To deploy VMware SD-WAN Edges in a Virtual Hub manually, you must have already created a Resource Group, virtual WAN (vWAN), and virtual Hub (vHUB) on the Azure side.

Configuration Steps:

Prerequisites

Once the vWAN Hub is up and running and routing status is complete, you must meet the following prerequisites before proceeding with the Manual deployment of an Azure vWAN Network Virtual Appliance (NVA) via VMware SASE Orchestrator:
  • Obtain Enterprise account access to VMware SASE Orchestrator.
  • Obtain access to the Microsoft Azure portal with the appropriate IAM roles.
  • Software image requirements for this deployment are as follows: 
    • VMware SASE Orchestrator: 4.5.0 and above.
    • VMware SD-WAN Gateway: 4.5.0 and above.
    • VMware SD-WAN Edges: 4.2.1 and above.

Procedure

  1. In the Orchestrator, create a Virtual Edge by navigating to Configure > Edges > New Edge.
  2. In the Orchestrator, once the Edges are created, change the interface settings for all Edges as follows:
    • Change GE1 interface to Route with Autodetect WAN overlay.
    • Change GE2 to Route with WAN overlay deactivated.
    • The GE3 to GE8 interfaces are not used in this deployment. 
    Note: You can configure Profiles with Virtual Edge interface settings as required by this integration so that you do not have to change interface settings after creating Virtual Edges on the Orchestrator.
    Note: If you attempt to downgrade an Edge from Release 4.2.1 to an earlier release, the Edge will become stuck in an activating loop.
  3. SSH access to VMware SD-WAN Azure NVAs is managed by the Azure support team. The Azure side enforces security policies that only allow the source IP address 168.63.129.16 to SSH to Azure Virtual Edges. To allow a Virtual Edge to accept SSH from this source IP, navigate to Configure > Edges > Firewall > Edge Access > Support Access, and add the IP address 168.63.129.16 under the Allow the following IPs field.
    Note: You can perform the Step 3 configuration on a Profile used by many or all of the Virtual Edges so you do not need to do it for each individual Virtual Edge.

    For more details regarding this IP configuration, see https://docs.microsoft.com/en-us/azure/virtual-network/what-is-ip-address-168-63-129-16

  4. Copy the Orchestrator URL and the Activation Key of each Virtual Edge.
    For example:
    • vcoxx-usvi1.velocloud.net
    • Activation Key1: XXXX:ZE8F:YYYY:67YT
    • Activation Key2: XXXX:ZE8F:ZZZZ:67YT
  5. Login to the Azure portal and search for the "VMware SD-WAN in vWAN" application in the Azure Market place. The VMware SD-WAN in vWAN managed application page appears. You can use this application to automate the deployment of Virtual Edges in Virtual WAN Hub.
  6. Click Create on the managed application and enter the following basic details:
    • Subscription: The subscription which has the created Virtual WAN hub.
    • Resource Group: Create a new resource group or select the existing one. 
    • Region: Select the region in which the Virtual WAN Hub is created. Virtual Edges will be deployed in that Virtual WAN Hub.
    • Application Name: Enter a name for your managed application. 
    • Managed Resource Group - Provide the application's managed resource group. The managed resource group holds all the resources that are required by the managed application which the consumer has limited access to.
  7. In the VMware SD-WAN in Virtual WAN tab, select Virtual WAN Hub in the selected region. The Virtual Edges will be deployed in this Hub.
    Once the customer selects a Virtual WAN Hub, the following information appears listing the BGP neighbor IP Addresses and the ASN of the Virtual WAN Hub. Make a note of this information as it is needed to configure BGP neighborships on the Orchestrator.
    • Scale unit: Select the scale as required.
    • VMware SD-WAN Orchestrator: Paste the Orchestrator URL from Step 3.
    • IgnoreCertErrors: Set this flag as False. Change this flag to True only if the Orchestrator URL cannot be used and the Orchestrator IP address must be provided.
    • ActivationKey for Edge1: Paste the activation key from Step 3.
    • ActivationKey for Edge2: Paste the activation key from Step 3.
    • BGP ASN: The ASN that will be configured on the Virtual Edges in the VMware SASE Orchestrator. The following ASNs are reserved by Azure or IANA:
      • ASNs reserved by Azure:
        • Public ASNs: 8074, 8075, and 12076.
        • Private ASNs: 65515, 65517, 65518, 65519, and 65520.
      • ASNs reserved by IANA:
        • 23456, 64496-64511, 65535-65551, and 429496729.
    • ClusterName: Enter a unique name for the deployment which does not inlcude special characters such as #, @, _, -, and so on. 
  8. After entering all the required fields, click Review + create.
  9. The deployment process will start and takes approximately 10 to 15 minutes to complete. Once the deployment is complete, the Virtual Edges will connect and activate against the Orchestrator. 
  10. Once all of the Virtual Edges are connected to the Orchestrator, you need to configure static routes and BGP neighbors so that the Virtual Edges can connect to the Azure Virtual WAN Hub: 
    1. Configure Static Routes: Add /32 static routes sufficient that there is a unique route pointing to the respective GE2 Interface on each Virtual Edge. To add a static route, the Orchestrator requires a next hop IP address. Acquire the next hop IP address by running the Remote Diagnostic “Interface Status” test in the Remote Diagnostics UI page of the Orchestrator. Select the first IP address of the subnet assigned to GE2 and configure it as the next hop.
      The following image shows an IP address assigned to GE2 as 10.101.112.6/25 and the first IP address of this subnet is 10.101.112.1, which is used to configure the static route on the Orchestrator. 

