Print

VeloCloud SD-WAN 7.0 - Administration Guide - CloudHub Automated Deployment of NVA in Azure vWAN Hub Print

CloudHub Automated Deployment of NVA in Azure vWAN Hub

The VeloCloud SD-WAN and Azure virtual WAN (vWAN) NVA Automated Deployment guide describes the configurations required to automatically deploy a Virtual Edge as a Network Virtual Appliance (NVA) in the Azure vWAN Hub network.
Note: Only VeloCloud Hosted Orchestrator supports Automated Deployment of NVA in Azure vWAN Hub.

Overview

Cloud migration poses many challenges in connecting remote locations to Azure vNets in a simple, optimized, and secure way across myriad connectivity options. VeloCloud SD-WAN addresses these problems by leveraging Dynamic Multipath Optimization™ (DMPO) technologies and distributed cloud gateway coverage worldwide. VeloCloud SD-WAN transforms unpredictable broadband transport into Enterprise-class quality connections, ensuring application performance from remote locations to the Azure Cloud.

To address different deployment scenarios for customers deploying Azure vWAN, VeloCloud SD-WAN progressively added capabilities to the solution through automation. With this new integration, customers can now deploy VeloCloud Edges directly inside Azure vWAN hubs automatically, and natively integrate Azure vWAN customizable routing intelligence with VeloCloud SD-WAN optimized last-mile connectivity.

The example topology illustrates the VeloCloud SD-WAN and Azure vWAN NVA Automated Deployment scenario.

Figure 1. Example Topology with Automated Deployment of NVA in Azure vWAN Hub

CloudHub Deployment Prerequisites

To use automatic deployment of VeloCloud Edges as a Network Virtual Appliance (NVA) in Azure virtual WAN (vWAN) Hub, users must have previously created a Resource Group, a vWAN, and a virtual Hub (vHUB) on the Azure side. Once the vWAN Hub becomes active and routing status completes, users must ensure to meet the following prerequisites before proceeding with the Automated deployment of Azure vWAN NVA via Arista Edge Cloud Orchestrator:
  • Obtain Enterprise account access to Arista Edge Cloud Orchestrator.
  • Obtain access to the Microsoft Azure portal with the appropriate IAM roles.
  • Ensure that users already created a Resource Group, a vWAN and a vHUB in Azure. For steps, see Virtual WAN Documentation.
  • Software image requirements for this deployment are as follows: 
    • VeloCloud Edge Cloud Orchestrator: 5.1.0.
    • VeloCloud Gateway: 4.2.1 and above.
    • VeloCloud Edges: 4.2.1 and above.
Note: For additional information about the supported regions of NVA in Virtual Hub, see About NVA Hubs for Microsoft Azure .

CloudHub Automated Deployment of Azure vWAN NVA Using Arista Edge Cloud Orchestrator

To use Automated deployment of Azure vWAN NVA using Arista Edge Cloud Orchestrator, perform the following steps:
  1. In the Orchestrator, ensure that users activate the Multi-Cloud Service (MCS) account. Verify by checking the following system properties:
    • session.options.enableMcsServiceAccount
    • vco.system.configuration.data.mcsNginxRedirection
    Note: Contact the Edge Ops team to activate the MCS account for the Orchestrator.
    Figure 2. Displaying System Properties
  2. For an Enterprise user, once the MCS account activates, users can access the MCS service by selecting Configure > Cloud Hub to display the Cloud Hub page.
    Figure 3. Displaying Cloud Hub
  3. To deploy a NVA Edge in vWAN HUB network, perform the following two steps:
    1. Create a new credential.
    2. Create a new Cloud Hub.
  4. To create new credential, select Configure > Credential > New Credential . Provide all the required details and select Create.
    Figure 4. Adding New Credentials

     

    Table 1. Credential Fields
    Field Description
    Name Enter a unique name for the Azure subscription.
    Cloud Provider Select Azure as the Cloud Provider.
    Client ID Enter the Client ID.
    Tenant ID Enter the tenant ID.
    Client Secret Enter the Client Secret.
    Subscription ID Enter the Azure Subscription ID that created the Virtual WAN Hub to deploy Virtual Edges.

    For additional information on how to retrieve IDs for a subscription in Azure portal, see How to create a new Azure Active Directory (Azure AD) application and service principal.

    Arista Networks recommends that customers create a custom role with the following permissions (JSON) and provide access to only the necessary resources for the Cloud Hub function.

