Overview

Overview

VeloCloud SD-WAN enables enterprises and service providers to utilize multiple WAN transports simultaneously. By aggregating diverse links, the solution increases available bandwidth and ensures consistent application performance for both on-premises and cloud-based (SaaS/IaaS) environments.

The platform leverages a Cloud-Delivered architecture to construct a secure overlay network using multiple tunnels. This architecture continuously monitors and adapts to WAN transport fluctuations in real time.

Dynamic Multipath Optimization (DMPO)

The following diagram depicts a typical SD-WAN deployment with Multi Cloud Non SD-WAN Destinations.

Key Functionalities

Continuous Monitoring

Automated Bandwidth Discovery- After the VeloCloud Edge detects a WAN link, it immediately initiates the Automated Bandwidth Discovery process to calibrate the link for optimal performance.

Hub and Headend Configurations

Continuous Path Monitoring

Dynamic Multipath Optimization (DMPO) performs continuous, unidirectional measurements of performance metrics-loss, latency, and jitter of every packet, on every tunnel between any two DMPO endpoints, Edge or Gateway.

Per-Packet Steering

VeloCloud SD-WAN utilizes per-packet steering to make independent routing decisions for both uplink and downlink directions. This granular control allows the system to optimize performance without introducing asymmetric routing issues.

Monitoring Methodologies

These comprehensive measurements allow DMPO to react instantly to fluctuating WAN conditions. By constantly evaluating link health, the system delivers sub-second protection against sudden outages or drops in bandwidth capacity.

MPLS Class of Service (CoS)- When users deploy a private link with a CoS agreement, configure DMPO to incorporate CoS tags into monitoring and application steering decisions. By recognizing these tags, the system ensures that the provider priority queues align with the SD-WAN routing logic.

Dynamic Application Steering

Application-aware Per-packet Steering - Dynamic Multipath Optimization (DMPO) identifies traffic using Layer 2 through Layer 7 attributes, such as VLAN, IP address, protocol, and specific applications. VeloCloud SD-WAN performs per-packet steering based on business policy configurations and real-time link conditions.

The system includes Smart Defaults out-of-the-box, which pre-configure steering behavior and priorities for more than 2,500 applications. This allows users to leverage dynamic steering and prioritization immediately without manually defining policies.

VeloCloud SD-WAN provides sub-second protection against both conditions. By continuously monitoring all WAN links, DMPO detects an SLA failure or outage within 300–500 ms. It immediately steers the flow to a healthy link to maintain performance. Once the link stabilizes, the system observes a one-minute hold time before steering the traffic back to the preferred link.

Real World Example - Skype for Business

For example, two 50 Mbps links deliver 100Mbps of aggregated capacity for a single traffic flow and applies QoS at both the aggregate and individual link level.

If a site has two 50 Mbps links, DMPO can aggregate them to deliver 100 Mbps of total capacity for a single traffic flow. This ensures that a single large file transfer can consume the combined bandwidth of all transports rather than being limited to the speed of one link.

On-demand Remediation

Error and Jitter Correction - In a scenario where it may not be possible to steer the traffic flow onto the better link, such as a single link deployment, or multiple links with issues at the same time, DMPO can enable error corrections for the duration of the WAN link issues. The type of error corrections used depends on the type of applications and the type of errors.

Real-time applications such as voice and video flows can benefit from Forward Error Correction (FEC) when packet loss occurs. DMPO automatically enables FEC on single or multiple links. With multiple links, DMPO selects up to two of the best links at any given time for FEC. Duplicated packets are discarded and out-of-order packets are re-ordered at the receiving end before delivering to the final destination.

DMPO enables jitter buffer for the real-time applications when the WAN links experience jitter. TCP applications such as file transfer benefit from Negative Acknowledgement (NACK). Upon the detection of a missing packet, the receiving DMPO endpoint informs the sending DMPO endpoint to retransmit the missing packet. Doing so protects the end applications from detecting packet loss and, as a result, maximizes TCP window and delivers high TCP throughput even during lossy condition.

