SD-WAN Security and Service Insertion
SD-WAN Security and Service Insertion
This domain covers control-plane and data-plane crypto, enterprise PKI, on-box security, cloud-delivered security, and redirecting traffic through service nodes.
Crypto and identity
- Control plane: DTLS (or TLS) on UDP 12346 with certificate-based authentication, AES and periodic rekey.
- Data plane: IPsec, IKEv1 or IKEv2, AES-GCM, rekey timers, one tunnel per TLOC pair; NAT-T on UDP 4500 when NAT is detected.
- Enterprise PKI: a root CA signs controller and edge certificates, either manually or via SCEP; mismatched roots break the handshake.
On-box security
- Zone-based firewall on cEdge: define zones (inside, outside, tunnel) and inter-zone policies; a zone that omits the tunnel interface silently bypasses inspection.
- Unified Threat Defense on cEdge: Snort-based IPS and URL filtering, which requires the security virtual image, a resource profile, and a security feature template; signatures update from vManage.
Cloud security and SASE
- Cloud OnRamp for SaaS probes SaaS reachability (static, DNS or HTTP) and steers users to the better direct or backhauled path, for example Microsoft 365.
- Umbrella integration adds DNS-layer security and a SIG tunnel for internet-bound traffic.
- Cloud OnRamp for IaaS extends the fabric into AWS, Azure or GCP with a hosted virtual WAN Edge.
Service insertion
A service node (a WAN Edge or supported third-party VM) connects to a service VPN and advertises a service TLOC through OMP. A centralized data policy then matches traffic and applies a service action referencing an ordered service chain; the packet is redirected to the first node, then the next, then accepted.
Worked example
Internet-bound traffic from VPN 10 must be inspected by a firewall sitting in VPN 10. Add the service node interface to VPN 10, confirm it advertises its service TLOC, define a service chain with that node, and add a traffic data policy: match VPN 10 and 0.0.0.0/0, action service chain, then accept. Verify with show sdwan omp services and the vManage service-insertion monitor.
Traps
- Chain order matters; reversing it sends traffic to the wrong node first.
- Omitting the service VPN from VPN membership hides the routes the policy needs.
- Forgetting the trailing accept drops traffic after inspection.
- UTD will not start without the security virtual image and a compatible resource profile.