To provision an SD-WAN Edge, perform the following steps:

Prerequisites

Ensure you have the SD-WAN Orchestrator host name and admin account to login.

Procedure

  1. Log in to the SD-WAN Orchestrator application as Admin user, with your login credentials.
  2. Go to Configure > Edges.
  3. In the Edges screen, click Add Edge. The Provision an Edge screen appears.
  4. You can configure the following options:
    Option Description
    Mode By default, SD-WAN Edge mode is selected.
    Name Enter a unique name for the Edge.
    Model Select Virtual Edge from the drop-down menu.
    Profile Select Quick Start Profile from the drop-down menu.
    Note: If an Edge Staging Profile is displayed as an option due to Edge Auto-activation, it indicates that this Profile is used by a newly assigned Edge, but has not been configured with a production Profile.
    Edge License Select an Edge license from the drop-down menu. The list displays the licenses assigned to the Enterprise, by the Operator.
    Authentication

    Choose the mode of authentication from the drop-down menu:

    • Certificate Deactivated: Edge uses a pre-shared key mode of authentication.
      Warning: This mode is not recommended for any customer deployments.
    • Certificate Acquire: This mode is selected by default and is recommended for all customer deployments. With Certificate Aquire mode, certificates are issued at the time of Edge activation and renewed automatically. The Orchestrator instructs the Edge to acquire a certificate from the certificate authority of the SD-WAN Orchestrator by generating a key pair and sending a certificate signing request to the Orchestrator. Once acquired, the Edge uses the certificate for authentication to the SD-WAN Orchestrator and for establishment of VCMP tunnels.
      Note: After acquiring the certificate, the option can be updated to Certificate Required, if needed.
    • Certificate Required: This mode is only appropriate for customer enterprises that are "static". A static enterprise is defined as one where no more than a few new Edges are likely to be deployed and no new PKI oriented changes are anticipated.
      Important: Certificate Required has no security advantages over Certificate Acquire. Both modes are equally secure and a customer using Certificate Required should do so only for the reasons outlined in this section.
      Certificate Required mode means that no Edge heartbeats are accepted without a valid certificate.
      Caution: Using this mode can cause Edge failures in cases where a customer is unaware of this strict enforcement.
      With this mode, the Edge uses the PKI certificate. Operators can change the certificate renewal time window for Edges by editing the Orchestrator's System Properties. For more information, contact your Operator.
    Note:
    • With the Bastion Orchestrator feature enabled, the Edges that are to be staged to Bastion Orchestrator should have the authentication mode set to either Certificate Acquire or Certificate Required.
    • When an Edge certificate is revoked, the Edge is deactivated and needs to go through the activation process. The current QuickSec design checks certificate revocation list (CRL) time validity. The CRL time validity must match the current time of Edges for the CRL to have impact on new established connection. To implement this, ensure the Orchestrator time is updated properly to match with the date and time of the Edges.
    Encrypt Device Secrets Select the Enable check box to allow the Edge to encrypt the sensitive data across all platforms. This option is also available on the Edge Overview page.
    Note: For Edge versions 5.2.0 and above, before you deactivate this option, you must first deactivate the Edge using remote actions. This causes restart of the Edge.
    High Availability Select the Enable check box to apply High Availability (HA). Edges can be installed as a single standalone device or paired with another Edge to provide High Availability (HA) support.
    Local Contact Name Enter the name of the site contact for the Edge.
    Local Contact Email Enter the email address of the site contact for the Edge.
  5. Enter all the required details and click Next to configure the following additional options:
    Note: The Next button is activated only when you enter all the required details.
    Option Description
    Serial Number Enter the serial number of the Edge. If specified, the Edge must display this serial number on activation.
    Note: When deploying virtual VMware SD-WAN Edges on AWS Edges, make sure to use the instance ID as the serial number for the Edge.
    Description Enter an appropriate description.
    Location Click the Set Location link to set the location of the Edge. If not specified, the location is auto-detected from the IP address when the Edge is activated.
  6. Click Add Edge.
    The Edge is provisioned, and the activation key is displayed on the top of the page. Make a note of the activation key to use it for launching the Edge from the AliCloud Console.
    Note: The activation key expires in one month if the Edge device is not activated against it.
  7. Configure Virtual Edge interfaces. The following steps are explained considering Topology A.
    1. Go to Configure > Edges. The Edges page displays the existing Edges.
    2. Click the link to an Edge or click the View link in the Device column of the Edge. The configuration options for the selected Edge are displayed in the Device tab.
    3. Go to the Interface Settings area.
    4. In the Connectivity category, expand Interfaces. Different types of Interfaces available for the selected Edge are displayed.
    5. Select Override Interface check box. Click the link to the GE2 Interface to edit the settings.
    6. Now click the link to the GE3 Interface and select Override Interface check box.
    7. Deactivate WAN Overlay and NAT Direct Traffic, as this interface will be used LAN-side, and click Save.
      For more information, see the topic Configure Interface Settings for Edges in VMware SD-WAN Administration Guide.
    Note: If you are using an Edge instance with only two interfaces as illustrated in Topology B, then the public interface (GE2) is used for both WAN and LAN connectivity. For the LAN network to point to the GE2 interface, under Static Route Settings, configure a static route on the Edge that points to the Private Subnet/VSwitch.
  8. Under the Configure VLAN area, edit the VLAN settings to update the Edge LAN IP Address.
  9. (Optional) If you are using a Jump Host, to allow SSH access to the Edge from the jump server, make sure to activate the Support Access for the Jump Host server’s IP in the Firewall page.
  10. Click Save.

What to do next