Orchestrator monitors and measures the link SLA (loss, latency, jitter) on a periodic basis and FEC (packet duplication) activates upon threshold violation for real-time traffic using different values for voice and video applications.

In a single WAN link scenario, duplicate packets transmit on the same link adjacent to one another. Since packet drops due to congestion are random, it is statistically unlikely that two adjacent packets drop, greatly increasing the likelihood that one of the packets makes it to the destination. The replicated packets are sent on separate links in the case of two or more WAN links.

Adaptive FEC triggers on a per-flow basis in real-time based on measured packet loss thresholds, and disabled in real-time after the packet loss no longer exceeds the activation threshold. This ensures that the network efficiently uses available bandwidth , avoids unnecessary packet duplication, and reducesresource overhead. The VeloCloud Adaptive FEC approach ensures minimal or elimination of the effect of packet loss on the transport network on end-user devices. When end-user devices do not see packet drops, the devices avoid retransmissions and TCP congestion avoidance mechanisms like slow start, which can negatively impact overall throughput, application performance, and end-user experience.

DMPO Real World Results

Scenario 1 - A Branch-to-Branch VoIP call uses a single link. The results in the figure demonstrate the benefits of on-demand remediation using FEC and jitter remediation on a single Internet link with traditional WAN and VeloCloud SD-WAN. A mean opinion score (MOS) of less than 3.5 is unacceptable quality for a voice or video call.

Scenario 2- TCP Performance with and without VeloCloud SD-WAN for Single and Multiple Links. These results show how NACK enables per-packet load balancing.

Scenario 3- Hybrid WAN scenario with an outage on the MPLS link and both jitter and loss on the Internet link. These results show how DMPO protects applications from sub-second outages by steering the traffic to Internet links and enabling on-demand remediation on the Internet link.

Business Policy Framework and Smart Defaults

The business policy lets the IT administrator control QoS, steering, and services for the application traffic. Smart Defaults provides a ready-made business policy that supports over 2500 applications. DMPO makes steering decisions based on the type of application, real time link condition (congestion, latency, jitter, and packet loss), and the business policy.

Each application has a category. Each category has a default action, which is a combination of Business Priority, Network Service, Link Steering, and Service Class. Users can also define custom applications.

Each application has a Service Class: Real Time, Transactional, or Bulk. The Service Class determines how DMPO handles the application traffic. Users cannot change the Service Class for the default applications, but can specify it for their own custom applications.

Each application also has a Business Priority: High, Normal, or Low. The Business Priority determines how DMPO prioritizes and applies QoS to the application traffic. Users can change the Business Priority for any application.

Link Steering Abstraction With Transport Group

Across different branch and hub locations, there may be different models of the VeloCloud Edge with different WAN interfaces and carriers. In order to enforce the centralized link steering policy using Profile, it is important that the interfaces and carries are abstracted. Transport Group provides the abstraction of the actual interfaces of the devices and carriers used at various locations. The business policy at the Profile level can be applied to the Transport Group instead, while the business policy at the individual Edge level can be applied to Transport Group, WAN Link (carrier), and Interfaces.

Link Steering by Transport Group

Different locations may have different WAN transports, such as a WAN carrier name or a WAN interface name, DMPO uses the concept of transport group to abstract the underlying WAN carriers or interfaces from the business policy configuration. The business policy configuration can specify the transport group as public wired, public wireless, or private wired, in the steering policy so that the same business policy configuration applies across different device types or locations which may have completely different WAN carriers and WAN interfaces. When the DMPO performs the WAN link discovery, it also assigns the transport group to the WAN link. This is the most desirable option for specifying the links in the business policy because it eliminates the need for IT administrators to know the physical connectivity or WAN carrier.

Link Steering by Interface

The link steering policy can be applied to the interface, for example, GE2 or GE3, which differs depending on the Edge model and the location. This is the least desirable option to use in the business policy because IT administrators must be fully aware of the Edge connectivity to specify the interface to use.

