Cisco Intelligent WAN (IWAN) (Networking Technology)

Cover
Title Page
Copyright Page
About the Authors
About the Technical Reviewers
Acknowledgments
Contents
Foreword
Introduction
Part I: Introduction to IWAN
	Chapter 1 Evolution of the WAN
		WAN Connectivity
			Leased Circuits
			Internet
			Multiprotocol Label Switching VPNs (MPLS VPNs)
		Increasing Demands on Enterprise WANs
			Server Virtualization and Consolidation
			Cloud-Based Services
			Collaboration Services
			Bring Your Own Device (BYOD)
			Guest Internet Access
		Quality of Service for the WAN
		Branch Internet Connectivity and Security
			Centralized Internet Access
			Distributed Internet Access
		Cisco Intelligent WAN
			Transport Independence
			Intelligent Path Control
			Application Optimization
			Secure Connectivity
			Zone-Based Firewall
			Cloud Web Security
			Software-Defined Networking (SDN) and Software-Defined WAN (SD-WAN)
		Summary
Part II: Transport Independent Design
	Chapter 2 Transport Independence
		WAN Transport Technologies
			Dial-Up
			Leased Circuits
			Virtual Circuits
			Peer-to-Peer Networks
			Broadband Networks
			Cellular Wireless Networks
			Virtual Private Networks (VPNs)
			Remote Access VPN
			Site-to-Site VPN Tunnels
			Hub-and-Spoke Topology
			Full-Mesh Topology
			Multiprotocol Label Switching (MPLS) VPNs
			Layer 2 VPN (L2VPN)
			Layer 3 VPN (L3VPN)
			MPLS VPNs and Encryption
			Link Oversubscription on Multipoint Topologies
			Dynamic Multipoint VPN (DMVPN)
		Benefits of Transport Independence
			Managing Bandwidth Cost
			Leveraging the Internet
			Intelligent WAN Transport Models
		Summary
	Chapter 3 Dynamic Multipoint VPN
		Generic Routing Encapsulation (GRE) Tunnels
			GRE Tunnel Configuration
			GRE Example Configuration
		Next Hop Resolution Protocol (NHRP)
		Dynamic Multipoint VPN (DMVPN)
			Phase 1: Spoke-to-Hub
			Phase 2: Spoke-to-Spoke
			Phase 3: Hierarchical Tree Spoke-to-Spoke
		DMVPN Configuration
			DMVPN Hub Configuration
			DMVPN Spoke Configuration for DMVPN Phase 1 (Point-to-Point)
			Viewing DMVPN Tunnel Status
			Viewing the NHRP Cache
			DMVPN Configuration for Phase 3 DMVPN (Multipoint)
		Spoke-to-Spoke Communication
			Forming Spoke-to-Spoke Tunnels
			NHRP Route Table Manipulation
			NHRP Route Table Manipulation with Summarization
		Problems with Overlay Networks
			Recursive Routing Problems
			Outbound Interface Selection
			Front-Door Virtual Route Forwarding (FVRF)
			Configuring Front-Door VRF (FVRF)
			FVRF Static Routes
			Verifying Connectivity on an FVRF Interface
			Viewing the VRF Routing Table
		IP NHRP Authentication
		Unique IP NHRP Registration
		DMVPN Failure Detection and High Availability
			NHRP Redundancy
			NHRP Traffic Statistics
			DMVPN Tunnel Health Monitoring
		DMVPN Dual-Hub and Dual-Cloud Designs
		IWAN DMVPN Sample Configurations
		Sample IWAN DMVPN Transport Models
		Backup Connectivity via Cellular Modem
			Enhanced Object Tracking (EOT)
			Embedded Event Manager
		IWAN DMVPN Guidelines
		Troubleshooting Tips
		Summary
		Further Reading
	Chapter 4 Intelligent WAN (IWAN) Routing
		Routing Protocol Overview
		Topology
		WAN Routing Principles
			Multihomed Branch Routing
			Route Summarization
			Traffic Engineering for DMVPN and PfR
		EIGRP for IWAN
			Base Configuration
			Verification of EIGRP Neighbor Adjacencies
			EIGRP Stub Sites on Spokes
			EIGRP Summarization
			EIGRP Traffic Steering
			Complete EIGRP Configuration
			Advanced EIGRP Site Selection
		Border Gateway Protocol (BGP)
			BGP Routing Logic
			Base Configuration
			BGP Neighbor Sessions
			Default Route Advertisement into BGP
			Routes Learned via DMVPN Tunnel Are Always Preferred
