CloudLabBox
Try the free demo

Cisco Catalyst SD-WAN CLI lab 5 of 14

Control policy - hub and spoke

Turn the default full mesh into hub and spoke with a centralised control policy on the vSmart, and prove that spoke-to-spoke traffic now goes through the data centre.

Run this lab

It needs Standard: its 8 nodes are set to 8 vCPU and 6,656 MB in total.

In your workspace: Shared, then Cisco Catalyst SD-WAN CLI guided labs, then 05 - Control policy - hub and spoke

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 8 vCPU and 6,656 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
8 vCPU, 6,656 MB
Smallest plan
Standard

The scenario

Meridian's security team wants every branch-to-branch flow to pass the data-centre firewall. Today's overlay is a full mesh: Manchester and Leeds talk directly. You turn it into hub and spoke with a centralised control policy, written once on the vSmart, without touching a single WAN edge.

NodeSystem IPSiteINET (ge0/0)LAN, VPN 10 (ge0/1)
vBond10.255.0.11000198.51.100.1
vSmart10.255.0.21000198.51.100.2
DC1 (hub)10.255.0.1010198.51.100.1010.10.10.1/24
BR1 (spoke)10.255.0.1111198.51.100.1110.11.10.1/24
BR2 (spoke)10.255.0.1212198.51.100.1210.12.10.1/24
H3, H1, H210.10.10.10, 10.11.10.10, 10.12.10.10, all fixed

What this course leaves out. There is no SD-WAN Manager (vManage) in any of these labs. A virtual edge can't join the Manager's inventory without a signed device list from Cisco, which these labs don't have. So you won't see the Manager's GUI, dashboards, templates, Policy Builder or zero-touch onboarding. You work at the CLI of the controllers and edges, with a private lab CA and device lists typed by hand. In production you'd build this policy in the Manager's Policy Builder and activate it there. Here you write it on the vSmart CLI. The hosts have fixed addresses set at boot, because the DHCP server on these vEdge images can lock up the edge at start-up.

What you’ll practise

  • Read the default full mesh
  • Write a control policy that filters TLOCs and rewrites next hops
  • Prove the new topology with BFD, routes and traceroute

The tasks

  1. Start the lab
  2. See the full mesh
  3. Plan the policy
  4. Write and apply the policy
  5. Prove the new topology

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Control policy - hub and spoke8 nodes and 1 network, 8 links. Every link is listed as text below the diagram.vBondvSmartDC1BR1BR2H3H1H2INETG0/1eth0G0/1eth0G0/0G0/1eth0ge0/0eth0G0/0G0/0
8 nodes and 1 network, with the interface names each link uses.
Every link, as text
  • vBond ge0/0 to INET (network)
  • vSmart eth0 to INET (network)
  • DC1 G0/0 to INET (network)
  • BR1 G0/0 to INET (network)
  • BR2 G0/0 to INET (network)
  • DC1 G0/1 to H3 eth0
  • BR1 G0/1 to H1 eth0
  • BR2 G0/1 to H2 eth0
Nodes in Control policy - hub and spoke, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
vBondCisco vBondvtbond-20.12.21 vCPU, 1,024 MB
vSmartCisco vSmartvtsmart-20.12.21 vCPU, 1,024 MB
DC1Cisco vEdgevtedge-20.12.21 vCPU, 1,024 MB
BR1Cisco vEdgevtedge-20.12.21 vCPU, 1,024 MB
BR2Cisco vEdgevtedge-20.12.21 vCPU, 1,024 MB
H3Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco Catalyst SD-WAN CLI guided labs.

  3. Open 05 - Control policy - hub and spoke and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco Catalyst SD-WAN CLI labs

All Cisco Catalyst SD-WAN CLI labs

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.