Configure Device Settings for Profiles

After creating a Profile, users can select the Segments to include in their profile from the Segment menu on the Device tab.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles to display a list of the existing Profiles.
2. Select on a Profile or select View in the Device column of the Profile to assign segments. Users can also select a Profile, then select Modify to configure the Profile. The configuration options for the selected Profile display on the Device tab.
3. From the Segment menu, select Change Profile Segments to display Change Profile Segments.

   

4. Select the Segments to include in the profile. Segments with a lock symbol next to them indicate a Segment in use within a profile, and cannot be removed. Segments available for use display under All Segments.
5. Select Update Segments, then select Save Changes.

   After users have assigned a Segment to the Profile, users can configure Segment through the Segment menu. All Segments available for configuration appear in the Segment menu. If a Segment assigned to a VLAN or interface, it displays the VLAN ID and the Edge models associated with it.

   When users choose a Segment to configure from the Segment menu, depending upon the Segment options, the settings associated with that Segment appear in the Segments area.

   

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
2. Select on a Profile or select View in the Device column of the Profile. Users can also select a Profile and select Modify to configure the Profile.
3. The configuration options for the selected Profile display on the Device tab.
4. Scroll down to the Connectivity category and select VLAN.

   

5. Add a new VLAN by selecting + Add VLAN. Delete a selected VLAN by selecting Delete. A VLAN already assigned to a device interface cannot be deleted.
6. Select IPv4 or IPv6 to display the respective list of VLANs.
7. Selecting + Add VLAN displays the following screen:

   

8. In the Add VLAN window, configure the following VLAN details:

   Table 6. Add VLAN - Options and Descriptions

   Option	Description
   General Settings
   Segment	Select a segment from the list. The VLAN belongs to the selected segment.
   VLAN Name	Enter a unique name for the VLAN.
   VLAN ID	Enter the VLAN ID.
   Description	Enter a description. (Optional)
   LAN Interfaces	Users can configure the LAN Interfaces only at the Edge level.
   SSID	Users can configure the Wi-Fi SSID details for the VLAN only at the Edge level.
   ICMP Echo Response	Select to allow the VLAN to respond to ICMP echo messages.
   DNS Proxy	Selected by default. This option allows users to activate or deactivate a DNS Proxy regardless of the IPv4 or IPv6 DHCP Server settings.
   IPv4 and IPv6 Settings Note:Users can activate either IPv4 or IPv6 or both settings.
   Assign Overlapping Subnets	Select if users want to assign the same subnet for the VLAN to every Edge in the Profile and define the subnet in the Edge LAN IP Address. If users want to assign different subnets to every Edge, do not select the checkbox and configure the subnets on each Edge individually. Overlapping subnets for the VLAN are supported only for SD-WAN to SD-WAN traffic, providing that the LAN has NAT activated and SD-WAN to Internet traffic.
   Edge LAN IPv4/IPv6 Address	Available only when users have selected Assign Overlapping Subnets as Yes. Enter the LAN IPv4/IPv6 address of the Edge.
   CIDR Prefix / Prefix Length	Available only when users have selected Assign Overlapping Subnets as Yes. Enter the CIDR prefix for the LAN IPv4/IPv6 address.
   Network	Enter the IPv4/IPv6 address of the Network.
   OSPF	Available only when users have configured OSPF at the Profile level for the selected Segment. Select the checkbox and choose an OSPF area from the list. The OSPFv2 configuration supports only IPv4. The OSPFv3 configuration supports only IPv6. For additional information on OSPF settings and OSPFv3, see Activate OSPF for Profiles.
   Multicast	Activates only when users have configured multicast settings for the Edge. Users can configure the following multicast settings for the VLAN. IGMP PIM Select advanced multicast settings to set the following timers: PIM Hello Timer IGMP Host Query Interval IGMP Max Query Response Value
   VNF Insertion	Select to insert a VNF to the VLAN, which redirects traffic from the VLAN to the VNF. To activate VNF Insertion, ensure that the selected segment has a service VLAN mapped. For additional information about VNF, see Security Virtual Network Functions. Available only under IPv4 Settings.
   Advertise	Select to advertise the VLAN to other branches in the network.
   Fixed IPs	Users can configure the fixed IP only at the Edge level.

    

9. Select one of the available options for IPv4 DHCP Server:Activated, Relay, or Deactivated.
10. Select one of the available options for IPv6 DHCP Server: Activated or Deactivated.

    Table 7. DHCP Server - Options and Descriptions

    Option	Description
    Activated- Activates DHCP with the Edge as the DHCP server. The following configuration options are available for this type.
    DHCP Start	Enter a valid IPv4/IPv6 address available within the subnet.
    Num. Addresses	Enter the number of IPv4/IPv6 addresses available on a subnet in the DHCP Server.
    Lease Time	Select the period of time from the list. This provides the allowed duration the VLAN uses an IPv4/IPv6 address dynamically assigned by the DHCP Server.
    Options	Select Add and select pre-defined or custom DHCP options from the list. The DHCP option provides a network service to the clients from the DHCP server. For a custom option, enter the Code, Data Type, and Value. Select Delete to delete a selected option.
    Relay- Activates the DHCP with the DHCP Relay Agent installed at a remote location. Select from the following configuration options:
    Source from Secondary IP(s)	When selected,, the DHCP discover and request packets from the client relay to the DHCP Relay servers sourced from the primary IP address and all the secondary IP addresses configured for the VLAN. The reply from the DHCP Relay servers returns to the client after rewriting the source and destination. The DHCP server receives the request from both the primary and secondary IP addresses and the DHCP client can get multiple offers from primary subnet and secondary subnets. When not selected, the DHCP discover/request packets from the client relay to the DHCP Relay servers sourced only from the primary IP address.
    Relay Agent IP(s)	Select Add to add IPv4 addresses. Select Delete to delete a selected address.
    Deactivated- Deactivates the DHCP.

    A warning message displays under the following conditions when selecting DNS proxy checkbox:

    • Both of the IPv4 and IPv6 DHCP Servers are Deactivated.
    • The IPv4 DHCP Server is in Relay state and the IPv6 DHCP Server is Deactivated.
11. Select Done. On the Device settings screen, select Save Changes to save the settings. The VLAN now has a configuration for the Profile. Users can edit the VLAN settings by selecting the link under the VLAN column.

    To configure VLANs for Edges, see Configure VLAN for Edges.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles to display Configuration Profiles.
2. Select the Profile to override ARP timeouts or select View in the Device column of the Profile. The Device tab displays the configuration options for the selected Profile.
3. Under Connectivity, select ARP Timeouts.
4. To override the default ARP timeouts, select Override default ARP Timeouts.

   

5. Configure the various ARP timeouts in hours and minutes with the ARP Stale Timeout as less than the ARP Dead Timeout. The ARP Dead Timeout must be less than the ARP Cleanup Timeout.

   Table 8. ARP Timeouts - Options and Descriptions

   Option	Description
   ARP Stale Timeout	When the ARP age exceeds the Stale time, the state changes from ALIVE to REFRESH. At the REFRESH state, when a new packet tries to use this ARP entry, the packet forwards and also a new ARP request sent. If the ARP resolves, the ARP entry moves to the ALIVE state. Otherwise the entry remains in the REFRESH state and the traffic forwards in this state. The allowable value ranges from 1 minute to 23 hours and 58 minutes.
   ARP Dead Timeout	When the ARP age exceeds the Dead time, the state changes from REFRESH to DEAD. At the DEAD state, when a new packet tries to use this ARP entry, the packet drops and an ARP request sent. If the ARP gets resolved, the ARP entry moves to ALIVE state and the next data packet forwarded. If the ARP does not resolve, the ARP entry remains in the DEAD state. In the DEAD state, traffic does not forward to that port and becomes lost. The allowable value ranges from 2 minutes to 23 hours and 59 minutes.
   ARP Cleanup Timeout	When the ARP age exceeds the Cleanup time, the entry completely removes from the ARP table. The allowable value ranges from 3 minutes to 24 hours.

   The ARP timeout values can only be in increasing order of minutes.

6. Select Save Changes.

   At the Edge-level, users can override the inherited ARP Timeouts for specific edges. For additional information, see Configure Address Resolution Protocol Timeouts for Edges.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the link to a Profile or select the View link in the Device column of the Profile. Users can also select a Profile and select Modify to configure the Profile.
3. The Device tab displays the configuration options for the selected Profile.