      The following is the output from Test & Troubleshoot > Remote Diagnostics > Interface Status diagnostic test.

      Two static routes are configured on the Edge to reach BGP neighbors as shown in the following screenshot.

    2. BGP Neighbor Configuration: Configure BGP neighbors for each Virtual Edge as shown in the following diagram. Use BGP neighbor IPs and the ASN number as displayed in the information message in Step 7.

      Once static routes and BGP neighborships are configured, the Virtual Edges should begin learning routes from the Azure Virtual WAN Hub. BGP neighborship status can be verified under Monitor > Network Services.

  11. (Optional) Add the Virtual Edges into a cluster. Go to Configure > Network Services > Edge Cluster, create a new cluster Hub and add the Virtual Edges into the cluster.
  12. (Optional) To add a Virtual Network Connection with the Virtual Networks (vNETs) to the vHub, go to Azure vWAN > Connectivity > Virtual network connections.
    Click on Add Connection and provide a Connection Name, Choose the Hub, Subscription, and Resource Group. Select the vNET and the associated Route table that needs to be connected to the Hub. For example, it is the ‘default’ route table in a vNET.
    For the vWAN NVA Edge, the image is a 2 NIC Deployment, in other words the GE1 interface is not used as the ‘Management’ interface. This is unique to the vWAN NVA image. In the cloud_init, set the ‘management_interface’ flag to 'False'. 
    #cloud-config
password: Velocloud123
chpasswd: { expire: False } 
ssh_pwauth: True 
velocloud:
  vce:
    management_interface: false 
    vco: $vco 
    activation_code: $velo2_token 
    vco_ignore_cert_errors: $velo_ignore_cert_errors

    On all other cloud Edges, the GE1 interface is allocated as a ‘Management’ interface and cannot be used for data traffic.

    Note: For Customers whose Azure vWAN Hub Routers are created with 'Cloud Services infrastructure', see Hub Upgrade Instructions for VMware SD-WAN Edge Deployed as Azure vWAN NVA.

    Accessing the Command Line of Virtual Edges Deployed into an Azure vWAN vHub

    Azure vWAN is operated as a managed service. Unlike other virtual machines deployed into Azure, vWAN does not offer the ability to associate a public key to the virtual machine (VM) when it is configured. Since Azure also does not allow password-based SSH authentication, this effectively renders the CLI of the vEdge unreachable.

    To overcome these restrictions and access the vEdge's CLI for troubleshooting and operational purposes, the VMware SD-WAN's Secure Edge Access feature should be used. This will use the Orchestrator to create key-based, per-user SSH access to the vEdge's CLI.

    Refer to the following documentation to enable Secure Edge Access:

    Access SD-WAN Edges Using Key-based Authentication with New Orchestrator UI

    Note: During Secure Edge Access key creation process, specifying a password is listed as "optional." However, including a password is required to be configured to access Azure NVAs. The user will be prompted to provide the password during the SSH login process after first using key-based authentication.