Day 1: vManage Application-Aware Routing Policy¶
Step 1: Define SLA Classes in vManage¶
Navigate to: Configuration → Policies → Lists → SLA Class
SLA Class: REAL-TIME
├── Loss: 1%
├── Latency: 10ms
└── Jitter: 5ms
(Used for: Teams Voice/Video)
SLA Class: BUSINESS-CRITICAL
├── Loss: 1%
├── Latency: 50ms
└── Jitter: 10ms
(Used for: Corporate apps, Azure workloads)
SLA Class: INTERACTIVE
├── Loss: 2%
├── Latency: 100ms
└── Jitter: 20ms
(Used for: Office 365, SaaS)
SLA Class: BEST-EFFORT
├── Loss: 5%
├── Latency: 500ms
└── Jitter: 100ms
(Used for: General internet)
Step 2: Data Prefix Lists¶
Navigate to: Configuration → Policies → Lists → Data Prefix
List: OFFICE365-ALL (Microsoft-published O365 ranges)
13.107.0.0/17, 13.107.64.0/18, 20.190.128.0/18
40.92.0.0/14, 40.96.0.0/13, 40.104.0.0/15
40.107.0.0/17, 40.108.128.0/17, 40.126.0.0/18
52.96.0.0/14, 52.104.0.0/14, 52.108.0.0/14
52.112.0.0/14, 52.120.0.0/14
104.47.0.0/17, 104.146.128.0/17
List: AZURE-VNETS
10.100.0.0/16
10.101.0.0/16
List: CORPORATE-APPS
10.252.0.0/16
Step 3: Application-Aware Routing Policy (vManage JSON)¶
{
"name": "Abhavtech-Multi-Cloud-AAR",
"type": "data",
"description": "Traffic steering for multi-cloud connectivity",
"sequences": [
{
"sequenceId": 10,
"sequenceName": "Corporate-MPLS",
"match": { "destinationDataPrefix": "CORPORATE-APPS" },
"actions": {
"slaClass": "BUSINESS-CRITICAL",
"preferredColor": "mpls",
"backupSlaPreferredColor": "dia"
}
},
{
"sequenceId": 20,
"sequenceName": "Teams-Voice-ExpressRoute",
"match": {
"applications": ["ms-teams"],
"protocol": "udp",
"dscp": "ef"
},
"actions": {
"slaClass": "REAL-TIME",
"preferredColor": "azure-expressroute",
"backupSlaPreferredColor": "dia",
"setDscp": "ef"
}
},
{
"sequenceId": 30,
"sequenceName": "Office365-ExpressRoute",
"match": { "destinationDataPrefix": "OFFICE365-ALL" },
"actions": {
"slaClass": "INTERACTIVE",
"preferredColor": "azure-expressroute",
"backupSlaPreferredColor": "dia",
"setDscp": "af21"
}
},
{
"sequenceId": 40,
"sequenceName": "Azure-VNet-VirtualWAN",
"match": { "destinationDataPrefix": "AZURE-VNETS" },
"actions": {
"slaClass": "BUSINESS-CRITICAL",
"preferredColor": "dia",
"backupSlaPreferredColor": "mpls"
}
},
{
"sequenceId": 50,
"sequenceName": "GCP-APIs-DIA",
"match": { "applications": ["google-apis", "vertex-ai"] },
"actions": {
"slaClass": "INTERACTIVE",
"preferredColor": "dia"
}
},
{
"sequenceId": 999,
"sequenceName": "Default-Internet",
"match": { "destinationDataPrefix": "0.0.0.0/0" },
"actions": {
"slaClass": "BEST-EFFORT",
"preferredColor": "dia"
}
}
]
}
Day 3: QoS Configuration on Hub Routers¶
! ============================================================================
! QOS POLICY - HUB SITES (C8500-12X)
! Apply to ExpressRoute egress interfaces
! ============================================================================
class-map match-any VOICE-CLASS
match dscp ef
class-map match-any VIDEO-CLASS
match dscp af41
class-map match-any BUSINESS-CRITICAL-CLASS
match dscp af21
match dscp cs3
class-map match-any INTERACTIVE-CLASS
match dscp af11
policy-map WAN-EGRESS-QOS
class VOICE-CLASS
priority percent 20
class VIDEO-CLASS
bandwidth percent 20
class BUSINESS-CRITICAL-CLASS
bandwidth percent 30
fair-queue
class INTERACTIVE-CLASS
bandwidth percent 20
fair-queue
class class-default
bandwidth percent 10
fair-queue
! Apply to ExpressRoute sub-interfaces
interface TenGigabitEthernet0/0/2.4001
service-policy output WAN-EGRESS-QOS
interface TenGigabitEthernet0/0/3.4001
service-policy output WAN-EGRESS-QOS
Day 4: End-to-End Validation¶
#!/bin/bash
# e2e_azure_validation.sh
echo "============================================"
echo "AZURE INTEGRATION END-TO-END VALIDATION"
echo "$(date)"
echo "============================================"
## --- EXPRESSROUTE TESTS ---
echo ""
echo "--- ExpressRoute BGP Sessions ---"
for SITE in mum-hub-01 lon-hub-01 nj-hub-01; do
COUNT=$(ssh admin@$SITE "show bgp ipv4 unicast summary | grep -c '12076'" 2>/dev/null)