   

4. In the Connectivity category, select Wireless Link Management.
5. Turn on the Link control traffic frequency toggle button. Activating the Link control traffic frequency featurevia the Profile reduces data usage across all wireless links between Edge devices and their peers for each Edge device that uses the Profile. However, it impacts the application performance.

   When the user sets the Link control traffic frequency option to On, the system displays the following warning message to alert potential impacts on the network performance:

   , the following warning message appears:

   Activating this option will reduce data consumption on wireless WAN links by reducing monitoring intervals and other control traffic. This causes degradation of sub-second detection of link errors and failures, which may affect the application performance.

   The Wireless Link Management settings apply to all Edges associated with the Profile. The user can override the Wireless Link Management settings for an Edge. For steps, see Configure Wireless Link Management for Edges.

6. Select Save Changes.

1. In the SD-WAN service of the Enterprise portal, select Configure > Profiles .
   The Configuration Profiles page appears.
2. Select a profile to configure Wi-Fi Radio settings, then select the View link in the Device column of the Profile.
   The Device Settings page for the selected profile appears.
3. Under the Connectivity category, select Wi-Fi Radio.

   

4. The Wi-Fi Radio area expands, and the system sets the Channel to Automatic by default.
5. Select any one or both of the radio bands.
   Note: In the case of Edge 710 and Edge 710 5G, users can select both 2.4 GHz and 5 GHz radio bands.
6. Select Save Changes.
   At the Edge level, users can override the Wi-Fi Radio settings specified in the Profile by selecting the Override checkbox. For additional information, see Configure Wi-Fi Radio Overrides.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the link to a Profile or select the View link in the Device column of the Profile. Users can also select a Profile, then select Modify to configure it.
3. The Device tab displays the configuration options for the selected Profile.

   

    

4. In the Connectivity category, select Common Criteria Firewall.
5. Switch the Enable Common Criteria Firewall toggle to On. After users activate this option, the system automatically drops, counts, and logs the following packets:
   • The system drops packets destined for the Edge that contain invalid fragments or fragments it cannot completely reassemble
   • The system drops packets if the source address originates from a broadcast network, a multicast network, or a loopback address.
   • The system drops packets with the IP options: Loose Source Routing, Strict Source Routing, or Record Route specified.
   • The system drops packets that have the source or destination address as unspecified or reserved for future use.
   • The system drops packets if the source address does not belong to a network reachable through the specific interface where the packet arrived.
   • The system drops packets where the source or destination address of the network packet is defined as being unspecified (i.e., 0.0.0.0) or an address “reserved for future use” (i.e., 240.0.0.0/4) as specified in RFC 5735 for IPv4.
   • The system drops IPv6 packets if the source or destination matches an “unspecified address” or an address “reserved for future definition and use”. Per RFC 3513, the system only allows global unicast addresses within the 2000::/3 range.

   The system applies the Common Criteria (CC) Firewall settings to all Edges associated with the Profile. For steps, see Configure Common Criteria Firewall Settings for Edges.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profile/Edges .
2. Select a Profile to configure with Gateway Handoff Assignment settings, and then select View in the Device column of the Profile.
   The Device tab for the selected Profile appears.
3. Navigate to VPN Services and expand Gateway Handoff Assignment.

   

4. Select + Select Gateways to display Select Partner Gateways for Global Segment. By default, the Orchestrator selects Global Segment as the Segment. Choose any other segment if required.

   

5. The Partner Gateways section lists the Gateways in the Gateway Pool configured as a Partner Handoff Gateway. If Gateways without a Partner Handoff configuration exist, the dialog box displays the following sample message: "There is one other Gateway in the Gateway Pool not configured as a Partner Handoff Gateway."
6. To view only the list of selected Partner Gateways, select Show only selected.
7. Select the Partner Gateways from the list to assign to the Profile, then select Update.
8. The Partner Gateway assignments configured at the Profile level apply to all the Edges within the Profile. Users can override these settings at the Edge level.

   

9. Select CDE Gateways: In normal scenarios, the PCI traffic runs between the customer branch and Data Center where the PCI traffic is handoff to the PCI network and the Gateways are out of PCI scope. (The Operator can configure the Gateway to exclude PCI Segment by clearing the CDE role). In certain scenarios where Gateways can have a handoff to the PCI network and in the PCI scope, the Operator can activate CDE role for the Partner Gateways and these Gateways (CDE Gateways) become available for the user to assign in the PCI Segments (CDE Type).
10. Assign a CDE Gateway: By default, the Orchestrator selects Global Segment as the Segment. Choose any other segment (CDE Type) if required.
    1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
    2. Select a Profile to configure Gateway Handoff Assignment settings, then select View in the Device column of the Profile.
       The Device tab for the selected Profile appears.
    3. Navigate to VPN Services and expand Gateway Handoff Assignment.
    4. Select + Select Gateways to display Select Partner Gateways for Global Segment.

       

    5. In the Partner Gateways section, select a Partner Gateway marked with the CDE to assign to the Profile.
    6. Select Update.

1. In the Enterprise portal, navigate to Configure > Profiles .
2. Select the View link in the Device column, or select the Profile link.
3. In the Cloud Security Service area, switch the toggle button from Off to On.
4. Configure the following settings:

   

    

   Table 17. Cloud Security Service - Options and Descriptions

   Option	Description
   Cloud Security Service	Select a Cloud Security Service from the menu to associate with the profile. The user can also select New Cloud Security Service from the list to create a new service type. For additional information about how to create a new CSS, see Configure a Cloud Security Service. Note: For Cloud Security Services with a Zscaler login URL configured, Login to Zscaler appears in the Cloud Security Service area. Select Login to Zscaler to be redirected to the Zscaler Admin portal of the selected Zscaler cloud.
   Tunneling Protocol	This option is available only for the Zscaler Cloud Security Service provider. If the user selects a manual Zscaler service provider, then select either IPsec or GRE as the tunneling protocol. The default value is IPsec. Note: If the user selects an automated Zscaler service provider, then the system does not allow configuration of the Tunneling Protocol field; instead, it displays the service provider's protocol name.
   Hash	Select the Hash function as SHA 1 or SHA 256 from the drop-down. The default value is SHA 1.
   Encryption	Select the Encryption algorithm as AES 128 or AES 256 from the menu. The default value is None.
   Key Exchange Protocol	Select the key exchange method as IKEv1 or IKEv2. The default value is IKEv2.
   Login to Zscaler	Select Login to Zscaler to log in to the Zscaler Admin portal of the selected Zscaler cloud.

    

5. Select Save Changes.

   When user enables Cloud Security Services and configure settings in a profile, those settings automatically apply to the Edges associated with that profile. If required, user can override the configuration for a specific Edge. See Configure Cloud Security Services for Edges.

   For the profiles created with Cloud Security Services enabled and configured before the 3.3.1 release, user can redirect the traffic as follows:

   • Redirect only web traffic to Cloud Security Services.
   • Redirect all Internet-bound traffic to Cloud Security Services.
   • Redirect traffic based on Business Policy Settings - This option is available only from release 3.3.1. If user chooses this option, then the other two options are no longer available.

   Note: For new profiles created for release 3.3.1 or later, the system redirects the traffic by default per the Business Policy settings. For more information, see:

   • Configure Business Policies with Cloud Security Services
   • Cloud Security Services
   • Configure a Profile Device

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the profile link or click the View link in the Device column of the Profile. The Device tab displays the configuration options for the selected Profile.

   

3. Under the VPN Services category, select Zscaler and activate Zscaler by turning the button to On.
4. From the Cloud Subscription drop-down menu, select the Zscaler subscription.
   The Zscaler Cloud associated with the selected subscription automatically appears in the Cloud Name field.
5. To edit the Location Gateway options. select the Edit button. The Edit Location Gateway Options dialog appears.

   

6. Configure the Gateway options and Bandwidth control settings for Location and click Done. For additional information about Zscaler Gateway Options and Bandwidth Control parameters, see https://help.zscaler.com/zia/configuring-locations.
7. Select Reset to restore Zscaler Location gateway options to their defaults.
8. Select Save Changes.
   For additional information, see:

   • Configure Cloud Security Services for Profiles
   • Configure Cloud Security Services for Edges

Multicast provides an efficient way to send data to an interested set of receivers with only one copy of data from the source, by letting the intermediate multicast routers in the network replicate packets to reach multiple receivers based on a group subscription.

