cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Mixing Auto VPN and SD-WAN configurations within the same network

Here to help

Mixing Auto VPN and SD-WAN configurations within the same network

I'm starting this post just to ensure that there are no gotchas etc with the following:

 

A large multi-regional MX based network with some sites provisioned with a single Internet connection, while other more critical site have two. Only Internet circuits will be used to create a corporate WAN, regional data centres having MX HA pairs acting as the VPN hubs.

 

All traffic will be routed to the regional hub / data centre sites where Internet connectivity is managed via a Palo Alto service the client insists on using i.e. no local Internet breakout / split tunnelling is permitted

 

The ISP is providing "service levels" in respect to latency and QoS over the Internet connections. Traffic levels are not expected to be particularly high, hence MX65, MX100 will be used for the spoke sites with MX250 and above for the regional data centres.

 

Are there any known issues with mixing SD WAN spoke ( where multiple ISP connections exist) and auto VPN branch offices (singe ISP) connection configurations, as SD WAN sits on top of auto VPN I was assuming not?

 

Is is still best to deploy the spoke sites in NAT mode and the DC VPN hub in passthrough, if there is a relevant CVD or case study, apologies I have missed this! 

2 REPLIES 2
Kind of a big deal

Re: Mixing Auto VPN and SD-WAN configurations within the same network

Correct, SD-WAN sites on top of AutoVPN, so you can have some sites with one Internet connection and some sites with two Internet connections.

 

Spoke sites will using be in NAT mode.  I personally prefer to use NAT mode in DC's as well, but you can use "on a stick" or passthrough mode as well.

 

You might find this redundant DC design interesting to look at:

https://documentation.meraki.com/MX-Z/Deployment_Guides/Datacenter_Redundancy_(DC-DC_Failover)_Deplo...

Here to help

Re: Mixing Auto VPN and SD-WAN configurations within the same network

Many thanks for your prompt response, I'll review the CVD's today

Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.