Initializing cEdges in EVE-NG

This post is about making cEdges working inside EVE-NG simulation environment which does not focus on basic concepts.

Following is the network diagram. Please note that vManage, vBond and vSmart and vEdges are already initialized here. Also the vEdges and cEdges are added to vManage via serialFile.viptela file. You can find those in previous posts.

cEdge image I am using in this lab is CSR1000v IOS-XE version 16.12.03.

After bootup, you can console it and it will ask to change the password where the default username and passwords are both "admin".

Configuring cEdges is slightly different from configuring vEdges but the functionality is basically the same. According to the lab diagram, following are the configuration needed for vEdge1. It is just like the Cisco CLI.

!

config-transaction

!

hostname cEdge1

!

system

 system-ip 10.1.1.112

 site-id 2

 vbond 10.10.10.20

 organization-name TEST-ORG1

 exit

 clock timezone GST 5 30

!

int GigabitEthernet1

 no shut

 ip address 10.10.22.1 255.255.255.252

 exit

ip route 0.0.0.0 0.0.0.0 10.10.22.2

ip route 0.0.0.0 0.0.0.0 172.16.1.254

!

interface Tunnel1

 no shut

 ip unnumbered GigabitEthernet1

 tunnel source GigabitEthernet1

 tunnel mode sdwan

 exit

!

sdwan

 interface GigabitEthernet1

  tunnel-interface

   encapsulation ipsec

   allow-service all

   allow-service sshd

  commit

!

I have added only the cEdge1 config here; For cEdge2, System IP, Site ID, IP addresses will be changed.

Key Things to Note:-

system-ip is just an ID, which does not need to be routed. It is there to identify the device and it's just a number like OSPF router-id.
organization-name is very important as all the controllers, edges and the controller profile in smart account also need to match..
you can allow all services or just limit to sshd, https etc only.

You will not see "interface Tunnel1" command in context sensitive help but it will work after you enter the command. This tunnel number directly mapping the interface number at the backend. Ex:- Tunnel1 is mapping the GigabitEthernet1.

**You can see the VPN 0 is not defined in configuration, as there is no such concept in cEdges. It has VRF concept instead. When the interfaces are not defined with a VRF, they belong to the default which acts as the transport VPN.

As you can see, there are 2 default routes because each transport must have reachability to vBond and vSmart in order for OMP (Overlay Management Protocol) to work properly on both transports. More abut this and a workaround to overcome this will be discussed in a later post.

Now let's add the cEdge to vManage.

To do that we need to have the Root Cert installed in to the cEdge. We will do it by making CA Server a TFTP server and copy the CA Root Cert from CA Server to cEdge1 via TFTP.

!

copy tftp://10.10.10.40/CARoot.cer flash:CARoot.cer

!

request platform software sdwan root-cert-chain install bootflash:CARoot.cer

!

request platform software sdwan vedge_cloud activate chassis-number <> token <>

!

The chassis number and token can be found in Configuration > Devices > WAN Edge List on vManage.

If everything worked well, we can see the State as "certificate installed" in WAN Edge List on vManage.

Initializing vEdges in EVE-NG

This post is about making vEdges working inside EVE-NG simulation environment which does not focus on basic concepts.

Following is the network diagram. Please note that vManage, vBond and vSmart are already initialized here. Also the vEdges and cEdges are added to vManage via serialFile.viptela file. You can find those in previous posts.

vEdge version used in this lab is 20.7.1

After bootup, you can console it and it will ask to change the password where the default username and passwords are both "admin".

According to the lab diagram, following are the configuration needed for vEdge1. It is just like the Cisco CLI.

!

config t

!

system

 host-name vEdge1

 system-ip 10.1.1.111

 organization-name TEST-ORG1

 site-id 1

 vbond 10.10.10.20

 clock timezone Asia/Colombo

!

vpn 0

 ip route 0.0.0.0/0 10.10.11.2

 ip route 0.0.0.0/0 172.16.1.254

 interface ge0/0

  ip address 10.10.11.1/30

  no shut

  tunnel-interface

   encapsulation ipsec

   allow-service all

   allow-service sshd

   exit

 exit

! 

commit

!

Key Things to Note:-

system-ip is just an ID, which does not need to be routed. It is there to identify the device and it's just a number like OSPF router-id.
organization-name is very important as all the controllers, edges and the controller profile in smart account also need to match..
ge0/0 is the default interface configured for VPN0 (the underlay VPN)

You can allow all services or just limit to sshd, https etc only.