Multicast clients use the Internet Group Management Protocol (IGMP) to propagate membership information from hosts to Multicast activated routers and Protocol Independent Multicast (PIM) to propagate group membership information to Multicast servers via Multicast routers.

Multicast support includes:

• Multicast support on both overlay and underlay
• Protocol-Independent Multicast- Sparse Mode (PIM-SM) on Edge
• Internet Group Management Protocol (IGMP) version 2 on Edge
• Static Rendezvous Point (RP) configuration. In this scenario, the administrator configures a Static RP by activating the RP function on a third-party router rather than on the local Edge.

The user can activate and configure Multicast globally and at the interface level. If required, the user can override the Multicast configurations at the Edge level.

To configure Multicast globally:

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles to display the Profiles page.
2. Select a Profile or select View in the Device column of the Profile. The user can also select a Profile and select Modify to configure the Profile. The Orchestrator displays the configuration options for the selected Profile on the Device tab.
3. Navigate to the Routing & NAT category and expand the Multicast area. Toggle the button to activate the Multicast feature. There must be at least one RP group when enabling Multicast. The RP Selection is set to Static by default.

   

4. Configure the following Multicast settings:

   Table 18. Multicast Settings - Options and Descriptions

   Multicast Setting	Description
   RP Selection	Static is the default and supported mechanism.
   RP Address	Enter the IP address of the device that is the route processor for the multicast group.
   Multicast Group	Enter a range of IP addresses and port numbers that define a Multicast group. After the host device joins the Multicast group, it can receive any data packets sent to the group, identified by the IP address and port number.
   Enable PIM on Overlay	Activate PIM peering on SD-WAN Overlay. For example, when activated on both branch Edge and hub Edge, they form a PIM peer. By default, the source IP address for the overlays is derived from any switched interfaces (if present) or from a Static Routed interface with a deactivated WAN Overlay. The user can change the source IP by specifying the Source IP Address, which is a virtual address and automatically advertised over the overlay.
   PIM Timers	Under Advanced Settings, configure the PIM timers details, if needed: Join Prune Send Interval- The Join Prune Interval Timer. The default value is 60 seconds. The allowable range is 60-600. Keep Alive Timer- PIM keep alive timer. The default value is 60 seconds. The allowable range is 31-60000.

   To configure the multicast settings at the Interface level, see: Configure Interface Settings for Profile and .

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
2. The Profiles page displays the existing Profiles.
3. Select the profile link or click the View link in the Device column of the Profile. The user can also select a Profile, and click Modify to configure it.
4. The Orchestrator displays the configuration options for the selected Profile on the Device tab.
5. Scroll down to the Routing & NAT category and select DNS.

   

6. In the Conditional DNS Forwarding (Private DNS) section, select Private DNS to forward the DNS requests related to the domain name. Click Add to add existing private DNS servers to the drop-down menu. Click Delete to remove the selected private DNS server from the list.
7. To add a new private DNS, select New Private DNS.

   

   These are the available options for Private DNS:

   Table 19. New Private DNS Service - Options and Descriptions

   Option	Description
   DNS Type	Displays Private by default. The user cannot edit this option.
   Service Name	Type the name of the DNS service.
   IPv4 Server	Type the IPv4 address for the IPv4 Server. Click the plus (+) icon to add more addresses.
   IPv6 Server	Type the IPv6 address for the IPv6 Server. Click the plus (+) icon to add more addresses.
   Private Domains	Click Add, and then type the private domain name and description.

    

8. Click Save Changes.
9. In the Public DNS section, select a public DNS service from the drop-down menu for querying domain names. The system configures Google and OpenDNS as the default public DNS servers.
10. To add a new public DNS, select New Public DNS.
    Note: The system activates the public DNS service on a VLAN or routed interface only when users also activate the DNS Proxy on that same interface.

    

    These are the available options for a new public DNS:

    Table 20. New Public DNS Service - Options and Descriptions

    Option	Description
    DNS Type	Displays Public by default. The user cannot edit this option.
    Service Name	Type the name of the DNS service.
    IPv4 Server	Type the IPv4 address for the IPv4 server. Click the plus (+) icon to add more addresses.
    IPv6 Server	Type the IPv6 address for the IPv6 server. Click the plus (+) icon to add more addresses.

     

11. Click Save Changes.
12. In the Local DNS Entries section, click Edit to edit an existing local DNS entry. Click Delete to remove the selected local DNS entry from the list.
13. To add a new local DNS entry, select New Local DNS Entry.

    

    These are the available options for a new local DNS entry:

    Table 21. New Local DNS Entry - Options and Descriptions

    Option	Description
    Domain Name	Type the device domain name.
    IP Addresses	Type either an IPv4 or an IPv6 address.
    Add	Click Add to add multiple IP addresses. Note: The user can add up to 10 IP addresses per domain name.
    Delete	Click Delete to delete the selected IP addresses.

     

14. After configuring the private, public, and local DNS entries, click Save Changes on the Device page.
    Note: In addition to the actual data from the DNS, the Deep Packet Inspection (DPI) also feeds the DNS cache with hostname IP pairs when Qosmos parses the HTTP destination host or SSL SNI.

1. In the SD-WAN service of the Enterprise portal, click Configure. Depending on user's login permissions, select a Customer or Partner first, then select Configure to display the Profile.
2. Select a Profile from the list of available Profiles or Add a Profile if necessary.
3. Go to the Routing & NAT section and select the arrow next to OSPF.
4. In the OSPF Areas section, configure the Redistribution Settings for OSPFv2/v3, BGP Settings, and, if applicable, Route Summarization.
   Note: OSPFv2 supports only IPv4. OSPFv3 supports only IPv6 and is only available in the 5.2 release.

   

    

   Table 22. OSPF Settings - Options and Descriptions

   Option	Description
   Redistribution Settings
   Default Route	Select an OSPF route type (O1 or O2) for the default route. The default selection for this configuration is None.
   Advertise	Select either Always or Conditional. Selecting Always indicates advertising the default route always, and selecting Conditional means to redistribute the default route only when Edge learns via overlay or underlay. The user must select the Overlay Prefixes checkbox to enable the Conditional default route.
   Overlay Prefixes	If applicable, select Overlay Prefixes.
   BGP Settings
   BGP	To enable injection of BGP routes into OSPF, select BGP. The system allows users to redistribute BGP routes into OSPF. If user's network requires this, configure the following options: Set Metric Set Metric Type
   Set Metric	In Set Metric, enter the metric. This is the metric that OSPF adds to its external LSAs generated from redistributed routes. The default metric is 20.
   Set Metric Type	From the Set Metric Type menu, select a metric type. This is either type E1 or E2 (OSPF External-LSA type with the default type of E2.

    

5. In OSPF Areas, click +Add and configure the options. Add additional areas, if necessary, by selecting +Add. The user cannot override the fields in the table at the Edge level.

   Table 23. OSPF Areas - Options and Descriptions

   Option	Description
   Area ID	Select inside the Area ID text field and type an OSPF area ID.
   Name	Select inside the Name text field and type a descriptive name for area.
   Type	The system selects the Normal type by default. At this time, the system only supports the Normal type.

    

6. Next, configure the OSPF Interface Settings. For configuration details, see either "Configure Interface Settings for Profiles with New Orchestrator UI" or "Configure Interface Settings for Edges with New Orchestrator UI."
   Note: The user must activate OSPF at the Profile level before users can configure it on Edge interfaces.
7. If applicable, configure Route Summarization.
   Note: The Route Summarization feature is available starting with the 5.2 release. For an overview and use case for this feature, see Route Summarization.
8. Navigate to Route Summarization.
9. Click +Add in the Route Summarization area. A new row gets added to the Route Summarization area. The user can configure Route Summarization, as described in the table.

   

    

   Table 24. Route Summarization - Options and Descriptions

   Option	Description
   Subnet	Type the IP subnet.
   No Advertise	When the administrator sets the No Advertise option, the system summarizes all external routes (Type-5) under that supernet and does not advertise them. This means it effectively blocks the whole supernet from advertising to its peer.
   Tag	Type the router Tag value (1-4294967295).
   Metric Type	Type the Metric Type (E1 or E2).
   Metric	Type the advertised metric for this route (0-16777215).

    

10. Add additional routes, if necessary, by selecting +Add. Route Summarization Clone or Delete to copy or delete a Route Summarization.
11. Select Save Changes.