Link Steering and On-demand Remediation

There are four possible options for Link Steering – Auto, Preferred, Mandatory, and Available.

Link Selection Mandatory– Pin the traffic to the link or the transport group. The traffic never steers away regardless of the condition of the link including outage. On-demand remediation triggers to mitigate brownout condition such as packet loss and jitter.

For example, Netflix has a low priority for the application and requires staying on the public wired links at all times.

The default behavior of treating a private link with reference to a preferred link (i.e., that a preferred linkonly redirects to a private link if the preferred link is unstable or offline) is configurable through a setting on the Orchestrator UI.

Link Selection Available– This option picks the available link as long as it is up. DMPO enables on-demand remediation if the link fails to meet the SLA. DMPO does not redirect the application flows to another link unless the link is down.

Example - Web traffic is backhauled over the Internet link to the hub site using the Internet link as long as it is active, regardless of SLA.

Link Selection Auto – By default, DMPO automatically picks the best links based on the type of application and enables on-demand remediation when needed. There are four possible combinations of Link steering and On-demand Remediation for Internet applications. Traffic within the enterprise (VPN) always goes through the DMPO tunnels, so it always receives the benefits of on-demand remediation.

The below examples explain the default DMPO behavior for different type of applications and link conditions. Please see the appendix section for the default SLA for different application types.

Example: Transactional and bulk applications. Enables NACK if packet loss exceeds the threshold that is acceptable per application type (see the appendix for this value).

Secure Traffic Transmission

DMPO encrypts both the payload and the tunnel header with IP sec transport mode end-to-end for private or internal traffic. The payload contains the user traffic. DMPO supports AES128 and AES256 for encryption. It uses the PKI and IKEv2 protocols for IP sec key management and authentication.

Protocols and Ports

Appendix- QoE threshold and Application SLA

DMPO uses the SLA threshold below for different types of applications. It immediately takes action to redirect the affected application flows or perform on-demand remediation when the WAN link condition exceeds one or more thresholds. Packet loss is calculated by dividing the number of lost packets by the total packets in the last 1-minute interval. The DMPO endpoints communicate the number of lost packets every second. The QoE report also reflects this threshold.

DMPO also takes action immediately when it loses communications (no user data or probes) within 300 ms.

Beginning in Release 5.2.0, users have the capability to modify the threshold values for latency for video, voice, and transactional traffic types through a Customizable QoE feature. This means that customers can include high latency links as part of the selection process and the Orchestrator applies the new values to the QoE monitoring page.

VeloCloud Edge

A thin “Edge” with zero IT touch provisioned from the cloud for secured, optimized connectivity to applications and virtual services. Edges are zero-touch, enterprise-class devices or virtual software that provide secure and optimized connectivity to private, public, and hybrid applications and compute and virtual services. Edges perform deep application recognition, application and per-packet steering, on-demand remediation performance metrics, and end-to-end Quality of Service (QoS) in addition to hosting Virtual Network Function (VNF) services. An Edge pair deployment provides High Availability (HA). Users can deploy Edges in branches, large sites, and data centers. All other network infrastructure is available on demand in the cloud.

VeloCloud Orchestrator

Host the VeloCloud Orchestrator and provide centralized enterprise-wide configuration and real-time monitoring. It also orchestrates the data flow into and through the SD-WAN overlay network and provides one-click provisioning of virtual services across Edges.

VeloCloud Gateways

The VeloCloud SD-WAN network consists of Gateways, providing SD-WAN services to the doorstep of SaaS, IaaS, and cloud network services and access to private backbones. Arista VeloCloud SD-WAN deploys multi-tenant, virtual Gateways. The Gateways provide the advantage of an on-demand, scalable, and redundant cloud network for optimized paths to cloud destinations and zero-installation applications.

For additional information about the VeloCloud Gateways functionality and resiliency, see Arista.

Introduction

The tests represent common deployment scenarios to provide recommendations for most deployments. The test data herein does not provide either all-inclusive metrics or performance or scale limits. In certain implementations, the observed performance exceeds the test results, and in other specific services, extremely small packet sizes, or other factors can reduce performance below the test results.

