We're determining the best way to implement default route and SD-WAN route failover in our network. I've attached an image of our WAN topology. Right now, an AutoVPN tunnel is formed between HQ and the Datacenter over the ASE connection. The ASE connection is connected to a WAN interface on the HQ MX. At the Datacenter, the ASE is connected to an MS350 switch pair that has an SVI for the vlan that traverses the link. An outage involved losing internet connectivity at the Datacenter. The HQ MX failed over to the other WAN port, but the only Hub specified was the Datacenter Hub and it was set for IPv4 default route. Return traffic is directed via static route on the Datacenter core switch to the SD-WAN Hub there. The DC Edge firewall, SD-WAN Hub and Core switch were all unable to connect to the Internet and the Meraki Registry. We had no Internet connectivity at HQ via the fail-over circuit until we disabled the IPv4 default route check box in Site-to-Site VPN there. So that failover is automatic - should the Azure vMX Hub be set as a secondary Hub for HQ and with IPv4 default route disabled for it? Would it be advisable to remove the SD-WAN tunnel over the ASE between HQ and the Datacenter and simply use the ASE as a L2 link that it's intended for? Here are some notes regarding the sites and equipment: Primary sites: HQ site Connected to the Datacenter site via a private circuit (ASE) Secondary public internet connection available for failover SD-WAN spoke utilizing private circuit as primary uplink Datacenter site Hosts many VM's and through which the HQ reaches the Internet One MX pair is the edge firewall and another pair is a one-armed VPN concentrator Edge firewall pair provides for Client VPN Azure tenant Hosts SQL databases and some VM's Small branch sites Connect to Datacenter over SD-WAN From Upstream to Downstream this is our topology: Datacenter site Edge MX250 pair: -WAN 1 primary uplink which provides Internet inbound/outbound -Utilizes two VLANS, management and DMZ -Not participating in SD-WAN Core switch MS350 stack pair: -Static DFG of Edge MX250 LAN -SVI provides the default gateway for HQ's primary uplink and L2 connectivity for both the public Internet circuit and the private circuit back to HQ One-armed VPN Concentrator MX250 pair: -All RFC-1918 is statically routed here from the Core switch -Hub for all sites -Hub is also the IPv4 DFG for HQ Private circuit (ASE) connects HQ site via L2… HQ site HQ Core Switch Cisco Catalyst: -L2 Connectivity for private circuit and for secondary public circuit -L3 for HQ site -Transit vlan to site's MX firewall's LAN MX250 Firewall pair: -SD-WAN spoke -Datacenter's Hub is specified as only Hub and is the IPv4 DFG -Private circuit to DC is the primary Uplink -Public circuit is secondary (1/5th bandwidth of private circuit)
... View more