			Branch Router Configuration
			Single-Router Branch Sites
			Multiple-Router Branch Sites
			Changing BGP Administrative Distance
			Route Advertisement on DMVPN Hub Routers
			DMVPN Hub LAN Connectivity Health Check
			BGP Route Advertisement on Hub Routers
			BGP Route Filtering
			Redistribution of BGP into OSPF
			Traffic Steering
			Complete BGP Configuration
			Advanced BGP Site Selection
		FVRF Transport Routing
		Multicast Routing
			Multicast Distribution Trees
			Source Trees
			Shared Trees
			Rendezvous Points
			Protocol Independent Multicast (PIM)
			Source Specific Multicast (SSM)
			Multicast Routing Table
			IWAN Multicast Configuration
			Hub-to-Spoke Multicast Stream
			Spoke-to-Spoke Multicast Traffic
			Modify the SPT Threshold
			Modify the Multicast Routing Table
		Summary
		Further Reading
	Chapter 5 Securing DMVPN Tunnels and Routers
		Elements of Secure Transport
		IPsec Fundamentals
			Security Protocols
			Authentication Header
			Encapsulating Security Payload (ESP)
			Key Management
			Security Associations
			ESP Modes
			DMVPN without IPsec
			DMVPN with IPsec in Transport Mode
			DMVPN with IPsec in Tunnel Mode
		IPsec Tunnel Protection
			Pre-shared Key Authentication
			IKEv2 Keyring
			IKEv2 Profile
			IPsec Transform Set
			IPsec Profile
			Encrypting the Tunnel Interface
			IPsec Packet Replay Protection
			Dead Peer Detection
			NAT Keepalives
			Complete Configuration
			Verification of Encryption on IPsec Tunnels
			Private Key Infrastructure (PKI)
			IOS Certificate Authority (CA) Server
			DMVPN Hub PKI Trustpoints
			DMVPN Branch PKI Trustpoints
			PKI IPsec Protection Configurations
			Certificate Registration with Out-of-Band Management Tunnel
		IKEv2 Protection
			Basic IOS CA Management
		Securing Routers That Connect to the Internet
			Access Control Lists (ACLs)
			Zone-Based Firewalls (ZBFWs)
			Self
			Default
			ZBFW Configuration
		Control Plane Policing (CoPP)
			IOS Embedded Packet Capture (EPC)
			IOS XE Embedded Packet Capture
			Analyzing and Creating the CoPP Policy
		Device Hardening
		Summary
		Further Reading
Part III: Intelligent Path Control
	Chapter 6 Application Recognition
		What Is Application Recognition?
		What Are the Benefits of Application Recognition?
		NBAR2 Application Recognition
		NBAR2 Application ID, Attributes, and Extracted Fields
			NBAR2 Application ID
			NBAR2 Application Attributes
			NBAR2 Layer 7 Extracted Fields
		NBAR2 Operation and Functions
			Phases of Application Recognition
			First Packet Classification
			Multistage Classification
			Final Classification
			Further Tracking
			NBAR2 Engine and Best-Practice Configuration
			Multipacket Engine
			DNS Engine
			DNS Authoritative Source (DNS-AS) Engine
			DNS Classification by Domain
			Cisco Intelligent WAN (IWAN) Control and Data Bundling Engine
			Behavioral and Statistical Engine
			Layer 3, Layer 4, and Sockets Engine
			Transport Hierarchy
			Subclassification
		Custom Applications and Attributes
			Auto-learn Traffic Analysis Engine
			Traffic Auto-customization
			Manual Application Customization
			HTTP Customization
			SSL Customization
			DNS Customization
			Composite Customization
			Layer 3/Layer 4 Customization
			Byte Offset Customization
			Manual Application Attributes Customization
		NBAR2 State with Regard to Device High Availability
		Encrypted Traffic
		NBAR2 Interoperability with Other Services
		NBAR2 Protocol Discovery
			Enabling NBAR2 Protocol Discovery
			Displaying NBAR2 Protocol Discovery Statistics
			Clearing NBAR2 Protocol Discovery Statistics
		NBAR2 Visibility Dashboard
		NBAR2 Protocol Packs
			Release and Download of NBAR2 Protocol Packs
			NBAR2 Protocol Pack License