Customers are welcome to perform independent tests, and results could vary. However, recommendations based on these test results are adequate for most deployments.

VeloCloud Edge

Arista VeloCloud SD-WAN Edges are zero-touch, enterprise-class appliances that provide secure, optimized connectivity for private, public, and hybrid applications and compute and virtual services. VeloCloud Edges perform deep application recognition of traffic flows, performance metrics measurements of underlay transport, and end-to-end service quality by applying packet-based link steering and on-demand application remediation, in addition to supporting other virtual network services.

Throughput Performance Test Topologies

Test Methodology

This subsection details the performance and scale test methodology used to derive the results.

Performance Test Methodology

Test Results

VeloCloud Edge Performance and Scale Results

Performance metrics are based on the Test Methodology detailed earlier.

Switched Port Performance: Arista designed VeloCloud Edges to be deployed as gateway routers between the LAN and the WAN. However, the Edges also provide the flexibility of meeting a variety of other deployment topologies. For example, configure SD-WAN Edges with interfaces to operate as switched ports—allowing the switching of LAN traffic between various LAN interfaces without the need for an external device.

Platform Independent Edge Scale Numbers

The Edge Scale numbers listed in the following table provide platform independent information and valid for all Edge models, both hardware and virtual.

Virtual Edge

Public Cloud

*Values captured with ENAv2.

Use of DPDK on VeloCloud Edges

To improve packet throughput performance, VeloCloud Edges utilizes Data Plane Development Kit (DPDK) technology. DPDK uses a set of data plane libraries and drivers provided by Intel for offloading TCP packet processing from the operating system kernel to processes running in user space and resulting in higher packet throughput. For additional details, see https://www.dpdk.org/.

Edge hardware models 620 and higher, and all virtual Edges, use DPDK by default on the routed interfaces. Edges do not use DPDK on the switched interfaces. A user cannot activate or deactivate DPDK for an Edge interface.

Dynamic Multi-path Optimization

VeloCloud SD-WAN Dynamic Multi-path Optimization comprises automatic link monitoring, dynamic link steering, and on-demand remediation.

Link Steering and Remediation

Dynamic, application-aware per-packet link steering performs automatically based on the business priority of the application, embedded knowledge of the its network requirements, and the real-time capacity and performance of each link. On-demand mitigation of individual link degradation through forward error correction, jitter buffering, and negative acknowledgment proxy also protects the performance of priority and network-sensitive applications. The dynamic per-packet link steering and on-demand mitigation combine to deliver robust, sub-second blocking, and limited protection improving application availability, performance, and end-user experience.

Cloud VPN

Cloud VPN is a one-click, site-to-site, VPNC-compliant, IPsec VPN that connects VeloCloud SD-WAN and non-SD-WAN destinations delivering real-time status and the health of the sites. The Cloud VPN establishes dynamic edge-to-edge communication for all branches based on service-level objectives and application performance. Cloud VPN also delivers secure connectivity across all branches with PKI scalable key management. New branches join the VPN network automatically with access to all resources in other branches, enterprise data centers, and 3rd party data centers, like Amazon AWS.

Firewall

VeloCloud SD-WAN delivers a stateful and context-aware (application, user, device) integrated application-aware firewall with granular control of sub-applications, supporting protocol-hopping applications, such as Skype and other peer-to-peer applications. For example, turn off Skype video and chat, but leave Skype audio enabled. The secure firewall service is user- and device OS-aware and can separate voice, video, data, and compliance traffic. On the corporate network, users can easily control the policies for BYOD devices such as Apple iOS, Android, Windows, and Mac OS.

Network Service Insertion

The VeloCloud SD-WAN Solution supports a platform to host multiple virtual network functions to eliminate single-function appliances and reduce branch IT complexity. VeloCloud SD-WAN service-chains traffic from the branch to cloud-based and enterprise regional hub services, with assured performance, security, and manageability. Branches leverage consolidated security and network services, including those from partners like Zscaler and Websense. Users can insert services in the cloud and on-premise with application-specific policies using a simple click-to-enable interface.