1. In the SD-WAN service of the Enterprise portal, select Configure > Profiles .
2. Select Device for a profile, or select a profile, then select the Device tab.
3. On the Device tab, scroll down to the Routing & NAT section and select the arrow next to the BDF area to open it.
4. Move the BDF slider to ON position.
5. Configure the following settings, as described in the table.

   Table 25. BFD Settings - Options and Descriptions

   Option	Description
   Peer Address	Enter the IPv4 address of the remote peer to initiate a BFD session.
   Local Address	Enter a locally configured IPv4 address for the peer listener. This address is used to send the packets. Users can select the IPv6 tab to configure IPv6 addresses for the remote peer and the peer listener. For IPv6, the local and peer addresses support only the following format: IPv6 global unicast address (2001:CAFE:0:2::1) IPv6 unique local address (FD00::1234:BEFF:ACE:E0A4)
   Multihop	Select the checkbox to enable multi-hop for the BFD session. While BFD on Edge and Gateway supports directly connected BFD Sessions, the user need to configure BFD peers in conjunction with multi-hop BGP neighbors. The multi-hop BFD option supports this requirement. Multihop must be enabled for the BFD sessions for "NSD-BGP-Neighbors".
   Detect Multiplier	Enter the detection time multiplier. The remote transmission interval is multiplied by this value to determine the detection timer for connection loss. The range is from 3 to 50 and the default value is 3.
   Receive Interval	Enter the minimum time interval, in milliseconds, at which the system can receive the control packets from the BFD peer. The range is from 300 to 60000 milliseconds and the default value is 300 milliseconds.
   Transmit Interval	Enter the minimum time interval, in milliseconds, at which the local system can send the BFD control packets. The range is from 300 to 60000 milliseconds and the default value is 300 milliseconds.

    

6. Select the + icon to add details of more peers.
7. Select Save Changes.

   

   When the user configures BFD rules for a profile, the rules automatically apply to the Edges associated with the profile. If required, the user can override the configuration for a specific Edge. See Configure BDF for Edges for additional information.

   VeloCloud SD-WAN supports configuring BFD for BGP and OSPF.

   • To enable BFD for BGP, see Configure BFD for BGP for Profiles.
   • To enable BFD for OSPF, see Configure BFD for OSPF.
   • To view the BFD sessions, see Monitor BFD Sessions.
   • To view the BFD events, see Monitor BFD Events.
   • For troubleshooting and debugging BFD, see Troubleshooting BFD.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles e.
   The Profiles page displays the existing Profiles.
2. Select the link to a Profile or select the View link in the Device column of the Profile that users want to configure.
   The Device tab displays the configuration options for the selected Profile.
3. Scroll down to the Routing & NAT category, select LAN-Side NAT Rules.
4. To configure LAN-Side NAT Rules, select +ADD and enter the details in the following table to add a NAT Source or Destination.

   

    

   Table 26. LAN-Side NAT Rules - Options and Descriptions

   Option	Description
   Type	Determine whether the NAT rule applies on the source or destination IP address of user traffic, and accordingly select either Source or Destination as the type from the drop-down menu.
   Inside Address	Enter the "inside" or "before NAT" IPv4 address (if prefix is 32), or subnet (if prefix is less than 32).
   Outside Address	Enter the "outside" or "after NAT" IPv4 address (if prefix is 32), or subnet (if prefix is less than 32).
   Source Route	Optionally, for destination NAT, specify source IPv4 address/subnet as match criteria. Only valid if the type is “Destination”. Ensure the prefix is a value from 1 through 32 and the default value is any.
   Destination Route	Optionally, for source NAT, specify destination IPv4 address/subnet as match criteria. Only valid if the type is “Source”. Ensure the prefix is a value from 1 through 32 and the default value is any.
   Description	Enter a description for the NAT rule.

    

5. Select Save Changes on the Device page. The configured NAT Source and Destination appears as shown in the following screenshot.

   

   Important:If the Inside Prefix has a lesser value than the Outside Prefix, the feature supports Many:1 NAT in the LAN to WAN direction and 1:1 NAT in the WAN to LAN direction. For example, if the Source Type has an Inside Address with the value 10.0.5.0/24, and an Outside Address with the value 192.168.1.25/32, sessions from the LAN to the WAN with the Source IP address matching the Inside Address 10.0.5.1 translate to 192.168.1.25. For sessions from the WAN to the LAN with a Destination IP address matching the Outside Address, 192.168.1.25 translate to 10.0.5.25. Similarly, if the Inside Prefix has a value greater than the Outside Prefix, the feature supports Many:1 NAT in the WAN to LAN direction and 1:1 NAT in the LAN to WAN direction. The NAT IP address does not automatically advertise, and users must ensure that a static route for the NAT IP address is configured and the next hop is the LAN next hop IP address of the source subnet.

1. In the SD-WAN service of the Enterprise portal, select the Configure tab.
2. From the left menu, select Profiles to display the Profile page.
3. Select a Profile from the list of available Profiles or add a Profile if necessary.
4. Go to the Routing & NAT section and select the arrow next to BGP to expand.
5. In the BGP area, toggle the radio button from Off to On.

   

6. In the BGP area, enter the local Autonomous System Number (ASN) in the appropriate field.
7. Configure the BGP Settings.

   Table 27. BGP Settings - Options and Descriptions

   Option	Description
   Router ID	Enter the global BGP router ID. If users do not specify any value, the ID is automatically assigned. If users have configured a loopback Interface for the Edge, the IP address of the loopback Interface will be assigned as the router ID.
   Keep-Alive	Enter the keep-alive timer in seconds, which is the duration between the keep-alive messages sent to the peer. The range is from 0 to 65535 seconds. The default value is 60 seconds.
   Hold Timer	Enter the hold timer in seconds. If users don't receive the keep-alive message within the specified time, the peer is down. The range is from 0 to 65535 seconds. The default value is 180 seconds.
   Uplink Community	Enter the community string to treat as uplink routes. Uplink refers to link connected to the Provider Edge(PE). Inbound routes towards the Edge matching the specified community value is treated as Uplink routes. These routes are not owner of the Hub/Edge. Enter the value in number format ranging from 1 to 4294967295 or in AA:NN format.
   Enable Graceful Restart checkbox	Note when selecting this checkbox: The local router does not support forwarding during the routing plane restart. This feature supports preserving forwarding and routing in case of peer restart.

    

8. Select +Add in the Filter List area to create one or more filters. These filters are applied to the neighbor to deny or change the attributes of the route. Users can use the same filter for multiple neighbors.

   

   

   

9. In the appropriate text fields, set the rules for the filter, as described in the table below.

   Table 28. Add Filter - Options and Descriptions

   Option	Description
   Filter Name	Enter a descriptive name for the BGP filter.
   Match Type	Choose the type of the routes to match with the filter: Prefix for IPv4 or IPv6- Choose to match with a prefix for IPv4 or IPv6 address and enter the corresponding prefix IP address in the Value field. Community- Choose to match with a community and enter the community string in the Value field. AS Path - Match routes using the user-provided AS path regular expression. Metric- Match routes using the user-provided MED value. Local preference-Match routes using the user-provided local preference value.
   Match Value	Enter the subnet value.
   Exact Match	It performs the filter action only when the Prosecutes match exactly with the specified prefix or community string. By default, this option is enabled.
   Action Type	Select the action to perform when the routes match with the specified prefix or the community string. Users can either permit or deny the traffic.
   Action Set	When the BGP routes match the specified criteria, users can set to route the traffic to a network based on the attributes of the path. Select one of the following options from the drop-down list: None- The attributes of the matching routes remain the same. Local Preference- It routes the matching traffic to the path with the specified local preference. Community- It filters the matching routes by the specified community string. Users can also select Community Additive to enable the additive option, which appends the community value to existing communities. Metric - It routes the matching traffic to the path with the specified metric value. As-Path-Prepend- Allows pre-pending multiple entries of Autonomous System (AS) to a BGP As-Path-Exclude - AS path exclude is a new set option, using which users can remove specific Autonomous System (AS) numbers from a route’s AS path. When users exclude ASNs, the system deletes all occurrences of the specified numbers, regardless of where they appear in the sequence.

   AS path Regex match option

   By using the AS Path Regex match type, administrators can filter BGP routes based on the autonomous systems they have traversed, applying a Permit or Deny action whenever a route's AS path matches the defined pattern. This approach enables the creation of sophisticated policies based on a route’s origin or transit history rather than just its prefix, allowing the system to accept routes from specific providers, block untrusted transit networks, or match defined ranges of ASNs.

