Meraki SD-WAN

Concentrator Mode

All WAN Appliances can be configured in either NAT or VPN concentrator mode. There are important considerations for both modes. For more detailed information on concentrator modes, click here.

VPN Topology

There are several topology options available for VPN deployment.

Warm Spare (High Availability) for VPN concentrators

When configured for high availability (HA), one WAN Appliance serves as the primary unit and the other WAN Appliance operates as a spare. All traffic flows through the primary WAN Appliance, while the spare operates as an added layer of redundancy in the event of failure.

Failover between WAN Appliances in an HA configuration leverages VRRP heartbeat packets. These heartbeat packets are sent from the Primary WAN Appliance to the Spare WAN Appliance out the singular uplink in order to indicate that the Primary is online and functioning properly. As long as the Spare is receiving these heartbeat packets, it functions in the passive state. If the Passive stops receiving these heartbeat packets, it will assume that the Primary is offline and will transition into the active state. In order to receive these heartbeats, both VPN concentrator WAN Appliances should have uplinks on the same subnet within the datacenter.

Only one MX license is required for the HA pair, as only a single device is in full operation at any given time.

Connection Monitor

Connection monitor is an uplink monitoring engine built into every WAN Appliance. The mechanics of the engine are described in this article.

SD-WAN Technologies

The Meraki SD-WAN implementation is comprised of several key features, built atop our AutoVPN technology.

SD-WAN Objectives

This guide focuses on two key SD-WAN objectives:

• Redundancy for critical network services

• Dynamic selection of the optimal path for VoIP traffic

Example Topology

The following topology demonstrates a fully featured SD-WAN deployment, including DC-DC failover for the redundancy.

High Level Traffic Flow

The decisions for path selection for VPN traffic are made based on a few key decision points:

• Whether VPN tunnels can be established on both interfaces
• Whether dynamic path selection rules are configured
• Whether Policy-based Routing rules are configured
• Whether load balancing is enabled

If tunnels are established on both interfaces, dynamic path selection is used to determine which paths meet the minimum performance criteria for particular traffic flow. Those paths are then evaluated against the policy-based routing and load balancing configurations.

For a more detailed description of traffic flow with an SD-WAN configuration, please see the appendix.

Example Topology

A one-armed concentrator is the recommended datacenter design choice for an SD-WAN deployment. The following diagram shows an example of a datacenter topology with a one-armed concentrator:

Dashboard Configuration

The Cisco Meraki Dashboard configuration can be done either before or after bringing the unit online.

1. Begin by configuring the WAN Appliance to operate in VPN Concentrator mode. This setting is found on the Security & SD-WAN > Configure > Addressing & VLANs page. The WAN Appliance will be set to operate in Routed mode by default.

2. Next, configure the Site-to-Site VPN parameters. This setting is found on the Security & SD-WAN > Configure > Site-to-site VPN page.

3. Begin by setting the type to "Hub (Mesh)."
4. ​Configure the local networks that are accessible upstream of this VPN concentrator.

   1. For the Name, specify a descriptive title for the subnet.

   2. For the Subnet, specify the subnet to be advertised to other AutoVPN peers using CIDR notation

5. NAT traversal can be set to either automatic or manual. See below for more details on these two options.

6. An example screenshot is included below:
   
      

Other Datacenter Configuration

Prerequisites

Before configuring and building AutoVPN tunnels, there are several configuration steps that should be reviewed.

Configuring AutoVPN

Once the subnets have been configured, Cisco Meraki's AutoVPN can be configured via the Security & SD-WAN > Configure > Site-to-site VPN page in Dashboard.

Best for VoIP

One of the most common uses of traffic optimization is for VoIP traffic, which is very sensitive to loss, latency, and jitter. The Cisco Meraki WAN Appliance has a default performance rule in place for VoIP traffic, Best for VoIP.

To configure this rule, click Add a preference under the VPN traffic section.

In the Uplink selection policy dialogue, select Custom expressions, then UDP as the protocol and enter the appropriate source and destination IP address and ports for the traffic filter. Select the Best for VoIP policy for the preferred uplink, then save the changes.

This rule will evaluate the loss, latency, and jitter of established VPN tunnels and send flows matching the configured traffic filter over the optimal VPN path for VoIP traffic, based on the current network conditions.

Load Balance Video

Video traffic is increasingly prevalent as technologies like Cisco video conferencing continue to be adopted and integrated into everyday business operations. This branch site will leverage another pre-built performance rule for video streaming and will load balance traffic across both Internet uplinks to take full advantage of available bandwidth.