Activation

Edge appliances automatically authenticate, connect, and receive configuration instructions after theyconnect to the Internet in a zero-touch deployment. They deliver a highly available deployment with Edge redundancy protocol and integrate with the existing network with support for Open Shortest Path First (OSPF) and Border Gateway Protocol (BGP) routing protocols, leveraging benefits from dynamic learning and automation.

Overlay Flow Control

The Edge learns routes from adjacent routers through OSPF and BGP. It sends the learned routes to the Gateway/Controller. The Gateway/Controller acts like a route reflector and sends the learned routes to other Edge. The Overlay Flow Control (OFC) facilitates enterprise-wide route visibility and control allowing for easy programming for full and partial overlay.

OSPF

VeloCloud SD-WAN supports inbound/outbound filters to OSPF neighbors, OE1/OE2 route types, and MD5 authentication. Routes learned through OSPF automatically redistribute to the Controller hosted in the cloud or on-premises.

BGP

VeloCloud SD-WAN supports inbound and outbound filters set to Deny or optionally add or change the BGP attribute to influence path selection including RFC 1998 community, MED, AS-Path prepends, and local preference.

Segmentation

Network segmentation is an important feature for both enterprises and service providers. In the most basic form, segmentation provides network isolation for management and security reasons. The most common forms of segmentation are VLANs for L2 and VRFs for L3.

Typical Use Cases for Segmentation:

• Line of Business Separation - Engineering, HR, etc., for Security/Audit.
• User Data Separation - Guest, PCI, and Corporate traffic separation.
• Enterprise uses overlapping IP addresses in different VRFs.

However, the previous approach is limited to a single box or two physically connected devices. To extend the functionality, segmentation information must be carried across the network.

VeloCloud SD-WAN offers end-to-end segmentation. When the packet traverses through the Edge, Orchestrator adds the Segment ID to the packet and forwards it to the Hub and cloud Gateway, allowing network service isolation from the Edge to the cloud and data center. This allows prefixes to be grouped into a unique routing table, making the business policy segment aware.

Routing

In Dynamic Routing, Edge learns routes from adjacent routers through OSPF or BGP. The Orchestrator maintains all the dynamically learned routes in a global routing table called the Overlay Flow Control (OFC). The Overlay Flow Control allows management of dynamic routes in the case of "Overlay Flow Control sync" and "change in Inbound/Outbound filtering configuration." The change in inbound filtering for a prefix from IGNORE to LEARN would fetch the prefix from the Overlay Flow Control and install it into the Unified routing table.

For additional information, see Configure Dynamic Routing with OSPF or BGP.

Business Policy Framework

Quality of Service (QoS), resource allocations, link/path steering, and error correction automatically apply based on business policies and application priorities. Orchestrate traffic based on transport groups defined by private and public links, policy definition, and link characteristics.

Branches to Private Third Party (VPN)

Customers with a private data center or cloud data center often want a way to include it in their network without defining a tunnel from each individual branch office site to the data center. By defining the site as a Non SD-WAN Destination, a single tunnel builds from the nearest Gateway to the customer’s existing router or firewall. All of the Edges that talk to the site connect to the same Gateway to forward packets across the tunnel, simplifying the overall network configuration and new site initiation.

Arista simplifies the branch deployment and delivers enterprise great application performance or public/private link for cloud and/or on-premise applications.

Data Center Network Topology

The Data Center Network topology consists of two hubs and multiple branches, with or without an Edge. Each hub has hybrid WAN connectivity with several branch types. The MPLS network runs BGP and peers with all the CE routers. At Hub 1, Hub 2, and Silver 1 sites, the L3 switch runs OSPF, or BGP with the CE router and firewall in case of hub sites.

In some cases, there may be redundant data centers which advertise the same subnets with different costs. In this scenario, both data centers can be configured as Edge-to-Edge VPN hubs. Since all edges connect directly to each hub, the hubs in fact also connect directly to each other. Based on route cost, traffic redirects to the preferred active data center.

