Fortinet black logo

Administration Guide

Objects and templates created by the SD-WAN overlay template

Objects and templates created by the SD-WAN overlay template

The SD-WAN overlay wizard automatically creates templates and objects required for deployment of SD-WAN in your environment. Generated templates and objects are assigned to the hub(s) specified by the template, and branch devices are identified by membership in the specified device group. See Configuring an SD-WAN overlay template.

The following template and objects are created by the SD-WAN overlay template wizard:

  • IPsec templates
  • BGP templates
  • SD-WAN template configuration
  • CLI templates
  • Templates groups
  • Metadata variables

The SD-WAN overlay template wizard also configures the SD-WAN overlay network. The default overlay network used by the wizard is 10.10.0.0, but this can be configured for your environment.

Below details the various templates and associated components that are defined in dual-hub and single-hub deployment scenarios.

Dual-hub deployments

Category

Templates and Objects

IPsec Templates

The following IPsec templates are created for configuration of IPsec in your SD-WAN environment:

  • BRANCH_IPsec: The IPsec template for IPsec tunnels for branch devices. This template includes the following IPsec tunnels to allow connection from branch devices to the hubs through VPN1 and VPN2: HUB1-VPN1, HUB1-VPN2, HUB2-VPN1, and HUB2-VPN2.
  • HUB1_IPsec: The IPsec template created for hub 1. This template includes the IPsec tunnels VPN1 and VPN2 to allow secure communication from hub 1 to branch devices.
  • HUB2_IPsec: The IPsec template created for hub 2. This template includes the IPsec tunnels VPN1 and VPN2 to allow secure communication from hub 2 to branch devices.

BGP Templates

The following BGP templates are created for configuration of BGP in your SD-WAN environment:

  • BRANCH_BGP:The BGP template generated for your SD-WAN branch devices. This template uses the branch_id metadata variable to configure the Router ID for each branch device.
  • HUB1_BGP: The BGP template created for hub 1.
  • HUB2_BGP: The BGP template created for hub 2.

SD-WAN Template configurations

The following SD-WAN zones/members and health check servers are configured for the SD-WAN template specified in the wizard.

  • SD-WAN Zone/Interface Member: WAN1/port1, WAN2/port2, HUB1/HUB1-VPN1 and HUB1-VPN2, HUB2/HUB2-VPN1 and HUB2-VPN2
  • Performance SLA: HUB1_HC and HUB2_HC
Note

These settings are only applied when the Add Overlay Objects to SD-WAN Template option is enabled in the wizard.

CLI Templates

The following CLI templates are created to configure the device interfaces and BGP router ID.

  • BRANCH_CLI: Configure the interface and BGP router id for branch devices. This template uses metadata variables to configure unique values for each branch device. This template is added to the BRANCH_CLIGRP template group.
  • HUB1_CLI: Configure the HUB1-Lo interface on the hub 1 device. This template is added to the HUB1_CLIGRP template group.
  • HUB2_CLI: Configure the HUB2-Lo interface on the hub 2 device. This template is added to the HUB2_CLIGRP template group.

Template Groups

A template group is created for hub and branch devices. These template groups include the provisioning templates created by the SD-WAN overlay template wizard for that device.

  • HUB1: Includes provisioning templates for the hub 1 device.
  • HUB2: Includes provisioning templates for the hub 2 device.
  • BRANCH: Includes provisioning templates for branch devices. This template is automatically applied to all devices included in the branch device group specified in the wizard.

For information about onboarding new branch devices using template groups, see Onboarding new branch devices

Metadata Variables

ADOM-level metadata variables are used as variables in scripts and templates.

  • branch_id: The branch_id variable is automatically created by the template. Each branch device must be assigned a unique value. The branch_id metadata variable is used in branch provisioning templates to configure certain settings, such as the BGP router ID. See ADOM-level metadata variables.
Single-hub deployments

Category

Templates and Objects

IPsec Templates

The following IPsec templates are created for configuration of IPsec in your SD-WAN environment:

  • BRANCH_IPsec: The IPsec template for IPsec tunnels for branch devices. This template includes the following IPsec tunnels to allow connection from branch devices to the hubs through VPN1 and VPN2: HUB1-VPN1 and HUB1-VPN2.
  • HUB1_IPsec: The IPsec template created for the hub. This template includes the IPsec tunnels VPN1 and VPN2 to allow secure communication from the hub to branch devices.