To configure this, click Add a preference under the VPN traffic section.

In the Uplink selection policy dialogue, select UDP as the protocol and enter the appropriate source and destination IP address and ports for the traffic filter. For the policy, select Load balance for the Preferred uplink. Next, set the policy to only apply on uplinks that meet the Video streaming performance category. Finally, save the changes.

This policy monitors loss, latency, and jitter over VPN tunnels and will load balance flows matching the traffic filter across VPN tunnels that match the video streaming performance criteria.

PbR with Performance Failover for Web traffic

Web traffic is another common type of traffic that a network administrator may wish to optimize or control. This branch will leverage a PbR rule to send web traffic over VPN tunnels formed on the WAN 1 interface, but only if that matches a custom-configured performance class.

To configure this, select Create a new custom performance class under the Custom performance classes section.

In the Name field, enter a descriptive title for this custom class. Specify the maximum latency, jitter, and packet loss allowed for this traffic filter. This branch will use a "Web" custom rule based on a maximum loss threshold. Then, save the changes.

Next, click Add a preference" under the VPN traffic section.

In the Uplink selection policy dialogue, select TCP as the protocol and enter in the appropriate source and destination IP address and ports for the traffic filter. For the policy, select WAN1 for the Preferred uplink. Next, configure the rule such that web traffic will Failover if there is Poor performance. For the Performance class, select "Web". Then, save the changes.

This rule will evaluate the packet loss of established VPN tunnels and send flows matching the traffic filter out of the preferred uplink. If the loss, latency, or jitter thresholds in the "Web" performance rule are exceeded, traffic can fail over to tunnels on WAN2 (assuming they meet the configured performance criteria).

Layer 7 Classification

Best for VoIP

To configure this rule, click Add a preference under the VPN traffic section.

In the uplink selection policy dialogue, click Add+ to configure a new traffic filter. From the filter selection menu, click the VoIP & video conferencing category and then select the desired layer 7 rules. This example will use the SIP (Voice) rule.

Then, select the Best for VoIP performance class for the preferred uplink and save the changes. This rule will evaluate the loss, latency, and jitter of established VPN tunnels and send flows matching the configured traffic filter over the optimal VPN path for VoIP traffic, based on the current network conditions.

Complete Flowchart

The following flowchart breaks down the path selection logic of Meraki SD-WAN. This flowchart will be broken down in more detail in the subsequent sections.
(note: PfR = Performance Rule,  Pbr = Policy-based routing)

Decision Point 1: Can we establish Tunnels over both uplinks?

The very first evaluation point in SD-WAN traffic flow is whether the WAN Appliance has active AutoVPN tunnels established over both interfaces.

When VPN tunnels are not successfully established over both interfaces, traffic is forwarded over the uplink where VPN tunnels are successfully established.

If we can establish tunnels on both interfaces, processing proceeds to the next decision point.

Decision Point 2: Are performance rules for dynamic path selection defined?

If we can establish tunnels on both uplinks, the WAN Appliance will then check to see if any dynamic path selection rules are defined.

If dynamic path selection rules are defined, we evaluate each tunnel to determine which satisfy those rules.

If only one VPN path satisfies our performance requirements, traffic will be sent along that VPN path. The WAN Appliance will not evaluate PbR rules if only one VPN path meets the performance rules for dynamic path selection.

If there are multiple VPN paths that satisfy our dynamic path selection requirements or if there are no paths that satisfy the requirements, or if no dynamic path selection rules have been configured, PbR rules will be evaluated.

After performance rules for dynamic path selection decisions are performed, the WAN Appliance evaluates the next decision point.

Decision Point 3: Are PbR rules defined?

After checking dynamic path selection rules, the WAN Appliance will evaluate PbR rules if multiple or no paths satisfied the performance requirements.

If a flow matches a configured PbR rule, then traffic will be sent using the configured path preference.

If the flow does not match a configured PbR rule, then traffic logically progresses to the next decision point.

Decision Point 4: Is VPN load balancing configured?

After evaluating dynamic path selection and PbR rules, the WAN Appliance will evaluate whether VPN load balancing has been enabled.

If VPN load balancing has not been enabled, traffic will be sent over a tunnel formed on the primary Internet interface. Which Internet interface is the primary can be configured from the Security & SD-WAN > Configure > SD-WAN & traffic shaping page in Dashboard.

If load balancing is enabled, flows will be load balanced across tunnels formed over both uplinks.

VPN load balancing uses the same load balancing methods as the WAN Appliance's uplink load balancing. Flows are sent out in a round robin fashion with weighting based on the bandwidth specified for each uplink.