As you can see, there are 2 default routes because each transport must have reachability to vBond and vSmart in order for OMP (Overlay Management Protocol) to work properly on both transports. More abut this and a workaround to overcome this will be discussed in a later post.

Now let's add the vEdges to vManage

To do that we need to have the Root Cert installed in to the vEdge. We will do it by making CA Server a WinSCP server and upload the CA Root from CA Server to vEdge1 via SFTP (port 22).

Default folder in vEdge is /home/admin

Now enter the command "request root-cert-chain install /home/admin/CARoot.cer" in vEdge CLI

Then the activation command "request vedge-cloud activate chassis-number <####> token <####>"

The chassis number and token can be found in Configuration > Devices > WAN Edge List on vManage.

Now what happens at the backend is that the vEdge will communicate the vBond to get it onboarded. You can see the State as "certificate installed" in  WAN Edge List on vManage if everything went well.

Certificate Installed means that the vManage is creating and installing the ID Cert of vEdge into vEdge after onboarding automatically.

Note that this is possible because "WAN Edge Cloud Certificate Authorization" is set to "Automated" in Administration > Settings. If it is set to "Manual" you have to copy the CSR and sign it and install like we did to onboard vBond & vSmart.

Additionally you can test by CLI command "show control connections"

Adding vEdges / cEdges List to vManage in EVE-NG

This post is about making vEdges and cEdges working inside EVE-NG simulation environment which does not focus on basic concepts.

You need to have a Cisco Smart Account with you for this. 

Go to Cisco Software Central > Network Plug and Play Connect

 Select Controller Profiles

  + Add Profile

    Controller type -> VBOND

    Fill the reqired details like Profile Name, Organization Name, Primary Controller IP address which        is the VBOND IP

(click on the image to view in full size)

Then need to add the devices going again to Cisco Software Central > Plug and Play Connect

 Select Devices > +Add Software Devices

In Identify Device you should provide the Base PID (VEDGE-CLOUD-DNA for vEdges and CSR1KV for my cEdge), Quantity and the Controller Profile which you created for VBOND..

Now if you go to Cisco Software Central > Plug and Play Connect > Devices, you can see the devices are provisioned.

From now onwards you can do 2 things to onboard the provisioned devices to vManage.

1. Let vManage sync with your Cisco Smart Account through internet

2. Download serialFile.viptela from Smart Account portal and upload it to vManage manually

I am using the second option.

Go to Cisco Software Central > Plug and Play Connect

 Select Controller Profiles

 Download the "Provisioning File"

Now go to vManage > Configuration > Upload WAN Edge List and upload the downloaded file.

You can see the list of Devices are pushed to the vManage, vBond and vSmart.

You can check this from vBond CLI also by following command.

There is another command which shows same kind of output in vManage and vSmart which is "show control valid-vedges"

Initializing vSmart in EVE-NG

Please note that his post is just about deploying the Cisco SD-WAN components in EVE-NG hence concepts are not discussed.

Following is the lab used in this post.

vSmart version used in this lab is 20.7.1

After bootup, you can console it and it will ask to change the password where the default username and passwords are both "admin".

According to the lab diagram, following are the configuration needed. It is just like the Cisco CLI

!

config t
!
system
 host-name vSmart
 system-ip 10.1.1.103
 organization-name TEST-ORG1
 site-id 100
 vbond 10.10.10.20
 clock timezone Asia/Colombo
!
vpn 0

 ip route 0.0.0.0/0 10.10.10.1
 interface eth0
  ip address 10.10.10.30/24
  no shut
  tunnel-interface
  allow-service all

commit
!

Key Things to Note:-

system-ip is just an ID, which does not need to be routed. It is there to identify the device and it's just a number like OSPF router-id.
organization-name is very important as all the controllers, edges and the controller profile in smart account also need to match.
site-id should also be same in all controllers in order to sync/work.
eth0 is the default interface configured for VPN0 (the underlay VPN), you can allow all services or just limit to sshd, https etc only.
10.10.10.1 which is the default route is inside the Site-1 Core Switch as a VLAN interface.

Now let's add the vSmart to vManage

Go to Configuration > Devices

  Select "Controllers"

    Add Controller

      Select vSmart and give the VPN0 interrface IP address  as Management IP and username and password

      tick the Generate CSR and hit Add""

Now Go to Configuration > Certificates

 Select controllers

 Click on the 3 dots at the right side of the controller and select Generate CSR

 Download the CSR and send it to CA Server to get it signed..

After you have it signed, you can Go to Configuration > Certificates again and hit "Install Certificate" 

and paste the certificate content as text to install the certificate.

After few seconds, the status will turn to green with a Success..

