Silver Peak Orchestrator Operator's Guide 8.7 2019 200095-001 Silver Peak Orchestrator Operator's Guide Copyright and Trademarks Silver Peak Orchestrator Operator's Guide Date: June 2019 Copyright © 2019 Silver Peak Systems, Inc. All rights reserved. Information in this document is subject to change at any time. Use of this documentation is restricted as specified in the End User License Agreement. No part of this documentation can be reproduced, except as noted in the End User License Agreement, in whole or in part, without the written consent of Silver Peak Systems, Inc. Trademark Notification Silver Peak, the Silver Peak logo, and all Silver Peak product names, logos, and brands are trademarks or registered trademarks of Silver Peak Systems, Inc. in the United States and/or other countries. All trademark rights reserved. All other product names, logos, and brands are property of their respective owners. Warranties and Disclaimers THIS DOCUMENTATION IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. SILVER PEAK SYSTEMS, INC. ASSUMES NO RESPONSIBILITY FOR ERRORS OR OMISSIONS IN THIS DOCUMENTATION OR OTHER DOCUMENTS WHICH ARE REFERENCED BY OR LINKED TO THIS DOCUMENTATION. REFERENCES TO CORPORATIONS, THEIR SERVICES AND PRODUCTS, ARE PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED. IN NO EVENT SHALL SILVER PEAK SYSTEMS, INC. BE LIABLE FOR ANY SPECIAL, INCIDENTAL, INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER, INCLUDING, WITHOUT LIMITATION, THOSE RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT OF OR IN CONNECTION WITH THE USE OF THIS DOCUMENTATION. THIS DOCUMENTATION MAY INCLUDE TECHNICAL OR OTHER INACCURACIES OR TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW EDITIONS OF THE DOCUMENTATION. SILVER PEAK SYSTEMS, INC. MAY MAKE IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE PROGRAM(S) DESCRIBED IN THIS DOCUMENTATION AT ANY TIME. Silver Peak Systems, Inc. 2860 De La Cruz Boulevard Santa Clara, CA 95050 1.877.210.7325 (toll-free in USA) +1.408.935.1850 http://www.silver-peak.com/support — 2 — Silver Peak Orchestrator Operator's Guide Support For product and technical support, contact Silver Peak Systems at either of the following: 1.877.210.7325 (toll-free in USA) +1.408.935.1850 www.silver-peak.com/support We’re dedicated to continually improving the usability of our products and documentation. If you have suggestions or feedback for our documentation, please send an e-mail to [email protected]. If you have comments or feedback about the interface, please send an e-mail to [email protected]. — 3 — Silver Peak Orchestrator Operator's Guide Contents Copyright and Trademarks 2 Support 3 Getting Started 13 Overview of SD-WAN Prerequisites 14 Unity Overlays 18 Deployment Profiles 19 Mapping Labels to Interfaces 19 LAN–side Configuration: DHCP 19 WAN–side Configuration 20 Definitions 21 A More Comprehensive Guide to Basic Deployments 22 Bridge Mode 23 Router Mode 24 Server Mode 29 Deployment — EdgeConnect HA 30 Enabling EdgeConnect HA Mode 30 IPSec over UDP Tunnel Configuration 30 VRRP Configuration 31 LAN-Side Monitoring 31 Business Intent Overlays 32 Order of Operations 33 Match Traffic 33 Topology 33 WAN Links & Bonding Policy 34 Link Bonding Policy 35 Internet Traffic 36 Traffic Management 37 Interface Labels 38 Firewall Zones 39 Apply Overlays 40 Internet Traffic 41 IPSec Pre-shared Key Rotation 42 Failure Handling and Orchestrator Reachability 42 Hubs 44 Discovered Appliances 45 Preconfigure Appliances 47 Appliance Configuration Wizard 49 Licenses 52 How to RMA your device 52 Cloud Portal 53 — 4 — Silver Peak Orchestrator Operator's Guide SSL Certificates Tab 54 SSL CA Certificates Tab 55 SSL for SaaS Tab 57 Network Configuration Tabs 59 Virtual Tunnel Interface 60 VTI 61 Deployment Tab 62 Interfaces Tab 65 Terminology 66 Routes Tab 67 BGP Tab 71 OSPF Tab 75 Enabling OSPF 75 Adding an Interface 78 Viewing the OSPF Neighbors 81 Multicast 83 Loopback 85 Peer Priority Tab 86 Admin Distance Tab 87 Management Routes Tab 88 Import 89 Notes 89 VRRP Tab 90 VRRP Tab Settings 90 WCCP Tab 92 WCCP Settings 93 Service Group Advanced Settings 94 PPPoE Tab 96 DHCP Server Defaults 99 DHCP Settings 99 DHCP/BOOTP Relay Fields 100 DHCP Leases 101 Tunnels Tab 102 Troubleshooting 104 Using Passthrough Tunnels 104 Tunnel Groups Tab 106 Topology 107 Interfaces 107 Tunnel Exception 108 Schedule Auto MTU Discovery 109 Zscaler Internet Access 110 Enabling Zscaler 113 Verification 113 Policy Configuration Tabs 115 Route Policies Tab 116 — 5 — Silver Peak Orchestrator Operator's Guide Priority 117 Match Criteria 117 Source