SD-WAN Cloud OnRamp Configuration¶
vManage Configuration for Multi-Cloud¶
Cloud OnRamp Settings:
# vManage Cloud OnRamp Configuration (YAML representation)
cloud_onramp:
## AZURE EXPRESSROUTE
azure_expressroute:
enabled: true
circuits:
- name: Mumbai-ExpressRoute
region: Central India
bandwidth: 10 Gbps
circuit_id: /subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.Network/expressRouteCircuits/mumbai-er
bgp_asn_azure: 12076
bgp_asn_abhavtech: 65000
peering_type: Microsoft # Office 365
vlan_id: 4001
ipv4_primary: 169.254.200.0/30
ipv4_secondary: 169.254.200.4/30
- name: London-ExpressRoute
region: UK South
bandwidth: 10 Gbps
circuit_id: /subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.Network/expressRouteCircuits/london-er
bgp_asn_azure: 12076
bgp_asn_abhavtech: 65001
peering_type: Microsoft
vlan_id: 4002
ipv4_primary: 169.254.200.8/30
ipv4_secondary: 169.254.200.12/30
- name: NJ-ExpressRoute
region: East US
bandwidth: 10 Gbps
circuit_id: /subscriptions/xxx/resourceGroups/yyy/providers/Microsoft.Network/expressRouteCircuits/nj-er
bgp_asn_azure: 12076
bgp_asn_abhavtech: 65002
peering_type: Microsoft
vlan_id: 4003
ipv4_primary: 169.254.200.16/30
ipv4_secondary: 169.254.200.20/30
route_filtering:
- name: Allow-Office365
action: permit
prefixes:
- 52.96.0.0/14
- 52.104.0.0/14
- 52.112.0.0/14
- 40.96.0.0/12
- name: Allow-Azure-AD
action: permit
prefixes:
- 40.126.0.0/18
## AZURE VIRTUAL WAN
azure_virtual_wan:
enabled: true
hubs:
- name: vwan-hub-mumbai
region: Central India
address_space: 10.200.0.0/23
vpn_gateway_scale_unit: 3 # 1.25 Gbps per unit × 3 = 3.75 Gbps
bgp_asn: 65515 # Auto-assigned by Azure
public_ip: 52.172.x.x
branch_connections:
- branch: Bangalore
hub: vwan-hub-mumbai
connection_type: ipsec
bandwidth: 500 Mbps
bgp_enabled: true
local_asn: 65010
advertised_routes:
- 192.168.50.0/24 # Bangalore LAN
- branch: Delhi
hub: vwan-hub-mumbai
connection_type: ipsec
bandwidth: 300 Mbps
bgp_enabled: true
local_asn: 65011
advertised_routes:
- 192.168.51.0/24 # Delhi LAN
## UMBRELLA SASE (DIA)
umbrella_sase:
enabled: true
org_id: 1234567
api_key: <encrypted>
tunnels:
- site: Mumbai
tunnel_type: ipsec
pop: Mumbai
pop_ip: 203.0.113.100
bandwidth: 1 Gbps
- site: Bangalore
tunnel_type: ipsec
pop: Mumbai
pop_ip: 203.0.113.100
bandwidth: 500 Mbps
## ... (all 19 sites)
dns_policy:
forwarders:
- 208.67.222.222 # Umbrella Anycast DNS
- 208.67.220.220
web_policy:
categories_blocked:
- adult-content
- gambling
- malware
- phishing
firewall_policy:
default_action: deny
allowed_ports:
- 80 # HTTP
- 443 # HTTPS
- 53 # DNS
Application-Aware Routing Policy¶
Traffic Steering by Application:
## vManage Centralized Policy - Application-Aware Routing
policy:
name: Abhavtech-Multi-Cloud-Routing
description: Steer traffic to appropriate cloud based on application
sequences:
## SEQUENCE 10: Corporate Apps → MPLS
- sequence: 10
match:
destination_cidr: 10.252.0.0/16
applications:
- erp-abhavtech
- intranet
- file-servers
actions:
transport: mpls
sla_class: business-critical
preferred_color: mpls
backup_color: dia
## SEQUENCE 20: Office 365 → ExpressRoute
- sequence: 20
match:
applications:
- office365-exchange
- office365-sharepoint
- office365-teams
destination_cidr:
- 52.96.0.0/14
- 52.104.0.0/14
- 52.112.0.0/14
actions:
transport: expressroute
sla_class: real-time
preferred_color: azure-expressroute
backup_color: dia
qos_marking: EF # Expedited Forwarding for Teams voice
## SEQUENCE 30: Azure Workloads → Virtual WAN
- sequence: 30
match:
destination_cidr:
- 10.100.0.0/16 # Azure VNet prod
- 10.101.0.0/16 # Azure VNet shared
applications:
- azure-sql
- azure-storage
- azure-vm-rdp
actions:
transport: azure-virtual-wan
sla_class: business-critical
preferred_color: dia # IPsec over internet to Virtual WAN
backup_color: mpls # Failover to hub
## SEQUENCE 40: GCP Vertex AI → Umbrella DIA
- sequence: 40
match:
destination_fqdn:
- "*.googleapis.com"
- "*.google.com"
applications:
- gcp-console
- vertex-ai-api
actions:
transport: umbrella-dia
sla_class: business-critical
preferred_color: dia
security_inspection: umbrella
## SEQUENCE 50: SaaS Apps → Umbrella DIA
- sequence: 50
match:
applications:
- salesforce
- workday
- servicenow
- zoom
saas_categories:
- collaboration
- crm
- hr
actions:
transport: umbrella-dia
sla_class: interactive
preferred_color: dia
security_inspection: umbrella
## SEQUENCE 60: Internet → Umbrella DIA
- sequence: 60
match:
destination_cidr: 0.0.0.0/0 # Default route
actions:
transport: umbrella-dia
sla_class: best-effort
preferred_color: dia
security_inspection: umbrella
SLA Monitoring & Failover¶
Path Performance Monitoring:
sla_monitoring:
## Office 365 via ExpressRoute
- name: Office365-ER-SLA
test_type: http
target: outlook.office365.com
interval: 60 seconds
thresholds:
latency: 15ms
jitter: 5ms
packet_loss: 0.5%
actions_on_breach:
- alert: send_email
recipients:
- network-ops@abhavtech.com
- failover: switch_to_dia
duration: 10 minutes
- ticket: create_servicenow
priority: P2
## Azure Virtual WAN
- name: Azure-VWAN-SLA
test_type: icmp
target: 10.100.2.10 # Azure SQL private endpoint
interval: 30 seconds
thresholds:
latency: 30ms
jitter: 10ms
packet_loss: 1%
actions_on_breach:
- alert: send_slack
channel: "#network-alerts"
- failover: switch_to_mpls_hub
duration: 15 minutes
## GCP Vertex AI
- name: GCP-Vertex-SLA
test_type: https
target: aiplatform.googleapis.com
interval: 120 seconds
thresholds:
latency: 100ms
jitter: 20ms
packet_loss: 2%
actions_on_breach:
- alert: send_email
recipients:
- mlops@abhavtech.com
- log: splunk
severity: warning