In previous versions, users could create an enterprise object using Zscaler or Palo Alto Networks as a generic Non SD-WAN Destination. In 4.0 version, that object now becomes a Non SD-WAN Destination.

The Cloud-Delivered solution of Arista combines the economics and flexibility of the hybrid WAN with the deployment speed and low maintenance of cloud-based services. It dramatically simplifies the WAN by delivering virtual services from the cloud to branch offices. Arista customer-premise equipment, the Edge, aggregates multiple broadband links such as Cable, DSL, 4G-LTE, at the branch office and sends the traffic to Gateways. Using cloud-based orchestration, the service can connect the branch office to anydata center, including enterprise, cloud, or Software-as-a-Service (SaaS) data centers.

Edge consists of a compact, thin Edge device with zero-IT-touch provisioning from the cloud for secure, optimized connectivity to applications and data. A cluster of gateways deploys globally at top-tier cloud data centers to provide scalable and on-demand cloud network services. Working with the Edge, the cluster delivers Dynamic Multi-path Optimization so multiple, ordinary broadband links appear as a single, high-bandwidth link. Orchestrator management provides centralized configuration, real-time monitoring, and one-click provisioning of virtual services.

IPsec Tunnel Overhead

VeloCloud Tunnel Overhead

To support Dynamic Multipath Optimization™ (DMPO), VeloCloud encapsulates packets in a protocol called the VeloCloud Multipath Protocol (VCMP). VCMP adds 31 bytes of overhead for user packets to support resequencing, error correction, network analysis, and network segmentation within a single tunnel. VCMP operates on an IANA-registered port of UDP 2426. To ensure consistent behavior in all potential scenarios such as unencrypted, encrypted and behind a NAT, ad encrypted but not behind a NAT, VeloCloud encrypts VCMP using transport mode IPsec and forces NAT-T to be true with a special NAT-T port of 2426.

Packets sent to the Internet through the SD-WAN Gateway do not encrypt by default, since they egress to the open Internet upon exiting the Gateway. As a result, Internet Multipath traffic has less overhead than that of VPN traffic.

Impact of IPv6 Tunnel on MTU

VeloCloud SD-WAN supports IPv6 addresses to configure the Edge Interfaces and Edge WAN Overlay settings.

Users can set up the VCMP tunnel in the following environments: IPv4 only, IPv6 only, and dual stack. For more information, see IPv6 Settings.

When a branch has at least one IPv6 tunnel, DMPO uses this tunnel seamlessly along with other IPv4 tunnels. The packets for any specific flow can take any tunnel, IPv4 or IPv6, based on the real-time health of the tunnel. An example of specific flow is the path selection score for load-balanced traffic. In such cases, the increased size of the IPv6 header (additional 20 bytes) should be taken into account, and as a result, the effective path MTU will be reduced by 20 bytes. In addition, this reduced effective MTU will be propagated to the other remote branches through the Gateway so that the incoming routes into this local branch from other remote branches reflect the reduced MTU.

Path MTU Discovery

The Edge first attempts Path MTU discovery (RFC 1191),and sends a packet from the current known link MTU (Default 1500 bytes) to the peer with the Don’t Fragment (DF) bit set in the IP header. If the remote Edge or Gateway receives the packet, an acknowledgment packet of the same size returns to the Edge. If the packet cannot reach the remote Edge or Gateway due to MTU constraints, the intermediate device expects to send an ICMP destination unreachable (fragmentation needed) message. When the Edge receives the ICMP unreachable message, it validates the message and ensures the MTU value reported is sane). After the validation, adjust the MTU. The process then repeats until discovering the MTU.

In some cases (for example, USB LTE dongles), the intermediate device does not send an ICMP unreachable message even if the packet is too large. If RFC 1191 fails, the Edge did not receive an acknowledgment or ICMP unreachable, it falls back to RFC 4821 Packetization Layer Path MTU Discovery. The Edge attempts to perform a binary search to discover the MTU.

