Week 2 Day 1: Azure Virtual WAN Automated Gateway

Cloud OnRamp for IaaS automates optimal path selection from SD-WAN sites to Azure VNets via Virtual WAN.

Configure IaaS Cloud Gateway in vManage

Navigate: Configuration → Cloud OnRamp for IaaS → Azure

Step 1: Connect Azure Subscription

Cloud Provider: Microsoft Azure
Subscription ID: <YOUR_SUBSCRIPTION_ID>
Client ID: <SERVICE_PRINCIPAL_APP_ID>
Client Secret: <SERVICE_PRINCIPAL_SECRET>
Tenant ID: <AZURE_AD_TENANT_ID>

Create Azure Service Principal for vManage:

# Run in Azure CLI

az login

## Create service principal for vManage

az ad sp create-for-rbac \
  --name "vManage-CloudOnRamp" \
  --role "Contributor" \
  --scopes "/subscriptions/<SUBSCRIPTION_ID>"

## Output (save all values for vManage):

## {

##   "appId": "<CLIENT_ID>",

##   "displayName": "vManage-CloudOnRamp",

##   "password": "<CLIENT_SECRET>",

##   "tenant": "<TENANT_ID>"

## }


## Grant Network Contributor for VNet/VPN operations

az role assignment create \
  --assignee <CLIENT_ID> \
  --role "Network Contributor" \
  --scope "/subscriptions/<SUBSCRIPTION_ID>"

Step 2: Configure Virtual WAN in vManage

Navigate: Configuration → Cloud OnRamp for IaaS → Add Virtual WAN

Virtual WAN Name: abhavtech-vwan
Resource Group: abhavtech-networking
Region: Central India
Hub Address Space: 10.200.0.0/23
VPN Gateway Scale Unit: 3 (VpnGw3)

SD-WAN Sites to Connect:
  ✅ MUM-HUB-01 (color: mpls, dia)
  ✅ MUM-HUB-02 (color: mpls, dia)
  ✅ LON-HUB-01 (color: mpls, dia)
  ✅ NJ-HUB-01  (color: mpls, dia)
  ✅ BLR-ISR-01 (color: dia, lte)
  ✅ DEL-ISR-01 (color: dia, lte)
  [+ all remaining 13 branch sites]

vManage automatically: 1. Creates IPsec tunnels from all SD-WAN sites to Azure VPN Gateway 2. Configures BGP peering (ASN 65515 ↔ site ASNs) 3. Exchanges route advertisements 4. Updates SD-WAN OMP routes with Azure VNet prefixes

---

Week 2 Day 2: IaaS Policy for Azure VNets

Control Policy: Advertise Azure Routes to Branches

Navigate: Configuration → Policies → Control Policy → New

Policy Name: Azure-IaaS-Route-Distribution
Description: Redistribute Azure VNet routes to all SD-WAN sites

Sequences:

SEQ 10: Accept Azure VNet Routes from Hub (Cloud Gateway)
  Match:
    TLOC: Hub sites (MUM, LON, NJ)
    Prefix: 10.100.0.0/16, 10.101.0.0/16 (Azure VNets)
  Action:
    Accept
    Set: Community azure-vnet
    Set: Preference 100

SEQ 20: Distribute to Branch Sites
  Match:
    Community: azure-vnet
  Action:
    Accept
    Advertise to: All branches

SEQ 999: Default
  Action: Reject

Data Policy: Azure Traffic Steering

Policy Name: Azure-IaaS-Data-Policy
Apply to: All sites

SEQ 10: Azure SQL (Private Endpoint)
  Match:
    Destination: 10.100.10.0/24 (private endpoints subnet)
    Protocol: TCP
    Destination Port: 1433 (SQL)
  Action:
    Preferred Color: dia (IPsec tunnel to Azure Virtual WAN)
    Fallback: mpls
    DSCP Set: AF21
    Log: Enabled

SEQ 20: Azure App Servers
  Match:
    Destination: 10.100.2.0/24 (application servers)
    Protocol: TCP
    Destination Port: 443, 8443
  Action:
    Preferred Color: dia
    Fallback: mpls
    DSCP Set: AF21

SEQ 30: Azure Management
  Match:
    Destination: 10.101.1.0/24 (management subnet)
    Protocol: TCP
    Destination Port: 22, 3389, 443
  Action:
    Preferred Color: mpls (management traffic via MPLS)
    Fallback: dia
    DSCP Set: CS3

SEQ 40: All Azure Traffic (Catch-all)
  Match:
    Destination: 10.100.0.0/16, 10.101.0.0/16
  Action:
    Preferred Color: dia
    Fallback: mpls

---

Week 2 Day 3: Multi-Region Azure Failover

Configure Redundant Gateways

For hub sites with multiple transports, configure failover:

! MUM-HUB-01 — Azure Virtual WAN BGP with failover
! Primary: DIA transport to Azure VPN GW
! Backup: MPLS transport via hub backhaul

router bgp 65000
 ! Azure VPN Gateway via DIA tunnel (Primary)
 neighbor 10.200.0.254 remote-as 65515
 neighbor 10.200.0.254 description AZURE-VWAN-VIA-DIA
 neighbor 10.200.0.254 update-source Tunnel200   ! DIA tunnel to Azure
 neighbor 10.200.0.254 ebgp-multihop 3

 ! Azure VPN Gateway via MPLS (Secondary - higher cost, backup)
 neighbor 10.200.0.253 remote-as 65515
 neighbor 10.200.0.253 description AZURE-VWAN-VIA-MPLS
 neighbor 10.200.0.253 update-source Tunnel201   ! MPLS tunnel to Azure
 neighbor 10.200.0.253 ebgp-multihop 3

 address-family ipv4
  neighbor 10.200.0.254 activate
  neighbor 10.200.0.254 route-map AZURE-VNETS-IN in
  neighbor 10.200.0.254 route-map ABHAVTECH-SUBNETS-OUT out
  neighbor 10.200.0.254 route-map SET-LOCALPREF-200 in   ! Prefer DIA path

  neighbor 10.200.0.253 activate
  neighbor 10.200.0.253 route-map AZURE-VNETS-IN in
  neighbor 10.200.0.253 route-map ABHAVTECH-SUBNETS-OUT out
  neighbor 10.200.0.253 route-map SET-LOCALPREF-100 in   ! Backup MPLS path
 exit-address-family

Failover Test Procedure

## Step 1: Baseline — verify Azure VNets reachable via DIA

ssh admin@mum-hub-01
show ip route 10.100.2.0
## Expected: Via Tunnel200 (DIA), LOCAL_PREF 200


## Step 2: Simulate DIA failure

ssh admin@mum-hub-01
configure terminal
interface Tunnel200
 shutdown

## Step 3: Verify failover to MPLS

show ip route 10.100.2.0
## Expected: Via Tunnel201 (MPLS), LOCAL_PREF 100

## Convergence: <30 seconds (BGP hold timer)


## Step 4: Verify Azure SQL connectivity during failover

ping 10.100.10.10 repeat 100
## Expected: Minimal packet loss during path switch


## Step 5: Restore DIA

interface Tunnel200
 no shutdown

## Verify primary path restoration

show ip route 10.100.2.0
## Expected: Back to Tunnel200 (DIA, LOCAL_PREF 200)

---

Week 2 Day 4: Azure IaaS Validation

#!/bin/bash

## azure_iaas_validation.sh


echo "=== AZURE IaaS CLOUD ONRAMP VALIDATION ==="

## Test 1: Cloud OnRamp tunnel status

echo ""
echo "--- IPsec Tunnel Status (All Sites) ---"
for SITE in mum-hub-01 lon-hub-01 nj-hub-01 blr-isr-01 del-isr-01; do
  T200=$(ssh admin@$SITE "show interfaces Tunnel200 | grep 'line protocol'" 2>/dev/null | grep -c "up")
  T201=$(ssh admin@$SITE "show interfaces Tunnel201 | grep 'line protocol'" 2>/dev/null | grep -c "up")
  echo "$SITE: Primary(T200)=$([ $T200 -eq 1 ] && echo UP || echo DOWN) | Backup(T201)=$([ $T201 -eq 1 ] && echo UP || echo DOWN)"
done

## Test 2: Azure route propagation

echo ""
echo "--- Azure VNet Route Propagation ---"
for SITE in mum-hub-01 blr-isr-01 del-isr-01; do
  ROUTE=$(ssh admin@$SITE "show ip route 10.100.2.0" 2>/dev/null | grep -c "10.100")
  [[ $ROUTE -ge 1 ]] && echo "✅ [$SITE]: Azure routes present" || echo "❌ [$SITE]: No Azure routes"
done

## Test 3: Azure SQL connectivity from branches

echo ""
echo "--- Branch to Azure SQL Connectivity ---"
for BRANCH_HOST in "192.168.50.100" "192.168.51.100"; do
  RESULT=$(ping -c 3 -W 5 $BRANCH_HOST 2>/dev/null | grep -c "bytes from")
  [[ $RESULT -ge 1 ]] && echo "✅ Branch $BRANCH_HOST: Reachable" || echo "❌ Branch $BRANCH_HOST: Unreachable"
done

## Test 4: BGP route count to Azure

echo ""
echo "--- Azure Routes via BGP ---"
ROUTES=$(ssh admin@mum-hub-01 "show bgp ipv4 unicast neighbors 10.200.0.254 received-routes | count" 2>/dev/null | tail -1)
echo "Azure VNet routes received: $ROUTES"

echo ""
echo "=== IaaS VALIDATION COMPLETE ==="

---

Week 3: Cloud OnRamp for SASE (Umbrella)