<\/p>\n\n\n\n
SD-WAN Remote Access Overview<\/h2>\n\n\n\n
Cisco RA uses FlexVPN, FlexVPN is another method to configure VPN but in a much simpler manner. If you have configured DMVPN Phase 3, you will realise how much configuration is required. FleVPN simplifies this and uses IKEv2.<\/p>\n\n\n\n
You deploy a headend device (Router) at the head end network such as where all your applications or services will be ideally.<\/p>\n\n\n\n
- \n
- IOS-XE supports FlexVPN(IKEv2\/IPSec)<\/li>\n\n\n\n
- SSLVPN<\/li>\n\n\n\n
- As of v20.12 SSL VPN is now supported. <\/li>\n\n\n\n
- IOS-XE SD-WAN devices can support RA Headend device.<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-19.png\")
<\/a><\/figure><\/div>\n\n\nJust going to throw the Sales Pitch into why you would want to use RA!<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-20.png\")
<\/a><\/figure><\/div>\n\n\nSD-WAN RA \u2013 Deployment Considerations<\/h2>\n\n\n\n
- \n
- Static IP on the SD-WAN RA Headend for inbound RA VPN connections.<\/li>\n\n\n\n
- Dedicated non-TLOC WAN interface for RA, for Geo-load balancing and also you can configure inbound ACL to restrict traffic to IKEv2 and IPsec as well as now SSLVPN.<\/li>\n\n\n\n
- Shared TLOC interface with static public IP<\/li>\n<\/ul>\n\n\n\n
SD-WAN RA – Workflow<\/h2>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-21.png\")
<\/a><\/figure><\/div>\n\n\n- \n
- 1 Remote user connects to teh RA headend and requests a IPec\/SSL VPN connection<\/li>\n\n\n\n
- 2 RA Headend authenticates clients with a certificate or PSK.<\/li>\n\n\n\n
- 3 User\/Group policy determines the level of access and Client\/Subnet is pushed out.<\/li>\n\n\n\n
- 4 IPSec virtual interface (per RA user) is created and pushes the IP addresss and DNS etc<\/li>\n\n\n\n
- 5 Full or split tunnel routes traffic to the allowed subnets based on the policy set.<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-22.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-23.png\")
<\/a><\/figure><\/div>\n\n\nSD-WAN RA Deployment Models<\/h2>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-25.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-31.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-32.png\")
<\/a><\/figure><\/div>\n\n\n<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-33.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-34.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-35.png\")
<\/a><\/figure><\/div>\n\n\n\u00a0Platform Support<\/h2>\n\n\n\n
<\/p>\n\n\n\n
Final thing to consider is the design when implementing RA, is the Headebd device – remember it will need to serve the Service side as well as the usual NAT\/DIA sessions on top of the SD-WAN overlay Control Plane as well as Data Plane. So it is best to size appropriately so the box doesn’t set fire to itself!<\/p>\n","protected":false},"excerpt":{"rendered":"
Traditionally, RA will tunnel through one Security Edge Device at the perimeter. Typically this provides challenges such as: SD-WAN Remote Access Overview Cisco RA uses FlexVPN, FlexVPN is another method to configure VPN but in a much simpler manner. If you have configured DMVPN Phase 3, you will realise how much configuration is required. FleVPN … Continue reading SD-WAN Remote Access (SD-WAN RA)<\/span>