Additionally you can test by CLI command "show control connections"

Initializing vBond in EVE-NG

Please note that his post is just about deploying the Cisco SD-WAN components in EVE-NG hence concepts are not discussed.
Following is the lab used in this post.

vBond in EVE-NG is the same image as vEdge and the version used in this lab is 20.7.1

After bootup, you can console it and it will ask to change the password where the default username and passwords are both "admin".

According to the lab diagram, following are the configuration needed. 

It is just like the Cisco CLI

!

config t

!

system

 host-name vBond

 system-ip 10.1.1.102

 organization-name TEST-ORG1

 site-id 100

 vbond 10.10.10.20 local

 clock timezone Asia/Colombo

!

vpn 0

 ip route 0.0.0.0/0 10.10.10.1

 interface ge0/0

  ip address 10.10.10.20/24

  no shut

  tunnel-interface

   encapsulation ipsec

   allow-service all

commit

!

Key Things to Note:-

system-ip is just an ID, which does not need to be routed. It is there to identify the device and it's just a number like OSPF router-id.

organization-name is very important as all the controllers, edges and the controller profile in smart account also need to match.

ge0/0 is the default interface configured for VPN0 (the underlay VPN), you can allow all services or just limit to sshd, https etc only.

site-id should also be same in all controllers in order to sync/work.

"local" keyword specifies that this is the vBond itself.

Now let's add the vBond to vManage

Go to Configuration > Devices

  Select "Controllers"

    Add Controller

      Select vBond and give the VPN0 interrface IP address  as Management IP and username and password

      tick the Generate CSR and hit Add""

Now Go to Configuration > Certificates

 Select controllers

 Click on the 3 dots at the right side of the controller and select Generate CSR

 Download the CSR and send it to CA Server to get it signed..

After you have it signed, you can Go to Configuration > Certificates again and hit "Install Certificate" 

and paste the certificate content as text to install the certificate.

After few seconds, the status will turn to green with a Success..

Additionally you can test by CLI command "show control connections"

Initializing vManage in EVE-NG

Please note that his post is just about deploying the Cisco SD-WAN components in EVE-NG hence concepts are not discussed.

Following is the lab used in this post.

As you can see, there are 3 WAN sites. All the devices will be configured in upcoming posts.

vManage version used in this lab is 20.7.1

After bootup, you can console it and it will ask to change the password where the default username and passwords are both "admin". Then it will ask to format the disk.

It will take some time to perform the format operation..
According to the lab diagram, following are the configuration needed.
It is just like the Cisco CLI

!

config t

!

system

 host-name vManage

 system-ip 10.1.1.101

 organization-name TEST-ORG1

 site-id 100

 vbond 10.10.10.20

 clock timezone Asia/Colombo

!

vpn 0

 ip route 0.0.0.0/0 10.10.10.1

 interface eth0

  ip address 10.10.10.10/24

  no shut

  tunnel-interface

   allow-service all

   commit

!

Key Things to Note:-

system-ip is just an ID, which does not need to be routed. It is there to identify the device and it's just a number like OSPF router-id.

organization-name is very important as all the controllers, edges and the controller profile in smart account also need to match.

Eth0 is the default interface configured for VPN0 (the underlay VPN), you can allow all services or just limit to sshd, https etc only.

After login in to the GUI, two of the things which were configured from the CLI needs to be configured again.

1. Organization name

2. vBond IP

To do that, Go to Administration > Settings and configure the 1st two options.

Now what is remaining is installing the certificates.

Each SD-WAN device must have 2 certificates.

1. Root Cert

2. ID Cert

ID Cert is the certificate which belongs to the device itself.

Root Cert is the CA Cert which is used to generate the CSR of the ID cert to get signed by the CA.

First the CA Root cert must be downloaded to the vManage.

Download the CA Cert as Base 64

Go to Administration > Settings 

  Edit Controller Certificate Authorization

   Change Certificate Sigining by to Enterprise Root Certificate

   Paste the Root CA as text

   Tick "Set CSR Properties"

    Enter the correct Domain Name, Organization, City, State, Email & Country Code

    Hit "Import & Save"

 

Then the CSR should be generated and send to CA to Sign and it becomes the ID Cert of vManage.

Now Go to Configuration > Certificates

 Select controllers

 Click on the 3 dots at the right side of the controller and select Generate CSR

 Download the CSR and send it to CA Server to get it signed..

After you have it signed, you can Go to Configuration > Certificates again and hit "Install Certificate" 

and paste the certificate content as text to install the certificate.

After few seconds, the status will turn to green with a Success..