   Table 29. Supported AS Path Regex Characters

   Character	Meaning / Use	Example	Matches Example AS Paths
   0–9	Digits used in AS numbers	^65001$	65001
   ^	Start of AS path	^65001	65001 65002 65003
   $	End of AS path	65001$	65003 65002 65001
   _	AS boundary (start, end, space, comma, brace, or parentheses)	_65001_	65000 65001 65002
   			65001
   |	Logical OR (alternation)	^(65001|65002)$	65001
   			65002
   []	Character class (any one character in set)	^6500[12]$	65001
   			65002
   {}	Repeat count	[0-9]{5}	65000
   ()	Grouping (for OR or repetition)	(65001|65002) 65003	65002 65003 65004
   (space)	AS separator	^65001 65002	65001 65002 65003
   *	Zero or more repetitions	[0-9]*	65001
   			123
   +	One or more repetitions	[0-9]+	65001
   .	Any single character	6500.	65000–65009
   ?	Zero or one occurrence	6500[1-2]?	6500
   			65001
   			64002
   -	Range indicator (inside [])	^65[0-9][0-9]$	6500–6599
   \	Escape special characters (treat literally) Usually matches confederations and AS_SET	_\{65200_	65100 {65200 65300}
   		_\(64512\)	65001 (64512) 65001

   AS Path Exclude

   AS path exclude is a new set option,using which users can remove specific Autonomous System (AS) numbers from a route’s AS path. When users exclude ASNs, the system deletes all occurrences of the specified numbers, regardless of where they appear in the sequence.

   Example:

   For instance, if a user provides input as "100 300" and a route's AS path is "100 200 300 400", the resulting AS path after filtering will be "200 400"

10. Select the + icon to add more matching rules for the filter. Repeat the procedure to create more BGP filters. The Filter List area displays the configured filters.
    Note:

    • The maximum number of supported BGPv4 Match/Set rules is 512 (256 inbound, 256 outbound). Exceeding 512 total Match/Set rules may cause performance issues, resulting in disruptions to the enterprise network.
    • Older versions of Edge and their profiles show the new enhanced BGP filter options AS Path, AS-Path -Exclude, Metric and Local preference in the user interface, but these settings are not applied until upgraded to Edge version 7.0 or above.
11. Scroll down to Neighbors and select +Add.

    

12. Configure the following settings for the IPv4 addressing type:

    Table 30. Neighbours - Options and Descriptions

    Option	Description
    Neighbor IP	Enter the IPv4 address of the BGP neighbor
    ASN	Enter the ASN of the neighbor
    Inbound Filter	Select an Inbound filer from the drop-down list
    Outbound Filter	Select an Outbound filer from the drop-down list

    Note: When overriding and configuring BGP neighbors at the Edge level, any Profile-level filters associated with the neighbors is removed when users switch the Edge from one profile to another. So at the Edge level, users must make sure to re-associate the filters with the BGP neighbors after switching the Edge profile.

    Additional Options – Select the View all to configure the following additional settings:

    Table 31. Additional Options and Descriptions

    Option	Description
    Max-hop	Enter the number of maximum hops to enable multi-hop for the BGP peers. The range is from 1 to 255 and the default value is 1. Note: This field is available only for eBGP neighbors, when the local ASN and the neighboring ASN are different. With iBGP, when both ASNs are the same, multi-hop is inherent by default and this field is not configurable.
    Local IP	Local IP address is the equivalent of a loopback IP address. Enter an IP address that the BGP neighborships can use as the source IP address forth outgoing packets. If users do not enter any value, it uses the IP address of the physical Interface as the source IP address. Note: For eBGP, this field is available only when Max- hop count is more than 1. For iBGP, it is always available as iBGP is inherently multi-hop.
    Uplink	Flag the neighbor type to Uplink. Select this option if users use the neighbor as the WAN overlay toward MPLS. The system uses this flag to determine if the site becomes a transit site (such as an SD-WAN Hub) by propagating routes learned over an SD-WAN overlay to a WAN link toward MPLS. If users want to establish the site as a transit site, users must also select the Overlay Prefix Over Uplink check box in the Advanced Settings area.
    Allow AS	Select the checkbox to allow the BGP routes to receive and process even if the Edge detects its own ASN in the AS-Path.
    Default Route	The Default Route adds a network statement in the BGP configuration to advertise the default route to the neighbor.
    Enable BFD	Enables subscription to existing BFD session for the BGP neighbor.
    Keep-Alive	Enter the keep-alive timer in seconds, which is the duration between the keep-alive messages sent to the peer. The range is from 0 to 65535 seconds. The default value is 60 seconds.
    Hold Timer	Enter the hold timer in seconds. If users don't receive the keep-alive message within the specified time, the peer is down. The range is from 0 to 65535 seconds. The default value is 180 seconds.
    Connect	Enter the time interval to try a new TCP connection with the peer if it detects the TCP session is not passive. The default value is 120 seconds.
    MD5 Auth	Select the checkbox to enable BGP MD5 authentication. Administrators typically use this option in legacy or federal networks, where they commonly implement BGP MD5 as a security measure for BGP peering.
    MD5 Password	Enter a password for MD5 authentication. Note: Starting from the 4.5 release, the use of the special character < in the password is no longer supported. In cases where users have already used < in their passwords in previous releases, they must remove it to save any changes on the page.

     

13. Select the + to add more BGP neighbors. Over Multi-hop BGP, the system might learn routes that require recursive lookup. These routes have a next-hop IP which is not in a connected subnet, and do not have a valid exit Interface. In this case, the routes must have the next-hop IP resolved using another route in the routing table that has an exit Interface. When there is traffic for destination that needs these routes to look up, routes requiring recursive lookup resolves to a connected Next Hop IP address and Interface. Until the recursive resolution happens, the recursive routes point to an intermediate Interface.
    For additional information about Multi-hop BGP Routes, see the Remote Diagnostic Tests on Edges section in the VeloCloud SD-WAN Troubleshooting Guide.
14. Navigate to Advanced Settings and select the down arrow to open the Advanced Settings section.

    

15. Configure the following advanced settings and globally apply them to all the BGP neighbors with IPv4 addresses.

    Table 32. Advanced Settings - Options and Descriptions

    Option	Description
    Overlay Prefix	Select the check box to redistribute the prefixes learned from the overlay.
    Turn off AS-Path carry over	The user should leave this option unchecked by default. Select the check box to turn off AS-PATH Carry Over. In certain topologies, turning off AS-PATH Carry Over will influence the outbound AS-PATH to make the L3 routers prefer a path towards an Edge or a Hub. Warning: When users turn off AS-PATH Carry Over, users must tune their network carefully to avoid routing loops.
    Connected Routes	Select to redistribute all the connected Interface subnets.
    OSPF	Select the checkbox to enable OSPF redistribute into BGP.
    Set Metric	When users enable OSPF, enter the BGP metric for the redistributed OSPF routes. The default value is 20.
    Default Route	Select to redistribute the default route only when Edge learns the BGP routes through overlay or underlay. When users select the Default Route option, the Advertise option is available as Conditional.
    Overlay Prefixes over Uplink	Select the checkbox to propagate routes learned from overlay to the neighbor with uplink flag.
    Networks	Enter the network address in IPv6 format that BGP advertises to the peers. Select (+) to add more network addresses.

    When users enable the Default Route option, the BGP routes are advertised based on the Default Route selection globally and per BGP neighbor.

    Table 33. Default Route Advertising Options

    Default Route Selection		Advertising Options
    Global	Per BGP Neighbor
    Yes	Yes	The per BGP neighbor configuration overrides the global configuration and hence the system always advertises the default route to the BGP peer.
    Yes	No	BGP redistributes the default route to its neighbor only when the Edge learns an explicit default route through the overlay or underlay network.
    No	Yes	The system advertises the default route to the BGP peer.
    No	No	The system does not advertise the default route to the BGP peer.

     

16. Select the IPv6 tab to configure the BGP settings for IPv6 addresses. Enter a valid IPv6 address of the BGP neighbor in the Neighbor IP field.
    The BGP peer for IPv6 supports the following address format:

    • Global unicast address (2001:CAFE:0:2::1)
    • Unique Local address (FD00::1234:BEFF:ACE:E0A4)
17. Configure the other settings as required.
    Note: The Local IP address configuration is not available for IPv6 address type.
18. Select Advanced to configure the following advanced settings, which globally apply to all the BGP neighbors with IPv6 addresses.