    "permissions": [
{
"actions": [
"Microsoft.Resources/subscriptions/resourceGroups/read",
"Microsoft.Resources/subscriptions/resourcegroups/deployments/read",
"Microsoft.Resources/subscriptions/resourcegroups/resources/read",
"Microsoft.Resources/subscriptions/resourcegroups/deployments/operationstatuses/read",
"Microsoft.Resources/subscriptions/resourcegroups/deployments/operations/read",
"Microsoft.Network/virtualWans/read",
"Microsoft.Network/virtualWans/join/action",
"Microsoft.Network/virtualWans/virtualHubs/read",
"Microsoft.Network/virtualHubs/read",
"Microsoft.AzureStack/linkedSubscriptions/linkedResourceGroups/linkedProviders/virtualNetworks/read",
"Microsoft.Network/networkVirtualAppliances/delete",
"Microsoft.Network/networkVirtualAppliances/read",
"Microsoft.Network/networkVirtualAppliances/write",
"Microsoft.Network/networkVirtualAppliances/getDelegatedSubnets/action",
"Microsoft.Network/virtualNetworks/read",
"Microsoft.Network/virtualNetworks/join/action",
"Microsoft.Network/virtualNetworks/peer/action",
"Microsoft.Network/virtualNetworks/write",
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action",
"Microsoft.Network/virtualNetworks/subnets/read",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"
],
"notActions": [],
"dataActions": [],
"notDataActions": []
}
]
  5. To create a New Cloud Hub, perform the following steps:
    The Cloud Hub Workflow works only for a new Profile. Create a new Profile before proceeding with the deployment of NVA Edge in vWAN HUB network.
    1. Navigate to Configure > Workflow and select New Cloud Hub to display the Cloud Credentials page.
      Figure 5. Configuring a New Cloud Hub Credentials
    2. Provide all the required Cloud Credentials details and select Next.
      Table 2. Cloud Credential Details
      Field Description
      Cloud Provider Select Azure as the Cloud Provider.
      Azure Connectivity Options Select Deploy Virtual Edge as an NVA in Azure vWAN as the connectivity option between user's Hub and vNET.
      Cloud Subscription Users can use the existing cloud subscription or create a new subscription by selecting the Create New option.
      The vWAN and vHUB Options page appears.
      Figure 6. Displaying vWAN and vHub Options
    3. Select vWAN, vHUB, and provision a Virtual Azure NVA Edge with a unique name by providing all the required details.
      Table 3. vWAN and vHUB Options
      Field Description
      Resource Group Select a resource group created in Azure.
      vWAN Select a Virtual WAN created in Azure.
      Choose vHUB
      Region Select the region to deploy the Virtual WAN Hub. Virtual Edges deploy in that Virtual WAN Hub.
      vHub Select a Virtual WAN Hub to deploy the virtual Edges.
      Address Space Specify the hub address range in CIDR notation. The minimum address space is /24 to create a hub.
      Workflow Name Enter the workflow name for the Virtual WAN Hub.
      Create Edge Networking
      NVA Name Enter a unique name for the Network Virtual Appliance (NVA) Edge device.
      Select NVA Version Select the NVA version.
      Edge Cluster Name Enter a unique name for the Edge Cluster.
      Scale Units Scale Units can be 2, 4, or 10, and map to a Azure instance type.
      Select Profile Select a Profile to associate the Virtual Edge. Use the existing Profile or create a new Profile before deploying the Azure vWAN NVA Edges in Azure vWAN Hub.
      Edge License Select the Edge license associated with the Virtual Edges.
      Contact Name Enter a contact name.
      Contact Email Enter a contact email ID.
      BGP ASN Enter the ASN value to configure on the Virtual Edges in the Arista Edge Cloud Orchestrator. Azure reserves the followingASNs:
      • Public ASNs: 8074, 8075, and 12076.
      • Private ASNs: 65515, 65517, 65518, 65519, and 65520.

       

    4. Select Finish. The newly created Cloud Hub appears on the Workflow page.
    5. Under the Detail column, select View to view the Event Details of the selected Cloud Hub.
      Currently, Orchestrator does not have a separate Monitor page for Cloud Hub service. Users can use the Monitor page of the SD-WAN service for verifying the Edge actions and states.
  6. In the SD-WAN service portal, select Monitor > Edges to verify the Virtual Azure NVA Edge that users provisioned or deployed with the Cloud Hub automation service.
    Figure 7. Displaying the Virtual Azure NVA Edge
  7. To verify if the BGP sessions established for the deployed Virtual Azure NVA Edge, select Monitor > Routing .
    Figure 8. Display BGP Sessions

    Once the Virtual Edges become active, configure IP address for each of the Virtual Edges by navigating to Configure > Edges > Firewall > Edge Access , and adding the IP address 168.63.129.16 under the Allow the following IPs field.

    Figure 9. Configuring Edge Security

    Create the configuration on a Profile used by any or all of the Virtual Edges then users do not configure one for individual Virtual Edge. For additional details regarding this IP configuration, see Microsoft IP Reference.

..