-session |
Diagnostic command run on local spoke to view remote spoke WAN link information and path manager shortcut path selection. |
As with the previous version of ADVPN, on the hub, you must enable ADVPN and configure firewall policies between spokes.
The config vpn ipsec phase1-interface command is used to configure the shared idle timeout for overlays used by ADVPN.
config vpn ipsec phase1-interface
edit <phase1-interface name>
set idle-timeout {enable | disable}
set shared-idle-timeout {enable | disable}
set idle-timeoutinterval <integer>
next
end
|
set idle-timeout {enable | disable} |
Enable/disable IPsec tunnel idle timeout (default = |
|
set shared-idle-timeout {enable | disable} |
Enable/disable |
|
set idle-timeoutinterval <integer> |
IPsec tunnel idle timeout, in minutes (5 - 43200, default = 5). |
|
Currently, ADVPN 2.0 only supports IPv4. |