    Table 34. Advanced Options and Descriptions

    Option	Description
    Connected Routes	Select the checkbox to redistribute all the connected Interface subnets.
    Default Route	Select the checkbox to redistribute the default route only when Edge learns the BGP routes through overlay or underlay. When users select the Default Route option, the Advertise option is available as Conditional.
    Networks	Enter the network address in IPv6 format that BGP will be advertising to the peers. Select the Plus (+) Icon to add more network addresses.

    The Route Summarization feature is available in the 5.2 release, for an overview and use case of this functionality, see Route Summarization. For configuration details, follow the Steps 19 to 24.
19. Select +Add in the Route Summarization area. It adds a new row to the Route Summarization area.

    

20. Under the Subnet column, enter the network range that users want to summarize in the A.B.C.D/M format and the IP subnet.
21. Under the AS Set column, select Yes if applicable.
22. Under the Summary Only column, select the Yes checkbox to allow only the summarized route to be sent.
23. Add additional routes, if necessary, by selecting +Add. To Clone or Delete a Route Summarization, use the appropriate buttons, located next to +Add. The BGP Settings section displays the BGP configuration settings.
24. Select Save Changes when complete to save the configuration.
    Note: When users configure BGP settings for a profile, the configuration settings are automatically applied to the SD-WAN Edges associated with the profile.

Equal Cost Multi Path (ECMP) allows traffic with the same source and destination across multiple paths of Equal cost.

In large branches, connections with high throughput often requires supporting multiple 1G and 10G interfaces. Customers can use multiple interfaces for their LAN network to maximize throughput and resilience. These paths can be routed using BGP, OSPF, or static routing.

Note: All paths utilize a scale number of flows.

Before beginning, ensure that users enable DCC at the enterprise level before configuring ECMP.

To configure ECMP for Profiles, perform the following steps:

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
2. Select a Profile to configure the ECMP.
3. Configure the following settings in the ECMP section:

   Table 35. ECMP Settings - Options and Descriptions

   Option	Description
   Connectivity	In Connectivity, the administrator can choose the Interface parameter, the NSD parameter, or both. If users select the Interface option, the system enables ECMP for LAN interfaces. When users select NSD, the system activates ECMP functionality on the NSD side.
   Maximum Paths	Maximum number of paths used for load balancing. Paths must be in the range of 2 to 4. All the paths would be utilized with scale number of flows.
   Load Balancing	Hash Load Based Load Sharing Parameters takes input parameters from 5-tuple (Source IP, Destination IP, Source Port, Destination Port and Protocol). These inputs can be any or all or any subset of this tuple based on user configuration. It maps flow to the path based on the hash value with selected inputs. Default is 5-tuple parameters, but users can choose any number of parameters based on their requirements. Effectiveness of load balancing increases with increased number of flows. All the configured static routes install in FIB, but only first n (based on ECMP max path) routes will be selected for load balancing.

   The system supports ECMP in all the modes Active/Active, Active/Hotstandby, Active/Standby with only the Active tunnels used for load balancing.

VeloCloud SD-WAN allows network administrators to configure a community value for Connected, Static, Open Shortest Path First (OSPF), and Border Gateway Protocol (BGP) route prefixes that they advertise to the overlay. Network administrators can also modify the ASN value for route prefixes when they advertise these prefixes to the overlay.

1. In the SD-WAN service of the Enterprise portal, navigate to Configure > Profiles .
2. Click the Device icon next to a profile, or select a profile, then click the Device tab.
3. On the Device tab, scroll down to the Routing & NAT section and click the arrow next to the Overlay Route Control area to open it.
4. Move the Overlay Route Control slider to the ON position.

   

5. Configure the following settings, as described in the table.

   Table 36. Overlay Route Control - Options and Descriptions

   Field	Description
   Network Prefix	Select either IPv4, or IPv6, or both to set a community value and AS path action for route prefixes advertised to the overlay.
   Community	Enter a community value to append to all route prefixes advertised to the overlay. Users can enter both range and ratio values for Community. The allowable range is from 1 to 4294967295. Note:When advertising a BGP route to the overlay, the system appends the ORC community to the existing community values. If the route already contains 24 community values, the system does not append the ORC community. It logs an error message in Edge, indicating that it could not add the ORC community. Note:BGP configuration is not required to configure the ORC community. ORC Community configuration is applied only for BGP community and not for extended BGP community.
   AS Path Action	Select one of the following options: Carry Own AS Only - Carries only local BGP ASN to the overlay as part of the overlay advertisement. Default - Adds the Edge's ASN and sends it to the overlay for a route prefix. Note: Users must configure BGP settings to enable "Carry Own AS Only" as AS Path Action.

6. Click Save Changes.

   When the user configures Overlay Route Control capabilities for a profile, the settings automatically apply to the Edges associated with the profile. If required, the user can override the configuration for a specific Edge. See Configure Overlay Route Control for Edges for additional information.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the Profile link or select the View link in the Device column of the Profile.
   The Device tab displays the configuration options for the selected Profile.
3. Under Telemetry, go to the Visibility Mode area, and then select one of the following:
   • Visibility by MAC address
   • Visibility by IP address

   

   Note the following when choosing a Visibility mode:

   • For Visibility by MAC address mode:
     • Clients are behind L2 SW
     • Client MAC, IP and Hostname (if applicable) will appear
     • Stats are collected based on MAC
   • For Visibility by IP address mode:
     • Clients are behind L3 SW
     • SW MAC, Client IP and Hostname (if applicable) will appear
     • Stats are collected based on IP

   Note: Changes to Visibility mode are non-disruptive.
4. Select Save Changes.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
2. Select a Profile, then select the View link under the Device column.
3. Scroll down to the Telemetry area, and then expand SNMP.
4. Select either Enable Version 2c or Enable Version 3, or both SNMP version checkboxes.

   

5. Select Enable Version 2c checkbox to configure the following fields:

   Table 37. Enable Version2c - Options and Descriptions

   Option	Description
   Port	Type the port number in the textbox. The default value is 161.
   Community	Select Add to add any number of communities. Type a word or sequence of numbers as a password, to allow access to the SNMP agent. The password may include alphabet A-Z, a-z, numbers 0-9, and special characters (e.g. &, $, #, %). Note: Starting with the 4.5 release, the Orchestrator no longer supports the special character "<" in passwords. In cases where users have already used "<" in their passwords in previous releases, they must remove it to save any changes on the page. Users can also delete or clone a selected community. .
   Allow Any IPs	Select this checkbox to allow any IP address to access the SNMP agent. To restrict access to the SNMP agent, clear the checkbox, and then add the IP address(es) that must have access to the SNMP agent. Users can delete or clone a selected IP address.

    

6. Select the Enable Version 3 checkbox to provide additional security. Select Add to configure the following fields:

   Table 38. Enable Version 3 - Options and Descriptions

   Option	Description
   Name	Type an appropriate username.
   Enable Authentication	Select this checkbox to add extra security to the packet transfer.
   Authentication Algorithm	Select an algorithm from the drop-down menu: MD5 SHA1 SHA2: Only SNMP version 5.8 and above support this option. Note: Selecting the Enable Authentication checkbox activates this field.
   Password	Type an appropriate password. The Privacy Password must match the Authentication Password configured on the Profile. Note: Selecting the Enable Authentication checkbox activates this field. Starting with the 4.5 release, the Orchestrator no longer supports the special character "<" in passwords. In cases where users have already used "<" in their passwords in previous releases, they must remove it to save any changes on the page.
   Enable Privacy	Select this checkbox to encrypt the packet transfer.
   Algorithm	Choose a privacy algorithm from the drop-down menu: DES AES Note: Algorithm AES indicates AES-128. Note: Selecting the Enable Privacy checkbox activates this field.

   Note: Users can delete or clone the selected entry.