[[ "$COUNT" -ge 2 ]] && STATUS="✅" || STATUS="❌"
echo "$STATUS [$SITE]: $COUNT/2 Microsoft BGP peers established"
done
## --- OFFICE 365 LATENCY ---
echo ""
echo "--- Office 365 Latency (ExpressRoute) ---"
for HOST in "outlook.office365.com" "teams.microsoft.com" "abhavtech.sharepoint.com"; do
LATENCY=$(ping -c 5 -q $HOST 2>/dev/null | tail -1 | awk -F/ '{printf "%.0f", $5}')
[[ -n "$LATENCY" && "$LATENCY" -lt 20 ]] && STATUS="✅" || STATUS="⚠️ "
echo "$STATUS $HOST: ${LATENCY}ms (threshold: <20ms)"
done
## --- VIRTUAL WAN TUNNELS ---
echo ""
echo "--- Virtual WAN IPsec Tunnels ---"
for BRANCH in "blr-isr-01" "del-isr-01" "hyd-isr-01"; do
STATE=$(ssh admin@$BRANCH "show interfaces Tunnel100 | grep 'line protocol'" 2>/dev/null | grep -c "up")
[[ "$STATE" -ge 1 ]] && echo "✅ [$BRANCH]: Tunnel100 UP" || echo "❌ [$BRANCH]: Tunnel100 DOWN"
done
## --- PRIVATE DNS RESOLUTION ---
echo ""
echo "--- Private Endpoint DNS Resolution ---"
for HOST in "abhavtech-sql.database.windows.net" "abhavtechstorage.blob.core.windows.net"; do
IP=$(nslookup $HOST 10.101.1.10 2>/dev/null | grep "Address" | tail -1 | awk '{print $2}')
if [[ "$IP" == "10.100.10."* ]]; then
echo "✅ $HOST -> $IP (private)"
else
echo "❌ $HOST -> $IP (expected 10.100.10.x)"
fi
done
## --- BRANCH TO AZURE SQL ---
echo ""
echo "--- Branch to Azure SQL Connectivity ---"
for BRANCH_HOST in "blr-test-host" "del-test-host"; do
RESULT=$(ssh user@$BRANCH_HOST "nc -zv 10.100.10.10 1433 -w 5" 2>&1)
[[ "$RESULT" == *"succeeded"* || "$RESULT" == *"Connected"* ]] && \
echo "✅ [$BRANCH_HOST]: SQL port 1433 reachable" || \
echo "❌ [$BRANCH_HOST]: SQL port 1433 NOT reachable"
done
echo ""
echo "============================================"
echo "VALIDATION COMPLETE"
echo "============================================"
Day 5: Production Cutover¶
Pre-Cutover Checklist¶
□ All ExpressRoute BGP sessions: 6/6 established (3 sites × 2 peers)
□ All branch IPsec tunnels: 15/15 established
□ Private endpoint DNS: Returns 10.100.10.x from all hub sites
□ Azure SQL: Reachable from Bangalore, Delhi branches
□ Validation script: All tests PASS
□ vManage AAR policy: Activated on all 19 devices
□ QoS policy: Active on all ExpressRoute interfaces
□ Rollback procedure: Documented and rehearsed
□ Change management: Approved
Cutover Execution¶
## Step 1: Activate vManage policy on all sites
## Via vManage UI: Configuration → Policies → Activate "Abhavtech-Multi-Cloud-AAR"
## Step 2: Monitor traffic on ExpressRoute interfaces
ssh admin@mum-hub-01
watch -n 5 'show interfaces TenGigabitEthernet0/0/2.4001 | include rate'
## Expected: Input rate increases as O365 traffic shifts to ExpressRoute
## Step 3: Monitor for 4 hours
## Check Teams MOS scores in ThousandEyes
## Check SharePoint response times in AppDynamics
## Check user complaints (expect none)
## Step 4: Confirm successful cutover
ssh admin@mum-hub-01
show ip bgp summary | include 12076
## Both peers should show established state with prefix count
echo "✅ Production cutover complete"
Rollback (if needed)¶
! Emergency rollback: Deactivate vManage AAR policy first (via UI)
! Then if needed, clear BGP sessions to drop ExpressRoute routes
router bgp 65000
address-family ipv4
! SD-WAN will automatically fall back to internet DIA within 30 seconds
! No manual action needed beyond deactivating vManage policy
exit-address-family
Appendix A: BGP Verification Commands¶
! BGP session status
show bgp ipv4 unicast summary
! Prefixes from Microsoft
show bgp ipv4 unicast neighbors 169.254.200.1 received-routes
! Verify O365 route path
show bgp ipv4 unicast 52.96.0.0
! Route table for O365
show ip route 52.96.0.0
! BGP debug (use carefully in production)
debug ip bgp 169.254.200.1 events
! IPsec tunnel status (branches)
show crypto ikev2 sa
show crypto ipsec sa
show interfaces Tunnel100
! BGP on branches
show bgp ipv4 unicast summary
show ip route 10.100.0.0