印刷

VeloCloud SD-WAN 7.0 - Administration Guide - Configure Segments 印刷

Configure Segments

Network segmentation partitions a network into distinct logical sub-networks—or segments—by applying isolation techniques on forwarding devices such as switches, routers, and firewalls. By isolating traffic based on organization or data type, the system ensures more secure, efficient, and granular data transmission.

In a segment-aware topology, users can apply tailored Virtual Private Network (VPN) profiles to each segment. For instance:
  • Guest Traffic - Backhaul to remote data center firewall services.
  • Voice Media - Leverage dynamic branch-to-branch tunnels for optimized performance.
  • PCI Segments - Rout directly to a central data center to ensure secure exit through a compliant PCI gateway.
To configure the Segments using the new Orchestrator UI, use the following steps:
  1. In the Enterprise portal, select Open New Orchestrator UI.
  2. Select Launch New Orchestrator UI.
  3. The UI opens in a new tab, displaying the Monitoring and Configuration options.

In the new Orchestrator UI, select the Configure tab.

Note: If users do not see the Configure tab, contact the Operator.
  1. Select Configure > Segments .
  2. The Segments page displays the existing Segments.
    Figure 1. Configure Segments
  3. Select Add to add a new Segment and configure the following details:
    Table 1. New Segment Option Descriptions
    Option Description
    Segment Name Enter a name for the Segment with a maximum of 256 characters.
    Description Enter a descriptive text for the Segment with a maximum of 256 characters.
    Type Choose the Segment type as one of the following:
    • Regular- The standard segment type.
    • Private- Used for traffic flows that require limited visibility in order to address end user privacy requirements.
    • CDE- VeloCloud provides a PCI-certified SD-WAN service. The Cardholder Data Environment (CDE) type is used for traffic flows that require PCI and want to leverage the VeloCloud PCI certification.
    Note: For the Global Segment, users can set the type eitherRegular or Private. For non-global segments, the type can be Regular, CDE, or Private.
    Service VLAN Enter the service VLAN identifier. For additional information, see Define Mapping Segments with Service VLANs.
    Delegate to Partner Selected by default. If users deselect it, the Partner cannot change the configurations within the segment, including the Interface assignment.
    Delegate to Customer Selected by default. Deselecting this checkbox prevents the Customer from changing configurations within the segment, including the Interface assignment.

     

  4. Select Save Changes.
When users configure the segment as Private, then the segment has the following properties:
  • Does not upload user flow statistics to Orchestrator, except for VeloCloud Control, VeloCloud Management, and a single IP flow that tracks all transmitted and received packets and bytes sent on the segment. For example, Customer flow statistics, such as Source IP and Destination IP, do not display in the Monitor tab for flows related to the Private segment.
  • Does not allow users to view flows in Remote Diagnostics.
  • The Edge does not allow Internet Multipath traffic. It automatically overrides all business policies set to Internet Multipath and changes them to Direct.

When users configure a segment as CDE, the hosted Orchestrator and Controller recognize the PCI segment and fall within the PCI scope. Non-CDE Gateways remain unaware of PCI traffic and do not transmit it, placing them outside the PCI scope.

To remove a Segment, select the Segment and then Delete. Users cannot delete a Segment used by a Profile.

..