VPN Traffic and MTU

Now that the SD-WAN Edge has discovered the MTU and calculated the overheads, an effective MTU can be computed for client traffic. The Edge attempts to enforce this MTU as efficiently as possible for the various potential types of traffic received.

Jumbo Frame Limitation

VeloCloud SD-WAN does not support jumbo frames as of Release 5.0. The maximum supported IP MTU, 1500,for packets sent across the overlay without fragmentation.

Bronze Site Topology

The Bronze topology represents a typical small site deployment where one or two WAN links connect to the public Internet. Bronze topology does not use an MPLS connection and does not have an L3 switch on the LAN side of the Edge. The following figure shows an overview of the Bronze topology.

Silver Site Topology

The Silver topology represents a site with an MPLS connection, in addition to one or more public Internet links. There are two variants of this topology. The first variant is a single L3 switch with one or more public Internet links and an MPLS link terminated on a CE and accessible through the L3 switch. In this case, the Edge goes between the L3 switch and the Internet which replaces the existing firewall/router.

The second variant includes MPLS and Internet routers deployed using either the Cisco Hot Standby Router Protocol (HSRP) or Virtual Router Redundancy Protocol (VRRP) from a different router vendor, with an L2 switch on the LAN side. In this case, the Edge replaces the L2 switch.

Gold Site Topology

The Gold topology consists of a typical large branch site topology. The topology includes active/active L3 switches, which communicate routes using OSPF or BGP, one or more public Internet links, and a MPLS link terminated on a CE router also connected to OSPF or BGP and accessible through the L3 switches.

A key differentiation point is that a single WAN link is accessible via two routed interfaces. To support this, a virtual IP address provisioned inside the Edge and advertised over OSPF, BGP, or statically routed to the interfaces.

High Availability (HA) Configuration

The following figure provides a conceptual overview of the Arista High Availability configuration using two Edges, one active and one standby.

Connected the L1 ports on each edge establish a failover link. The standby Edge blocks all ports except the L1 port for the failover link.

On-Premise Topology

The on-premise topology consists of two hubs and multiple branches, with or without an Edge. Each hub has hybrid WAN connectivity and branch types.

The MPLS network runs BGP and peers with all the CE routers. At Hub 1, Hub 2, and Silver 1 sites, the L3 switch runs OSPF, or BGP with the CE router and firewall in the case of hub sites.

In some cases, there may be redundant data centers which advertise the same subnets with different costs. In this scenario, configure both data centers as edge-to-edge VPN hubs. Since all edges connect directly to each hub, the hubs also connect directly to each other. Based on route cost, traffic redirects to the preferred active data center.

In previous versions, users could create an enterprise object using Zscaler or Palo Alto Network as a generic Non SD-WAN Destination. In 4.0 version, that object becomes as a Non SD-WAN Destination.

The Cloud-Delivered solution of Arista VeloCloud combines the economics and flexibility of the hybrid WAN with the deployment speed and low maintenance of cloud-based services. It simplifies the WAN by delivering virtual services from the cloud to branch offices. The Arista VeloCloud customer-premise equipment, Edge, aggregates multiple broadband links, for example, Cable, DSL, and 4G-LTE at the branch office, and sends the traffic to Gateways. Using cloud-based orchestration, the service can connect the branch office to any of type of data center: enterprise, cloud, or Software-as-a-Service (SaaS).

The Edge consists of a compact, thin Edge device zero-IT-touch provisioned from the cloud for secure, optimized connectivity to applications and data. Orchestrator management provides centralized configuration and real-time monitoring.

Administrator

Site Contact

The Site Contact has the responsibility for Edge physical installation and activation with the Arista VeloCloud SD-WAN service. The Site Contact can be a non-IT person who can receive an email and perform the instructions in the email for Edge activation.