1. In the SD-WAN service of the Enterprise portal, select Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the Profile link or select the View link in the Device column of the Profile.
3. From the Configure Segment drop-down menu, select a profile segment to configure Syslog settings. The Orchestrator selects Global Segment [Regular] by default.
4. Under Telemetry, go to the Syslog area and configure the following details:

   

   1. From the Facility drop-down menu, select a Syslog standard value to define how the Syslog server categorizes Edge events. Choose a value between local0 and local7.
      Note: The Orchestrator allows configuration of the Facility field only for the Global Segment, regardless of the Profile’s Syslog settings. The other segments inherit the facility code value from the Global segment.
   2. Select the Enable Syslog checkbox.
   3. Select the + ADD button and configure the following details:

      Table 39. Syslog Settings - Options and Descriptions

      Option	Description
      IP	Enter the destination IP address of the Syslog collector.
      Protocol	Select either TCP or UDP as the Syslog protocol from the drop-down menu.
      Port	Enter the port number of the Syslog collector. The default value is 514.
      Source Interface	As Edge interfaces are not available at the Profile level, the Source Interface field is set to Auto. The Edge automatically selects an interface with 'Advertise' field set as the source interface.
      Roles	Select one of the following: EDGE EVENT FIREWALL EVENT EDGE AND FIREWALL EVENT
      Syslog Level	Select the required Syslog severity level. For example, a CRITICAL configuration prompts the Edge to send all events categorized as critical, alert, or emergency. The Orchestrator supports the following Syslog severity levels: EMERGENCY ALERT CRITICAL ERROR WARNING NOTICE INFO DEBUG Note: By default, the Orchestrator forwards firewall event logs with Syslog severity level INFO.
      Tag	Optionally, enter a tag for the syslog. The Syslog tag differentiates the various types of events at the Syslog Collector. The Orchestrator enforces a maximum length of 32 characters, delimited by a period.
      All Segments	When configuring a Syslog collector with FIREWALL EVENT or EDGE AND FIREWALL EVENT role, select the All Segments checkbox to receive firewall logs from all the segments. The Syslog collector receives firewall logs exclusively from its configured segment if the checkbox remains unselected. Note: When the role is EDGE EVENT, the Syslog collector configured in any segment receives Edge event logs by default.

       

5. Select the + ADD button to add another Syslog collector, or else select Save Changes.
   Note:

   • Configure a maximum of two Syslog collectors per segment and 10 Syslog collectors per Edge. When the number of configured collectors reaches the maximum allowable limit, the Orchestrator deactivates the + button.
   • Based on the selected role, the Edge exports the corresponding logs in the specified severity level to the remote syslog collector. Receiving auto-generated local events at the Syslog collector requires configuring the log.syslog.backend and log.syslog.upload system properties at the Orchestrator level.

   To understand the format of a Syslog message for Firewall logs, see Syslog Message Format for Firewall Logs.

Orchestrator allows users to activate Syslog Forwarding feature at the Profile and the Edge level. On the Firewall page of the Profile configuration, activate the Syslog Forwarding button to forward firewall logs originating from the Enterprise Edge to configured Syslog collectors.

Note: By default, the Firewall page of the Profile or Edge configuration provides the Syslog Forwarding button in an inactive state.

For additional information about Firewall settings at the Profile level, see Configure Profile Firewall.

Secure Syslog Forwarding Support

The 5.0 release supports secure syslog forwarding capability. Federal certifications and large enterprise hardening standards require secure Syslog forwarding. The secure syslog forwarding process begins with a TLS-capable syslog server. Currently, the Orchestrator allows forwarding logs to a syslog server that supports TLS. The 5.0 release allows the Orchestrator to control syslog forwarding and to perform default security checks, such as hierarchical PKI verification and CRL validation. Moreover, it allows customizing the security of forwarding by defining supported cipher suites, disallowing self-signed certificates, etc.

Secure Syslog forwarding also relies on the method used to collect or integrate revocation information. The Orchestrator now allows an Operator to enter the revocation information, either manually or through an external process. The Orchestrator retrieves CRL information to verify forwarding security before establishing any connections. In addition, the Orchestrator fetches that CRL information regularly and uses it when validating the connection.

System Properties

Secure syslog forwarding begins with configuring the Orchestrator syslog forwarding parameters to allow it to connect with a syslog server. To do so, the Orchestrator accepts a JSON formatted string to accomplish the following configuration parameters, configured in System Properties.

Configure the following system properties:

• log.syslog.backend: Backend service syslog integration configuration
• log.syslog.portal: Portal service syslog integration configuration
• log.syslog.upload: Upload service syslog integration configuration

When configuring system properties, use the following Secure Syslog Configuration JSON string:

• config <Object>
  • enable: <true> <false> Activate or Deactivate Syslog forwarding. This parameter controls overall syslog forwarding, even when secure forwarding remains active.
  • options <Object>
    • host: <string> The host running syslog, defaults to localhost.
    • port: <number> The port on the host that syslog is running on, defaults to syslog's default port.
    • protocol: <string> tcp4, udp4, tls4. Note: (tls4 allows secure syslog forwarding with default settings. To configure it, see the following secure Options object.
    • pid: <number> PID of the process that log messages coming from (Default process.pid).
    • localhost: <string> Host to indicate that log messages are coming from (Default: localhost).
    • app_name: <string> The name of the application (node-portal, node-backend, etc) (Default: process.title).
  • secureOptions <Object>
    • disableServerIdentityCheck: <boolean> Optionally skipping SAN check while validating, i.e. can be used if the server's certification does not have a SAN for self-signed certificates. Default false.
    • fetchCRLEnabled: <boolean> If not false, the Orchestrator fetches CRL information embedded within the provided CAs. Default: true
    • rejectUnauthorized: <boolean> If not false, the Orchestrator applies hierarchical PKI validation against the list of supplied CAs. Default: true. (Orchestrator uses this mostly for testing purposes. Do not use it in production.)
    • caCertificate: <string> The Orchestrator can accept a string that contain PEM formatted certificates to optionally override the trusted CA certificates (can contain multiple CRLs in openssl friendly concatenated form). Default is to trust the well-known CAs curated by Mozilla. This option allows accepting a local CA governed by the entity, for instance, for On-prem customers who have their own CAs and PKIs.
    • crlPem:<string> The Orchestrator can accept a string that contains PEM formatted CRLs (can contain multiple CRLs in openssl friendly concatenated form). This option allows the acceptance of locally stored CRLs. If fetchCRLEnabled is set true, the Orchestrator combines this information with fetched CRLs. Use this option for a specific scenario where certificates do not have CRLDistribution point information in it.
    • crlDistributionPoints: <Array> The Orchestrator can optionally accept an array CRL distribution points URI in "http" protocol. The Orchestrator does not accept any "https" URI.
    • crlPollIntervalMinutes: <number> if fetchCRLEnabled is not set to false, the Orchestrator polls CRLs every 12 hours. However, this parameter can optionally override this default behavior and update CRL according to provided number.

Configuring Secure Syslog Forwarding Example

The Orchestrator has the following system property options to arrange described parameters to allow secure syslog forwarding.

Note: Modify the below example according to the trust of chain structure.

{"enable": true,"options": {"appName": "node-portal","protocol":
                                "tls","port": 8000,"host": "host.docker.internal","localhost":
                                "localhost"},"secureOptions": {"caCertificate": "-----BEGIN
                                CERTIFICATE-----MIID6TCCAtGgAwIBAgIUaauyk0AJ1ZK/U10OXl0GPGXxahQwDQYJKoZIhvcNAQELBQAwYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ8wDQYDVQQHDAZ2bXdhcmUxDzANBgNVBAoMBnZtd2FyZTEPMA0GA1UECwwGdm13YXJlMREwDwYDVQQDDAhyb290Q2VydDAgFw0yMTA5MjgxOTMzMjVaGA8yMDczMTAwNTE5MzMyNVowYDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ8wDQYDVQQHDAZ2bXdhcmUxDzANBgNVBAoMBnZtd2FyZTEPMA0GA1UECwwGdm13YXJlMREwDwYDVQQDDAhyb290Q2VydDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwG+Xyp5wnoTDxpRRUmE63DUnaJcAIMVABm0xKoBEbOKoW0rnl3nFu3l0u6FZzfq+HBJwnOtrBO0lf/sges2/QeUduCeBC/bqs5VzIRQdNaFXVtundWU+7Tn0ZDKXv4aRC0vsvjejU0H7DCXLg4yGF4KbM6f0gVBgj4iFyIjcy4+aMsvYufDV518RRB3MIHuLdyQXIe253fVSBHA5NCn9NGEF1e6Nxt3hbzy3Xe4TwGDQfpXx7sRt9tNbnxemJ8A2ou8XzxHPc44G4O0eN/DGIwkP1GZpKcihFFMMxMlzAvotNqE25gxN/O04/JP7jfQDhqKrLKwmnAmgH9SqvV0F8CAwEAAaOBmDCBlTAdBgNVHQ4EFgQUSpavxf80w/I3bdLzubsFZnwzpcMwHwYDVR0jBBgwFoAUSpavxf80w/I3bdLzubsFZnwzpcMwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2xvY2FsaG9zdDo1NDgzL2NybFJvb3QucGVtMA0GCSqGSIb3DQEBCwUAA4IBAQBrYkmg+4x2FrC4W8eU0S62DVrsCtA26wKTVDtor8QAvi2sPGKNlv1nu3F2AOTBXIY+9QV/Zvg9oKunRy917BEVx8sBuwrHW9IvbThVk+NtT/5fxFQwCjO9l7/DiEkCRTsrY4WEy8AW1CcaBwEscFXXgliwWLYMpkFxsNBTrUIUfpIR0Wiogdtc+ccYWDSSPomWZHUmgumWIikLue9/sOvV9eWy56fZnQNBrOf5wUs0suJyLhi0hhFOAMdEJuL4WnYthX5d+ifNon8ylXGO6cOzXoA0DlvSmAS+NOEekFo6R1Arrws0/nk6otGH/Be5+/WXFmp0nzT5cwnspbpA1seO-----END
                                CERTIFICATE-----","disableServerIdentityCheck":
                                true,"fetchCRLEnabled":true,"rejectUnauthorized":
                                true,"crlDistributionPoints":
                                http://cacerts.digicert.com/DigiCertTLSHybridECCSHA3842020CA1-1.crt