BGP Templates

The following BGP templates are created for configuration of BGP in your SD-WAN environment:

  • BRANCH_BGP:The BGP template generated for your SD-WAN branch devices. This template uses the branch_id metadata variable to configure the Router ID for each branch device.
  • HUB1_BGP: The BGP template created for the hub.

SD-WAN Template configurations

The following SD-WAN zones/members and health check servers are configured for the SD-WAN template specified in the wizard.

  • SD-WAN Zone/Interface Member: WAN1/port1, WAN2/port2, HUB1/HUB1-VPN1 and HUB1-VPN2.
  • Performance SLA: HUB1_HC.
Note

These settings are only applied when the Add Overlay Objects to SD-WAN Template option is enabled in the wizard.

CLI Templates

The following CLI templates are created to configure the device interfaces and BGP router ID.

  • BRANCH_CLI: Configure the interface and BGP router id for branch devices. This template uses metadata variables to configure unique values for each branch device. This template is added to the BRANCH_CLIGRP template group.
  • HUB1_CLI: Configure the HUB1-Lo interface on the hub device. This template is added to the HUB1_CLIGRP template group.

Template Groups

A template group is created for hub and branch devices. These template groups include the provisioning templates created by the SD-WAN overlay template wizard for that device.

  • HUB1: Includes provisioning templates for the hub 1 device.
  • BRANCH: Includes provisioning templates for branch devices. The template is automatically applied to all devices included in the branch device group selected in the wizard.

For information about onboarding new branch devices using template groups, see Onboarding new branch devices

Metadata Variables

ADOM-level metadata variables are used as variables in scripts and templates.

  • branch_id: The branch_id variable is automatically created by the template. Each branch device must be assigned a unique value. The branch_id metadata variable is used in branch provisioning templates to configure certain settings, such as the BGP router ID. See ADOM-level metadata variables.

Objects and templates created by the SD-WAN overlay template

The SD-WAN overlay wizard automatically creates templates and objects required for deployment of SD-WAN in your environment. Generated templates and objects are assigned to the hub(s) specified by the template, and branch devices are identified by membership in the specified device group. See Configuring an SD-WAN overlay template.

The following template and objects are created by the SD-WAN overlay template wizard:

  • IPsec templates
  • BGP templates
  • SD-WAN template configuration
  • CLI templates
  • Templates groups
  • Metadata variables

The SD-WAN overlay template wizard also configures the SD-WAN overlay network. The default overlay network used by the wizard is 10.10.0.0, but this can be configured for your environment.

Below details the various templates and associated components that are defined in dual-hub and single-hub deployment scenarios.

Dual-hub deployments

Category

Templates and Objects

IPsec Templates

The following IPsec templates are created for configuration of IPsec in your SD-WAN environment:

  • BRANCH_IPsec: The IPsec template for IPsec tunnels for branch devices. This template includes the following IPsec tunnels to allow connection from branch devices to the hubs through VPN1 and VPN2: HUB1-VPN1, HUB1-VPN2, HUB2-VPN1, and HUB2-VPN2.
  • HUB1_IPsec: The IPsec template created for hub 1. This template includes the IPsec tunnels VPN1 and VPN2 to allow secure communication from hub 1 to branch devices.
  • HUB2_IPsec: The IPsec template created for hub 2. This template includes the IPsec tunnels VPN1 and VPN2 to allow secure communication from hub 2 to branch devices.

BGP Templates

The following BGP templates are created for configuration of BGP in your SD-WAN environment:

  • BRANCH_BGP:The BGP template generated for your SD-WAN branch devices. This template uses the branch_id metadata variable to configure the Router ID for each branch device.
  • HUB1_BGP: The BGP template created for hub 1.
  • HUB2_BGP: The BGP template created for hub 2.

SD-WAN Template configurations

The following SD-WAN zones/members and health check servers are configured for the SD-WAN template specified in the wizard.

