khirom Tracker

Re: VPN DO NOT ESTABLISH BETWEEN VELOCLOUD GATEWAY AND FORTIGATE

khirom — Sat, 21 Oct 2023 05:24:29 GMT

Hi,
I have successfully configured a VPN between Fortigate and VMware SD-WAN Gateway.
Fortigate interface had a public IP address.
I have not tested it in a NAT environment.
Initially, I tried using AES128, SHA-1, and DH2.
After confirming the VPN was established, I switched to stronger parameters.
After setting NSD in the profile, the VPN was established.
I think VMware SD-WAN Gateway is the responder and Fortigate is the Initiator.

Re: VPN to Non-SD-WAN destination (NSD) directly from Edge?

khirom — Fri, 20 Oct 2023 15:56:28 GMT

Hi,
I configured IPsec VPN between AWS and VMware SD-WAN Edge using NSD via Edge.
It was amazingly easy.
However, I have not yet had success with FW.
It seems that SD-WAN Edge is the Initiator and NAT-T is used.

Re: VPN to Non-SD-WAN destination (NSD) directly from Edge?

khirom — Fri, 06 Oct 2023 09:29:00 GMT

Sorry, I wrote in the wrong thread.I leave the following as is.

This may not be correct.
It may be better to try the NSD via Gateway settings in the old UI instead of the new UI.
The parameters available in the new UI and the old UI are different.
Here is what I consider to be a good procedure
1. Confirm VPN establishment with the parameters available in the old UI.
2. After confirming, adjust the parameters to the stronger cryptographic strength in the new UI.
If the old UI is not available, contact support and they may be able to enable it.

Re: What is the difference between following Events "Edge Interface Down" and "Link D

khirom — Tue, 03 Oct 2023 01:23:18 GMT

Hi,

I think "Edge Interface Down" is physical NIC down and "Link Dead" is WAN Setting = DMPO Tunnel down.

"Link Dead" description appears when you hover your mouse over the information icon on the alert settings.

Re: WAN terminated on VLAN

khirom — Fri, 15 Sep 2023 15:42:19 GMT

Hi,

I think you should be careful with the default route "0.0.0.0/0".
VMware SD-WAN Edge has a default route when the interface gateway is configured.
If multiple Internet lines terminate to the VMware SD-WAN Edge, the route selection to the Internet is configured by business policy.
If the default route is obtained by static or dynamic routing, it is preferred.
Default routes obtained by static or dynamic routing can cause them to take precedence in many cases, causing unintended behavior.
This kb might be helpful.

Troubleshooting Unexpected Business Policy Behavior in VeloCloud SD-WAN (71317)
https://kb.vmware.com/s/article/71317

VMware SD-WAN switch ports are L2 switch access ports.
It is not available for cases where routing is desired.

This KB will help you understand the interface settings.

VMware SD-WAN by VeloCloud Interface Types and WAN Overlay (74846)
https://kb.vmware.com/s/article/74846?lang=en_us

If you want to set up an overlay using multiple VLANs on a single routing interface, the following description is helpful.

”2. Multiple Overlays Per Physical Interface”

If you set the WAN overlay setting to User defined instead of Auto,you should be able to set up a WAN overlay that uses multiple VLANs.

Re: SD WAN vs Edge software version

khirom — Fri, 15 Sep 2023 14:34:31 GMT

Hi,

I have heard in past webinar that VMware SD-WAN Edge behavior depends on the version of the Edge software.

Orchestrator is automatically upgraded and new features appear in the UI, but if the Edge version is still old, it should not work.

Sorry, I don't remember which webinar I heard this.

Re: VPN DO NOT ESTABLISH BETWEEN VELOCLOUD GATEWAY AND FORTIGATE

khirom — Tue, 29 Aug 2023 12:35:09 GMT

Hi,

I have never used Fortigate FW with VMware SD-WAN.

It may be PFS setting.

Have you tried "no PFS" setting?

Re: Support Bundle

khirom — Wed, 23 Aug 2023 08:49:55 GMT

Hi,
I found the document, but I could not see it on Orchestrator either.

Diagnostic Bundles for Edges
https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-82F8692E-839D-4353-B4A2-B301C1DED73C.html

I think you should contact VMware support.

You can get the diagnostic bundle in other ways.
If you allow access to the local UI from the Edge firewall settings, you would be able to get the diagnostic bundle from local, but VMware KB does not recommend this.

These materials might be helpful.

Configure Edge Access
https://docs.vmware.com/en/VMware-SD-WAN/5.1/VMware-SD-WAN-Administration-Guide/GUID-63895B33-A4D3-43F7-9F19-263DA8DA13AC.html

Configure Profile Firewall
https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-950E1A6F-70CD-4958-B2FE-E5D4DC817F99.html?hWord=N4IghgNiBcIMIHsB2AzAlgcwK4CcCmABAKIAmGhAggMZV4DOdIAvkA

How to generate a VMware SD-WAN™ Edge diagnostic bundle via Local Web UI (77248)
https://kb.vmware.com/s/article/77248

Local Web User Interface Access of the VMware SD-WAN Edge by VeloCloud is disabled by default (55009)
https://kb.vmware.com/s/article/55009

Local user is unable to access the Local Web UI of the VMware SD-WAN by VeloCloud Edge (2740819)
https://kb.vmware.com/s/article/2740819

Re: Standard HA Standby unit activation

khirom — Tue, 22 Aug 2023 17:29:21 GMT

Yes,
Here is a brief description of the procedure.

1. Create a new edge on Orchestrator and Enable HA configuration
2. Edge Activate.
3. Connect active and standby edges via GE1 port

These materials may be useful.