or Destination 118 Wildcard-based Prefix Matching 118 QoS Policies Tab 119 Handling and Marking DSCP Packets 120 Applying DSCP Markings to Optimized (Tunnelized) Traffic 120 Applying DSCP Markings to Pass-through Traffic 122 Priority 124 Match Criteria 124 Source or Destination 125 Wildcard-based Prefix Matching 125 Schedule QoS Map Activation 126 Optimization Policies Tab 127 Priority 127 Match Criteria 128 Source or Destination 128 Wildcard-based Prefix Matching 128 Set Actions 129 TCP Acceleration Options 130 NAT Policies Tab 134 Advanced Settings 136 Match Critera 136 Source or Destination 137 Wildcard-based Prefix Matching 137 Set Actions 137 Merge / Replace 138 Inbound Port Forwarding 139 Security Policies Tab 142 Wildcard-based Prefix Matching 142 Access Lists Tab 144 Match Criteria 145 Wildcard-based Prefix Matching 145 Shaper Tab 146 SaaS Optimization Tab 149 Configuration Tab 149 Monitoring Tab 150 Application Definitions 151 Application Groups Tab 153 Threshold Crossing Alerts Tab 154 ON by default: 155 OFF by default: 156 IP SLA Tab 158 Monitor Use Cases 159 Configuration Templates 169 Using Configuration Templates 170 System Template 171 — 6 — Silver Peak Orchestrator Operator's Guide Auth/Radius/TACACS+ Template 178 Authentication and Authorization 178 Appliance-based User Database 178 RADIUS 179 TACACS+ 179 What Silver Peak recommends 179 SNMP Template 180 Flow Export Template 183 DNS Proxy Policies 185 DNS Proxy Policies 186 DNS Template 187 Logging Template 188 Minimum Severity Levels 188 Configuring Remote Logging 189 Banner Messages Template 190 HTTPS Certificate Template 191 User Management Template 193 Default User Accounts 193 Command Line Interface privileges 194 Date/Time Template 195 Data Collection 196 SSL Certificates Template 197 SSL CA Certificates Template 199 SSL for SaaS Template 200 Tunnels Template 202 VRRP Template 205 Peer Priority Template 207 Admin Distance Template 208 Shaper Template 210 Dynamic Rate Control 211 Route Policies Template 213 Why? 214 Priority 214 Match Criteria 215 Source or Destination 215 Wildcard-based Prefix Matching 215 Set Actions Fields 216 Where the appliance directs traffic 216 How traffic is managed if a tunnel is down 216 QoS Policies Template 217 Priority 217 Match Criteria 218 Source or Destination 218 Wildcard-based Prefix Matching 218 Handling and Marking DSCP Packets 219 Applying DSCP Markings to Optimized (Tunnelized) Traffic 219 Applying DSCP Markings to Pass-through Traffic 221 Optimization Policies Template 224 — 7 — Silver Peak Orchestrator Operator's Guide Priority 224 Match Criteria 224 Source or Destination 225 Wildcard-based Prefix Matching 225 Set Actions Fields 226 NAT Policies Template 227 When to NAT 227 Advanced Settings 229 Match Critera 229 Source or Destination 230 Wildcard-based Prefix Matching 230 Set Actions 230 Merge / Replace 231 Threshold Crossing Alerts Template 232 ON by default: 233 OFF by default: 233 TCA Metrics 234 SaaS Optimization Template 236 TIPS 238 Security Policies Template 239 Implicit Drop Logging 239 Template 239 Wildcard-based Prefix Matching 240 CLI Template 241 Session Management Template 242 Apply Template Groups 243 Monitoring Status and Performance 244 Dashboard 245 Topology Settings & Legend 246 Viewing Tunnels in the Topology Map 249 Live View 250 Historical Charts 251 Health Map 253 Alarms Tab 255 Disable Alarms 255 Alarm Severity 256 Alarm Recipients 256 Additional Alarm Indications 257 Configuring & Distributing Custom Reports 258 View Reports 260 Sample Report 261 Scheduled & Historical Jobs 262 Appliance Bandwidth 263 Appliance Max Bandwidth 264 Appliance Bandwidth Utilization 265 Appliance Bandwidth Trends 266 Appliance Packet Counts 267 — 8 — Silver Peak Orchestrator Operator's Guide Appliance Bandwidth Cost Savings 268 Application Bandwidth 269 Application Pie Charts 270 Application Trends 271 Firewall Drops 272 Top Talkers 273 Domains 275 Countries 276 Ports 277 Traffic Behavior 278 Overlay-Interface-Transport 280 Interface Bandwidth Trends 282 Interface Summary 283 Tunnels Bandwidth 284 Show Underlays 284 Traceroute 285 Live View 285 Tunnels Pie Charts 287 Tunnel Bandwidth Trends 288 Tunnel Packet Counts 289 DRC Bandwidth Trends 290 Dynamic Rate Control 290 Flows - Active & Recent 292 Reset or Reclassify Flows 293 Appliance Flow Counts 296 Appliance Flow Trends 297 Tunnel Flow Counts 298 DSCP Bandwidth 299 DSCP Pie Charts 300 DSCP Trends 301 Traffic Class Bandwidth 302 Traffic Class Pie Charts 303 QoS (Shaper) Trends 304 Live View 305 Loss 306 Loss Trends 307 Jitter Summary 309 Jitter Trends 310 Latency 312 Latency