			Application Customization
			NBAR2 Protocol Pack Types
			NBAR2 Protocol Pack States
			Identifying the NBAR2 Software Version
			Verifying the Active NBAR2 Protocol Pack
			Loading an NBAR2 Protocol Pack
			NBAR2 Taxonomy File
			Protocol Pack Auto Update
			Protocol Pack Configuration Server
			Protocol Pack Source Server
		Validation and Troubleshooting
			Verify the Software Version
			Check the Device License
			Verifying That NBAR2 Is Enabled
			Verifying the Active NBAR2 Protocol Pack
			Checking That Policies Are Applied Correctly
			Reading Protocol Discovery Statistics
			Granular Traffic Statistics
			Discovering Generic and Unknown Traffic
			Verifying the Number of Flows
		Summary
		Further Reading
	Chapter 7 Introduction to Performance Routing (PfR)
		Performance Routing (PfR)
			Simplified Routing over a Transport-Independent Design
			“Classic” Path Control Used in Routing Protocols
			Path Control with Policy-Based Routing
			Intelligent Path Control—Performance Routing
			Introduction to PfRv3
		Introduction to the IWAN Domain
			IWAN Sites
			Device Components and Roles
			IWAN Peering
			Parent Route Lookups
		Intelligent Path Control Principles
			PfR Policies
			Site Discovery
			Site Prefix Database
			PfR Enterprise Prefixes
			WAN Interface Discovery
			Hub and Transit Sites
			Branch Sites
			Channel
			Smart Probes
			Traffic Class
			Path Selection
			Direction from Central Sites (Hub and Transit) to Spokes
			Direction from Spoke to Central Sites (Hub and Transit)
			Performance Monitoring
			Threshold Crossing Alert (TCA)
			Path Enforcement
		Summary
		Further Reading
	Chapter 8 PfR Provisioning
		IWAN Domain
		Topology
			Overlay Routing
			Advertising Site Local Subnets
			Advertising the Same Subnets
			Traffic Engineering for PfR
			PfR Components
		PfR Configuration
			Master Controller Configuration
			Hub Site MC Configuration
			Transit Site MC Configuration
			Branch Site MC Configuration
			MC Status Verification
			BR Configuration
			Transit BR Configuration
			Branch Site BR Configuration
			BR Status Verification
			NetFlow Exports
			Domain Policies
			Performance Policies
			Load-Balancing Policy
			Path Preference Policies
			Quick Monitor
			Hub Site Master Controller Settings
			Hub, Transit, or Branch Site Specific MC Settings
			Complete Configuration
		Advanced Parameters
			Unreachable Timer
			Smart Probes Ports
			Transit Site Affinity
		Path Selection
			Routing—Candidate Next Hops
			Routing—No Transit Site Preference
			Routing—Site Preference
			PfR Path Preference
			PfR Transit Site Preference
			Using Transit Site Preference and Path Preference
		Summary
		Further Reading
	Chapter 9 PfR Monitoring
		Topology
		Checking the Hub Site
			Check the Routing Table
			Checking the Hub MC
			Checking the Hub BRs
			Verification of Remote MC SAF Peering with the Hub MC
		Checking the Transit Site
		Check the Branch Site
			Check the Routing Table
			Check Branch MC Status
			Check the Branch BR
		Monitoring Operations
			Routing Table
			Monitor the Site Prefix
			Monitor Traffic Classes
			Monitor Channels
			Transit Site Preference
			With Transit Site Affinity Enabled (by Default)
			With Transit Site Affinity Disabled (Configured)
		Summary
		Further Reading
	Chapter 10 Application Visibility
		Application Visibility Fundamentals
			Overview
			Components
			Flows
			Observation Point
			Flow Direction
			Source/Destination IP Versus Connection
		Performance Metrics
			Application Response Time Metrics
			Media Metrics
			Web Statistics
			HTTP Host
			URI Statistics
		Flexible NetFlow
			Flexible NetFlow Overview
			Configuration Principles