Enterprise-level Orchestrator Features User Role Matrix

Configurations

The Arista VeloCloud SD-WAN service has four core configurations with a hierarchical relationship. Create these configurations in the Orchestrator. The following table provides an overview of the configurations:

Table 23. Core Configurations

Configuration	Description
Network	Defines basic network configurations, such as IP addressing and VLANs. Networks can be designated as Corporate or Guest and there can be multiple definitions for each network.
Network Services	Define several common services used by the VeloCloud Service, such as Backhaul Sites, Cloud VPN Hubs, Non SD-WAN Destinations, Cloud Proxy Services, DNS services, and Authentication Services.
Profile	Defines a template configuration to apply to multiple Edges. Configure a Profile by selecting a Network and Network Services. Apply a profile to one or more Edge models and defines the settings for the LAN, Internet, Wireless LAN, and WAN Edge Interfaces. Profiles can also provide settings for Wi-Fi Radio, SNMP, Netflow, Business Policies and Firewall configuration.
Edge	Configurations provide a complete group of settings that can be downloaded to an Edge device. The Edge configuration has a composite of settings from a selected Profile, a selected Network, and Network Services. An Edge configuration can also override settings or add ordered policies to those defined in the Profile, Network, and Network Services.

The following image shows a detailed overview of the relationships and configuration settings of multiple Edges, Profiles, Networks, and Network Services.

A single Profile can be assigned to multiple Edges. An individual Network configuration can be used in more than one Profile. All profiles use Network Services configurations.

Networks

With overlapping addresses, all Edges that use the Network have the same address space. Associate overlapping addresses with non-VPN configurations.

With non-overlapping addresses, an address space divides into blocks of an equal number of addresses. Non-overlapping addresses associate with VPN configurations. Assign address blocks to Edges that use the Network so that each Edge has a unique set of addresses. Non-overlapping addresses are required for Edge-to-Edge and Edge-to-Non SD-WAN Destination VPN communication. The configuration creates the required information to access an Enterprise Data Center Gateway for VPN access. An administrator for the Enterprise Data Center Gateway uses the IPsec configuration information generated during Non SD-WAN Destination VPN configuration to configure the VPN tunnel to the Non SD-WAN Destination.

The following image shows unique IP address blocks from a Network configuration being assigned to Edge.

Note: When using non-overlapping addresses, the Orchestrator automatically allocates the blocks of addresses to the Edges. The allocation happens based on the maximum number of Edges that might use the network configuration.

Network Services

Users can define Enterprise Network Services and use them across all the Profiles. This includes services for Authentication, Cloud Proxy, Non SD-WAN Destinations, and DNS. The defined Network Services are used only when they are assigned to a Profile.

Profiles

Profiles provide Cloud VPN settings for Edges configured for VPN. The Cloud VPN Settings can activate or deactivate Edge-to-Edge and Edge-to- Non SD-WAN Destination VPN connections.

Profiles can also define rules and configuration for the Business Policies and Firewall settings.

Edges

Users can use most of the settings defined in a Profile, Network, or Network Services without modification in an Edge configuration. However, users can override the settings for the Edge configuration elements to tailor an Edge for a specific scenario. This includes settings for Interfaces, Wi-Fi Radio Settings, DNS, Authentication, Business Policy, and Firewall.

In addition, configure an Edge to augment settings not present in Profile or Network configuration. This includes Subnet Addressing, Static Route settings, and Inbound Firewall Rules for Port Forwarding and 1:1 NAT.

Orchestrator Configuration Workflow

Important Notes

• Any customer procuring a USB modem for a Arista VeloCloud SD-WAN must select one from the above list to ensure support on their Edge.
• The four USB modems listed as supported provide worldwide coverage for all VeloCloud SD-WAN Customers.
• While all of the above may not be available in a specific market, at least one of the four should be procurable.
• For customers deploying a modem not listed above but which was previously listed as supported (referred to as "legacy" modems):
  • Note that the existing legacy modems continue to work on Edges, but rather that VeloCloud SD-WAN Engineering no longer tests those modems against the latest Edge software and should not be expected to provide fixes for issues arising from these legacy modems.
  • Any future modem purchases must be made from the above list.

Impact/Risks