To configure syslog forwarding, see the following JSON object as an example image:

If the configuration is successful, the Orchestrator produces the following log and begins forwarding:

[portal:watch] 2021-10-19T20:08:47.150Z - info: [process.logger.163467409.0] [660] Remote Log has been successfully configured for the following options {"appName":"node-portal","protocol":"tls","port":8000,"host":"host.docker.internal","localhost":"localhost"}

Secure Syslog Forwarding in FIPS Mode

Activating FIPS mode for secure syslog forwarding causes the system to reject connections with servers that lack the following cipher suites:

TLS_AES_256_GCM_SHA384:
TLS_AES_128_GCM_SHA256:
ECDHE-RSA-AES256-GCM-SHA384:
ECDHE-RSA-AES128-GCM-SHA256.

Regardless of FIPS mode, the system rejects the connection if the syslog server certificate lacks the "ServerAuth" attribute in its extended key usage field.

Constant CRL Information Fetching

If fetchCRLEnabled is not set to false, the Orchestrator regularly updates the CRL information every 12 hours via the backend job mechanism. The Orchestrator stores the fetched CRL information in the corresponding system property log.syslog.lastFetchedCRL.{serverName}. The Orchestrator checks this CRL information during every connection attempt to the syslog server. If an error occurs during the fetching, the Orchestrator generates an Operator event.

Setting fetchCRLEnabled to true activates three additional system properties to track the CRL status: log.syslog.lastFetchedCRL.backend, log.syslog.lastFetchedCRL.portal, log.syslog.lastFetchedCRL.upload, as shown in the image below. This information displays the last updated time of the CRL and CRL information.

Logging

If the option fetchCRLEnabled is set to true, the Orchestrator tries to fetch the CRLs. If an error occurs, the Orchestrator raises an event and displays it on the Operator Events page.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the Profile link or select the View link in the Device column of the Profile. Alternatively, select a Profile and select Modify to configure the Profile.
   The Device tab displays the configuration options for the selected Profile.
3. From the Segment drop-down menu, select a profile segment to configure NetFlow settings.
4. Scroll down to the Telemetry category and select the NetFlow Settings area to configure NetFlow details.

   

   1. Select the Activate NetFlow checkbox.
      Note: The Orchestrator supports IP Flow Information Export (IPFIX) protocol version 10.
   2. From the Collector drop-down menu, select an existing NetFlow collector to export IPFIX information directly from Edge, or select + New Collector to configure a new NetFlow collector. For additional information about how to add a new collector, see Configure NetFlow Settings.
      Note:

      • Configure a maximum of two collectors per segment and eight collectors per profile by selecting the + ADD button. When the number of configured collectors reaches the maximum allowable limit, the + ADD button will be deactivated.
      • The Orchestrator supports only NetFlow version 10.
   3. From the Filter drop-down menu, select an existing NetFlow filter for the traffic flows from Edge, or select + New Filter to configure a new NetFlow filter. For additional information about how to add a new filter, see Configure NetFlow Settings.
      Note: Configure a maximum of 16 filters per collector by selecting the + button. The system implicitly adds the Allow All filtering rule to the end of each collector’s filter list.
   4. Select the Allow All checkbox corresponding to a collector to allow all segment flows to that collector.
5. Under Intervals, configure the following NetFlow export intervals:
   • Flow Stats - Export interval for flow stats template, which exports flow statistics to the collector. By default, the system exports NetFlow records of this template every 60 seconds. The allowable export interval is 60 to 300 seconds.
   • FlowLink Stats - Export interval for the flow link stats template, which exports flow statistics per link to the collector. By default, the system exports NetFlow records of this template every 60 seconds. The allowable export interval is 60 to 300 seconds.
   • Segment Table - Export interval for the Segment option template, which exports segment-related information to the collector. The default export interval is 300 seconds. The allowable export interval is 60 to 300 seconds.
   • Application Table - Export interval for the Application option template, which exports application information to the collector. The default export interval is 300 seconds. The allowable export interval is 60 to 300 seconds.
   • Interface Table - Export interval for the Interface option template, which exports interface information to the collector. The default export interval is 300 seconds. The allowable export interval is 60 to 300 seconds.
   • Link Table - Export interval for Link option template, which exports link information to the collector. The default export interval is 300 seconds. The allowable export interval is 60 to 300 seconds.
   • Tunnel Stats - Export interval for tunnel stats template. By default, the system exports statistics for active tunnels on the Edge every 60 seconds. The allowable export interval is 60 to 300 seconds.
   In an Enterprise, configure the NetFlow intervals for each template only on the Global segment. The configured NetFlow export interval is applicable for all collectors of all segments on an Edge. For additional information on IPFIX templates, see IPFIX Templates.
6. Select Save Changes.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the Profile link or select the View link in the Device column of the Profile.
   The Device tab displays the configuration options for the selected Profile.
3. Scroll down to the Edge Services category, and then select Authentication.

   

4. Select the desired RADIUS server for authentication from the RADIUS Server drop-down menu.
   Note: The RADIUS Server drop-down menu displays all servers previously configured via the Authentication Services feature on the Network Services page. Alternatively, configure a new authentication service by selecting the New Radius Service button. For instructions on how to configure Authentication Services, refer to Configure Authentication Services.
5. Select Save Changes.

The Network Time Protocol (NTP) provides the mechanisms to synchronize time and coordinate time distribution in a large, diverse network. Arista VeloCloud recommends using NTP to synchronize the system clocks of Edges and other network devices.

1. In the SD-WAN service of the Enterprise portal, go to Configure > Profiles .
   The Profiles page displays the existing Profiles.
2. Select the Profile link or select the View link in the Device column of the Profile.
   The Device tab displays the configuration options for the selected Profile.
3. Configure the Edge's own time sources by defining Private NTP Servers. These servers can be either known time sources within user's own network, or well-known time servers on the Public Internet, if they are reachable from the Edge. To define Private NTP Servers:
   1. Scroll down to the Edge Services category, and then go to the NTP area.

      

   2. Select the Private NTP Servers checkbox.
   3. In the Servers area, select +Add and enter the IP address of the Private NTP Server. For an active DNS configuration, use a domain name instead of an IP address. To configure another NTP Server, select the +Add button again.
      Arista strongly recommends to add two or three servers to increase availability and accuracy of time setting. Without Private NTP Servers, the Edge attempts to synchronize time with a default set of public NTP servers. However, this requires successful communication with the public Internet.
      Note: Defining Private NTP Servers allows the Orchestrator to activate the Edge as an NTP Server for its clients.
      The system sets the Source Interface field to Auto because Edge interfaces are unavailable at the Profile level. The Edge automatically selects an interface with 'Advertise' field set as the source interface.
4. Defining Private NTP Servers enables the Orchestrator to configure the Edge as an NTP Server for its clients.
   1. Select the Edge as NTP Server checkbox. The checkbox is available only after the activation of at least one Private NTP Server.
   2. Choose the type of NTP Authentication as either None or MD5.
   3. For MD5, configure the NTP authentication key value pair details by selecting the +Add button under the Keys area.
5. Select Save Changes.
   The Orchestrator applies the NTP configuration settings to the selected Profile.