			Create a Flexible NetFlow Flow Record
			Create a Flow Exporter
			Create a Flow Monitor
			Apply a Flow Monitor to the WAN
			Flexible NetFlow for Application Visibility
			Use Case 1: Flow Statistics
			Use Case 2: Application Client/Server Statistics
			Use Case 3: Application Usage
			Monitoring NetFlow Data
			View Raw Data Directly on the Router
			View Reports on NetFlow Collectors
			Flexible NetFlow Summary
		Evolution to Performance Monitor
			Principles
			Performance Monitor Configuration Principles
			Easy Performance Monitor (ezPM)
			Application Statistics Profile
			Application Performance Profile
			Application Experience Profile
			ezPM Configuration Steps
			Monitoring Performance Monitor
		Metrics Export
			Flow Record, NetFlow v9, and IPFIX
			Terminology
			NetFlow Version 9 Packet Header Format (RFC 3954)
			IPFIX Packet Header Format (RFC 7011)
			Monitoring Exports
			Monitoring Performance Collection on Network Management Systems
		Deployment Considerations
			Performance Routing
			Interoperability with WAAS
		Summary
		Further Reading
Part IV: Application Optimization
	Chapter 11 Introduction to Application Optimization
		Application Behavior
			Bandwidth
			Latency
			Application Latency
			Network Latency
		Cisco Wide Area Application Services (WAAS)
			Cisco WAAS Architecture
			Application Optimizers
			Configuration Management System
			Data Redundancy Elimination (DRE) with Scheduler
			Storage
			Network I/O
			Interception and Flow Management
			TCP Optimization
			TCP Windows Scaling
			TCP Initial Window Size Maximization
			Increased Buffering
			Selective Acknowledgment (SACK)
			Binary Increase Congestion (BIC) TCP
		Caching and Compression
			Compression
			Data Redundancy Elimination (DRE)
			Unified Data Store
			Lempel-Ziv (LZ) Compression
			Object Caching
		Application-Specific Acceleration
			Microsoft Exchange Application Optimization
			HTTP Application Optimization
			SharePoint Application Optimization
			SSL Application Optimization
			Citrix Application Optimization
			CIFS Application Optimization
			SMB Application Optimization
			NFS Acceleration
			Akamai Connect
			Transparent Cache
			Akamai Connected Cache
			Dynamic URL HTTP Cache (Over-the-Top Cache)
			Content Prepositioning for Enhanced End-User Experience
		Summary
		Further Reading
	Chapter 12 Cisco Wide Area Application Services (WAAS)
		Cisco WAAS Architecture
			Central Management Subsystem
			Interface Manager
			Monitoring Facilities and Alarms
			Network Interception and Bypass Manager
			Application Traffic Policy Engine
			Disk Encryption
		Cisco WAAS Platforms
			Router-Integrated Network Modules
			Appliances
			WAVE Model 294
			WAVE Model 594
			WAVE Model 694
			WAVE Model 7541
			WAVE Model 7571
			WAVE Model 8541
			Interception Modules
			Virtual WAAS
			ISR-WAAS
			Architecture
			Sizing
			WAAS Performance and Scalability Metrics
		WAAS Design and Performance Metrics
			Device Memory
			Disk Capacity
			Number of Optimized TCP Connections
			WAN Bandwidth and LAN Throughput
			Number of Peers and Fan-out Each
			Central Manager Sizing
			Licensing
		Cisco WAAS Operational Modes
			Transparent Mode
			Directed Mode
		Interception Techniques and Protocols
			Web Cache Communication Protocol
			WCCP Service Groups
			Forwarding and Return Methods
			Load Distribution
			Failure Detection
			Flow Protection
			Scalability
			Redirect Lists
			Service Group Placement
			Egress Methods
			Policy-Based Routing (PBR)
			Inline Interception
			AppNav Overview
			AppNav Cluster Components
			Class Maps
			AppNav Policies
			AppNav Site Versus Application Affinity
			AppNav IOM
			AppNav Controller Deployment Models