  • SD-WAN Zone/Interface Member: WAN1/port1, WAN2/port2, HUB1/HUB1-VPN1 and HUB1-VPN2, HUB2/HUB2-VPN1 and HUB2-VPN2
  • Performance SLA: HUB1_HC and HUB2_HC
Note

These settings are only applied when the Add Overlay Objects to SD-WAN Template option is enabled in the wizard.

CLI Templates

The following CLI templates are created to configure the device interfaces and BGP router ID.

  • BRANCH_CLI: Configure the interface and BGP router id for branch devices. This template uses metadata variables to configure unique values for each branch device. This template is added to the BRANCH_CLIGRP template group.
  • HUB1_CLI: Configure the HUB1-Lo interface on the hub 1 device. This template is added to the HUB1_CLIGRP template group.
  • HUB2_CLI: Configure the HUB2-Lo interface on the hub 2 device. This template is added to the HUB2_CLIGRP template group.

Template Groups

A template group is created for hub and branch devices. These template groups include the provisioning templates created by the SD-WAN overlay template wizard for that device.

  • HUB1: Includes provisioning templates for the hub 1 device.
  • HUB2: Includes provisioning templates for the hub 2 device.
  • BRANCH: Includes provisioning templates for branch devices. This template is automatically applied to all devices included in the branch device group specified in the wizard.

For information about onboarding new branch devices using template groups, see Onboarding new branch devices

Metadata Variables

ADOM-level metadata variables are used as variables in scripts and templates.

  • branch_id: The branch_id variable is automatically created by the template. Each branch device must be assigned a unique value. The branch_id metadata variable is used in branch provisioning templates to configure certain settings, such as the BGP router ID. See ADOM-level metadata variables.
Single-hub deployments

Category

Templates and Objects

IPsec Templates

The following IPsec templates are created for configuration of IPsec in your SD-WAN environment:

  • BRANCH_IPsec: The IPsec template for IPsec tunnels for branch devices. This template includes the following IPsec tunnels to allow connection from branch devices to the hubs through VPN1 and VPN2: HUB1-VPN1 and HUB1-VPN2.
  • HUB1_IPsec: The IPsec template created for the hub. This template includes the IPsec tunnels VPN1 and VPN2 to allow secure communication from the hub to branch devices.

BGP Templates

The following BGP templates are created for configuration of BGP in your SD-WAN environment:

  • BRANCH_BGP:The BGP template generated for your SD-WAN branch devices. This template uses the branch_id metadata variable to configure the Router ID for each branch device.
  • HUB1_BGP: The BGP template created for the hub.

SD-WAN Template configurations

The following SD-WAN zones/members and health check servers are configured for the SD-WAN template specified in the wizard.

  • SD-WAN Zone/Interface Member: WAN1/port1, WAN2/port2, HUB1/HUB1-VPN1 and HUB1-VPN2.
  • Performance SLA: HUB1_HC.
Note

These settings are only applied when the Add Overlay Objects to SD-WAN Template option is enabled in the wizard.

CLI Templates

The following CLI templates are created to configure the device interfaces and BGP router ID.

  • BRANCH_CLI: Configure the interface and BGP router id for branch devices. This template uses metadata variables to configure unique values for each branch device. This template is added to the BRANCH_CLIGRP template group.
  • HUB1_CLI: Configure the HUB1-Lo interface on the hub device. This template is added to the HUB1_CLIGRP template group.

Template Groups

A template group is created for hub and branch devices. These template groups include the provisioning templates created by the SD-WAN overlay template wizard for that device.

  • HUB1: Includes provisioning templates for the hub 1 device.
  • BRANCH: Includes provisioning templates for branch devices. The template is automatically applied to all devices included in the branch device group selected in the wizard.

For information about onboarding new branch devices using template groups, see Onboarding new branch devices

Metadata Variables

ADOM-level metadata variables are used as variables in scripts and templates.

  • branch_id: The branch_id variable is automatically created by the template. Each branch device must be assigned a unique value. The branch_id metadata variable is used in branch provisioning templates to configure certain settings, such as the BGP router ID. See ADOM-level metadata variables.