VMware Docs
Configure High Availability on SD-WAN Edge

Prerequisites
https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-3F424EA9-79B7-4F7F-A418-EBD7CF9998A0.html

Activate High Availability
https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-71C39F31-ADAE-41C9-BDB1-53CC5057F149.html

Connect the Standby SD-WAN Edge to the Active Edge
https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-17011695-1025-4A8F-B9FE-15F73E4CCFFC.html

Connect LAN and WAN Interfaces on Standby SD-WAN Edge
https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-5E8AD49E-11C6-492A-B700-35AC09360B79.html

Re: SD-WAN network virtual LAB at home

khirom — Tue, 22 Aug 2023 17:10:52 GMT

Hi,

I have not tried it but it seems EVE-NG can do it. I see the question on this forum from time to time.

You can try using VMware Hands On Lab.

https://pathfinder.vmware.com/v3/page/hands-on-labs

Re: Standard HA Standby unit activation

khirom — Tue, 22 Aug 2023 17:06:59 GMT

Hi,

Standby Edge does not require activation.

Just connect an activated HA active Edge GE1 and an unactivated (factory condition) VMware SD-WAN Edge on the GE1 port.

Re: Edge Serial number for Activation

khirom — Tue, 22 Aug 2023 16:59:01 GMT

Hi,

The serial number is the same as the service tag.
The Service Tag is found on the VMware SD-WAN Edge.

You can find the serial number of the VMware SD-WAN Edge you have already activated in Orchestrator.

Re: Edge and Cisco switches

khirom — Tue, 22 Aug 2023 16:20:47 GMT

Edge port assignments can be made in profiles, but IP addresses and other settings are configured for individual Edges.

https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-554B6DB5-60B7-4479-8157-195C546EC602.html

Segments is similar to VRFs.
Segments is used when you want to separate traffic.

This Document is helpful to understand VMware SD-WAN for me.
https://sase.vmware.com/resources/sdwan-1-on-1-the-what-why-and-how

Re: Edge and Cisco switches

khirom — Tue, 22 Aug 2023 16:10:14 GMT

Hi,

This KB might be helpful.

VMware SD-WAN Edge Interface Types and WAN Overlay (74846)
https://kb.vmware.com/s/article/74846

Re: VPN to Non-SD-WAN destination (NSD) directly from Edge?

khirom — Tue, 22 Aug 2023 15:50:30 GMT

Hi,

These documents might be helpful.

Configure a Non SD-WAN Destinations via Edge
https://docs.vmware.com/en/VMware-SD-WAN/5.1/VMware-SD-WAN-Administration-Guide/GUID-7122D54E-2A8E-40B2-A5E3-4B6A3C928202.html

VMware SD-WAN Edge using Non SD-WAN Destination (NSD) via Edge may periodically experience a Dataplane Service failure (89644)
https://kb.vmware.com/s/article/89644

I have tested the connection between VMware SD-WAN Edge (Branch Edge) and the public cloud using NSD via Edge, but have not tried a VPN connection to Cisco ISR/ASR.

Re: Edge software version

khirom — Tue, 22 Aug 2023 09:13:11 GMT

Hi,

This KB might be helpful.

VMware SD-WAN Software Versions: Recommended Releases (80741)
https://kb.vmware.com/s/article/80741

Version 4.3.1 is already EOS.
You should change your default software to a different version.

Recommended software versions are listed in the VMware KB.
This KB will be updated when a new version is released.
I recommend subscribing.

'Software and Firmware Images' setting is used for activation of new edge.

Re: Edge software version

khirom — Mon, 21 Aug 2023 09:44:17 GMT

Hi,

By default, the Edge software image management feature is disabled.
If it is disabled, you might have to activate Edge to see it in the Orchestrator.
If you need to enable this feature, please contact VMware Support.

VMware Docs
Enable Edge Software Image Management
https://docs.vmware.com/en/VMware-SD-WAN/5.1/VMware-SD-WAN-Administration-Guide/GUID-49935545-6A10-4F80-83B5-D7A9348D68E4.html

Re: API call to get Link Data

khirom — Fri, 04 Aug 2023 09:19:25 GMT

How about using Postman?
It helps to verify the response.

I got link data using Postman.
My test steps are below.

1. Get Enterprise Logical ID
I got my enterpse logicalId via API v1.

Request: Post

"https://<vco-fqdn>/portal/rest/enterprise/getEnterprise"

I got enterpriseLogicalId like this.
xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

2. Get Edge Logical ID
I got my edge logicalId via API v1.

Request: Post

https://<vco-fqdn>/portal/rest/enterprise/getEnterpriseEdges

I got edgeLogicalId like this.
yyyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyy

3. Get Link stats
Request: Get
https://{vco-fqdn}//api/sdwan/v2/enterprises/{enterpriseLogicalId}/edges/{edgeLogicalId}/linkStats

Re: Velocloud Edge Default Username and Password

khirom — Fri, 04 Aug 2023 08:30:26 GMT

This document might be helpful.

View Edge Information

Local Credentials

https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-53CD696E-5511-4433-90BD-46C63AA2FDF0.html

Enable Secure Edge Access for an Enterprise

https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-A0CCF639-3AD5-436F-BA63-F654A1D38137.html

Re: New Velo Portal

khirom — Fri, 04 Aug 2023 01:14:03 GMT

The new UI has been the default from version 5.2.
The version 5.2 documentation may be helpful.

https://docs.vmware.com/en/VMware-SD-WAN/5.2/VMware-SD-WAN-Administration-Guide/GUID-6755D528-8D32-4DA2-9C60-9AC7D4337435.html