SD-WAN CLI configuration
The config system sdwan command is used to configure ADVPN 2.0 on the spokes:
config system sdwan
config zone
edit <zone-name>
set advpn-select {enable | disable}
set advpn-health-check <health-check name>
next
end
config members
edit <integer>
set transport-group <integer>
next
end
config service
edit <integer>
set shortcut-priority {enable | disable | auto}
next
end
end
|
Command |
Description |
|---|---|
|
advpn-select {enable | disable} |
Enable or disable SDWAN/ADVPN-2.0 (default=disabled). |
|
advpn-health-check <health-check name> |
Specify the health check for the spoke whose info will be sent to the peer spoke. |
|
transport-group <integer> |
Specify different group ID between (1 -255) to differentiate link-type, such as Internet, MPLS, LTE, Satellite. |
|
shortcut-priority {enable | disable | auto} |
Enable or disable making ADVPN shortcut a high priority over overlay parent interfaces, if SLA mode or link cost factor mode conditions are met:
|
|
diagnose sys sdwan advpn-session |
Diagnostic command run on local spoke to view remote spoke WAN link information and path manager shortcut path selection. The displayed name is the hostname or HA group name, if in HA. |
As with the previous version of ADVPN, on the hub, you must enable ADVPN and configure firewall policies between spokes.
The config vpn ipsec phase1-interface command is used to configure the shared idle timeout for overlays used by ADVPN.
config vpn ipsec phase1-interface
edit <phase1-interface name>
set idle-timeout {enable | disable}
set shared-idle-timeout {enable | disable}
set idle-timeoutinterval <integer>
next
end
|
Command |
Description |
|---|---|
|
idle-timeout {enable | disable} |
Enable/disable IPsec tunnel idle timeout (default = |
|
shared-idle-timeout {enable | disable} |
Enable/disable |
|
idle-timeoutinterval <integer> |
IPsec tunnel idle timeout, in minutes (5 - 43200, default = 5). |
The config vpn ipsec phase1-interface command is used to configure overlay placeholders, and shortcut tunnels require each spoke to be configured with these settings:
config vpn ipsec phase1-interface
edit <placeholder_phase1_interface_name>
set type dynamic
...
set net-device enable
...
set auto-discovery-dialup-placeholder {enable | disable}
next
end
|
Command |
Description |
|---|---|
|
auto-discovery-dialup-placeholder {enable | disable} |
Enable/disable overlay placeholder tunnels (default = disable). |
|
Currently, ADVPN 2.0 only supports IPv4. |