			AppNav Controller Interface Modules
			AppNav IOM Interfaces
			Guidelines and Limitations
			AppNav-XE
			Advantages of Using the AppNav-XE Component
			Guidelines and Limitations
		WAAS Interception Network Integration Best Practices
		Summary
		Further Reading
	Chapter 13 Deploying Application Optimizations
		GBI: Saving WAN Bandwidth and Replicating Data
		WAN Optimization Solution
		Deploying Cisco WAAS
			WAAS Data Center Deployment
			GBI Data Centers
			Data Center Device Selection and Placement
			Primary Central Manager
			Initial Primary Central Manager Configuration
			Configuring the Primary Central Manager’s NTP Settings
			Configuring the Primary Central Manager’s DNS Settings
			Configuring WAAS Group Settings
			Device Group Basic Settings
			Standby Central Manager
			Standby Central Manager’s Configuration
		AppNav-XE
			Initial GBI AppNav-XE Deployment
			Deploying a Data Center Cluster
			Deploying a Separate Node Group and Policy for Replication
			Deploying a New Policy for Data Center Replication
		GBI Branch Deployment
			Branch 1 Sizing
			Branch 1 Deployment
			Branch 12 Sizing
			Branch 12 WAAS Deployment
		Summary
Part V: QoS
	Chapter 14 Intelligent WAN Quality of Service (QoS)
		QoS Overview
		Ingress QoS NBAR-Based Classification
		Ingress LAN Policy Maps
		Egress QoS DSCP-Based Classification
		Egress QoS Policy Map
		Hierarchical QoS
		DMVPN Per-Tunnel QoS
			Per-Tunnel QoS Tunnel Markings
			Bandwidth-Based QoS Policies
			Bandwidth Remaining QoS Policies
			Subrate Physical Interface QoS Policies
			Association of Per-Tunnel QoS Policies
			Per-Tunnel QoS Verification
			Per-Tunnel QoS Caveats
		QoS and IPSec Packet Replay Protection
		Complete QoS Configuration
		Summary
		Further Reading
Part VI: Direct Internet Access
	Chapter 15 Direct Internet Access (DIA)
		Guest Internet Access
			Dynamic Host Configuration Protocol (DHCP)
			Network Address Translation (NAT)
			Verification of NAT
			Zone-Based Firewall (ZBFW) Guest Access
			Verification of ZBFW for Guest Access
		Guest Access Quality of Service (QoS)
		Guest Access Web-Based Acceptable Use Policy
			Guest Network Consent
			Guest Authentication
		Internal User Access
		Fully Specified Static Default Route
		Verification of Internet Connectivity
		Cisco Intelligent WAN (IWAN) Network Address Translation (NAT)
		Policy-Based Routing (PBR)
		Internal Access Zone-Based Firewall (ZBFW)
		Cloud Web Security (CWS)
		Baseline Configuration
		Outbound Proxy
		WAAS and WCCP Redirect
		Prevention of Internal Traffic Leakage to the Internet
		Summary
		References in this Chapter
Part VII: Migration
	Chapter 16 Deploying Cisco Intelligent WAN
		Pre-Migration Tasks
			Document the Existing WAN
			Network Traffic Analysis
			Proof of Concept
			Finalize the Design
		Migration Overview
			IWAN Routing Design Review
			EIGRP for the IWAN and the LAN
			BGP for the IWAN and an IGP (OSPF) for the LAN
			Routing Design During Migration
		Deploying DMVPN Hub Routers
		Migrating the Branch Routers
			Migrating a Single-Router Site with One Transport
			Migrating a Single-Router Site with Multiple Transports
			Migrating a Dual-Router Site with Multiple Transports
		Post-Migration Tasks
		Migrating from a Dual MPLS to a Hybrid IWAN Model
		Migrating IPsec Tunnels
		PfR Deployment
		Testing the Migration Plan
		Summary
		Further Reading
Part VIII: Conclusion
	Chapter 17 Conclusion and Looking Forward
		Intelligent WAN Today
		Intelligent WAN Architecture
		Intelligent WAN Tomorrow
Appendix A: Dynamic Multipoint VPN Redundancy Models
Appendix B: IPv6 Dynamic Multipoint VPN
Index
	A
	B
	C
	D
	E
	F
	G
	H
	I
	J
	K
	L
	M
	N
	O
	P
	Q
	R
	S
	T
	U
	V
	W
	X-Y-Z