打印

VeloCloud SD-WAN 7.0 - Administration Guide - Provision a New Edge 打印

Provision a New Edge

Enterprise Administrators can provision a single Edge or multiple Edges for Enterprise Customers.

To create a new Edge, perform the following steps:

  1. In the SD-WAN service of the Enterprise portal, go to Configure > Edges .
  2. On the Edges screen, click Add Edge. The Provision an Edge screen appears.
    Figure 1. Provision an Edge
  3. Users can configure the following options:
    Table 1. Provision an Edge - Options and Descriptions
    Option Description
    Mode By default, SD-WAN Edge mode is selected.
    Name Enter a unique name for the Edge.
    Model Select an Edge model from the drop-down menu.
    Profile Select a Profile to assign to the Edge from the drop-down menu. For information on creating a new Profile, see Create a Profile. If the system displays an Edge Staging Profile due to Edge Auto-activation, it indicates that a newly assigned Edge is currently using this profile and that the user has not yet configured it with a Production Profile.
    Edge License Select an Edge license from the drop-down menu. The list displays the licenses assigned to the Enterprise by the Operator.
    Authentication Choose the mode of authentication from the drop-down menu:
    • Certificate Deactivated: In this mode, the Edge uses Pre-Shared Key (PSK) authentication to establish secure communication to the Hub/Gateways/Orchestrator.
      Warning: VeloCloud SD-WAN does not recommend this mode for any customer deployments.
      If users change the mode from Certificate Deactivated to:
      • Certificate Acquire: All tunnels are disconnected and reconnected based on the RSA mode.
      • Certificate Required: The Orchestrator does not directly allow this change. Users must first change the mode to Certificate Acquire and then to Certificate Required. This helps avoid heartbeat loss to the Orchestrator when Edge is assigned a certificate.
    • Certificate Acquire: In this mode, certificates are issued at Edge activation and automatically renewed. The Orchestrator instructs the Edge to acquire a certificate from the Orchestrator's certificate authority by generating a key pair and sending a certificate signing request to the Orchestrator. After acquisition, the Edge uses the certificate for authentication with the Orchestrator and for establishing VCMP tunnels.
      If users change the mode from Certificate Acquire to:
      • Certificate Deactivated All tunnels are disconnected and reconnected based on PSK mode.
      • Certificate Required For Edges/Gateways running versions older than 6.1.x, switching from Certificate Acquire to Certificate Required causes a tunnel flap. Edges/Gateways running version 6.1.x or newer will not experience a tunnel flap.

      When a Hub enters Certificate Acquire mode, it reestablishes certificate-based tunnels using a new certificate while leaving PSK-based tunnels unaffected.

      Note: After acquiring the certificate, VeloCloud SD-WAN recommends updating this option to Certificate Required. This is to prevent Hubs/Gateways from accepting tunnel requests using PSK.
    • Certificate Required: This is the recommended mode. This mode does not allow peers with a PSK to connect. This mode does not accept Edge heartbeats without a valid certificate.
      If users change the mode from Certificate Required to:
      • Certificate Deactivated: VeloCloud SD-WAN does not recommend transitioning the Edge’s authentication mode to Certificate Deactivated.
      • Certificate Acquire: An Edge that has been offline for an extended period after activation may be unable to connect to the Orchestrator when it tries to bring itself online if its certificate has expired or it never acquired one. In Certificate Required mode, the Orchestrator rejects connections from Edges without a valid certificate. Reactivation is not required for such cases. The Edge can be brought back online by temporarily switching it to Certificate Acquire mode to obtain a new certificate.
        Recovery Procedure:
        1. Verify with the Enterprise administrator that they expect the Edge to come back online.
        2. Move the Edge to Certificate Acquire mode in the Orchestrator.
        3. Turn on or reconnect the Edge. This will connect to the Orchestrator and acquire a new certificate.
        4. Confirm in the Orchestrator that the Edge has a valid certificate and is establishing tunnels.
        5. Switch the Edge back to Certificate Required mode.
    Encrypt Device Secrets Select the Enable checkbox to activate Edge encryption across all platforms. This option is also available on the Edge Overview page. For additional information, see View Edge Information.
    Note: For Edge versions 5.2.0 and later, before users deactivate this option, users must first deactivate the Edge using remote actions. This causes Edge to restart.
    High Availability Select the Enable checkbox to apply High Availability (HA). Edges can be installed as a single standalone device or paired with another Edge to support HA. For additional information about HA, see the High Availability Deployment Models section.
    Local Contact Name Enter the name of the site contact for the Edge.
    Local Contact Email Enter the email address of the site contact for the Edge.

     

  4. Enter all the required details and click Next to configure the following additional options:
    Note: The Next button is activated only when users enter all the required details.
    Table 2. Additional Options and Descriptions
    Option Description
    Serial Number Enter the serial number of the Edge. If specified, the Edge must display this serial number on activation. When deploying virtual VeloCloud SD-WAN Edges on AWS Edges, ensure users use the instance ID as the Edge's serial number.
    Description Enter an appropriate description.
    Location Click the Set Location link to set the Edge's location. If not specified, the location is auto-detected from the IP address when the Edge is activated.

     

  5. Select Add Edge. The Edge gets provisioned with an activation key.
    Note: If the user does not activate the Edge using the provided Activation Key, it will expire after one month. For information on how to activate an Edge, see the Configure Edge Activation section in the Edge Activation Quick Start Guide.
    After users have provisioned an Edge, the Edge appears on the Edges screen.
  • If users have configured the Edge 510-LTE device or the 610-LTE device (version 4.2.0 release), users can run the LTE Modem Information diagnostic test. This test will retrieve diagnostic information, such as signal strength, connection information, and so on. For information on running a diagnostic test, see Testing and Troubleshooting.
  • To manage the provisioned Edges, see Manage Edges.
  • To view Edge details or to make any changes to the Edge, see View Edge Information.
  • To configure an Edge, see Configure Device Settings for Edges.
..