Add a Branch Gateway

• Create a new branch gateway site.

  1. Select ConfigurationPrisma SD-WANBranch SitesAdd Site.
  2. Add a Site Name and optionally enter description and tags.
  3. Enable Configure as a Branch Gateway Site.

  4. Enable Security Group Info and verify the Static SGI value to be between 1 and 65533 for the ION generated traffic. The Security Group Information option is enabled by default for Static tag configuration.
  5. Add the other details to set up a site and click Save & Exit.

  Assign a device to the created branch gateway site, enable L3 Direct Private WAN Forwarding and L3 LAN Forwarding for the device and then configure the interfaces.
• Convert an existing branch site to a branch gateway site.

  You can convert an existing branch site to a branch gateway site.

  Ensure that:

  • The site is in Control mode.
  • You have enabled L3 Direct Private WAN Forwarding.
  • You have enabled L3 LAN Forwarding.
  • There are no any existing branch-to-branch VPN tunnels. If any tunnels exist, Prisma SD-WAN deletes them during the conversion process.

  1. Select ConfigurationBranch Sites and click the ellipsis menu for the site.
  2. Select Switch to Branch Gateway Site.

     Switching a branch site to a branch gateway site causes the ION device to reboot. When you convert a branch site to branch gateway, make sure to have all the branches connected to this branch gateway site (physical and virtual ION devices) running software versions 6.4.1 or higher.

     Alternatively, you can select Branch Sites, select a site and then in the Branch Site Details section, click Edit Site and enable Branch Gateway.
• Edit branch gateway site settings.

  (Optional) After you create a branch gateway site, you can optionally edit the branch gateway site settings.

  Select Prefer LAN Default over WAN in case your topology needs to take the LAN interface (with a default gateway) as the default route. This will mimic the path selection behavior of a data center site where the device forwards all incoming WAN traffic to the LAN peer.

  For example, if the traffic flow is — Branch ↔Branch Gateway ↔ LAN (Firewall → Internet). Typically, the ION device will have a default route (0.0.0.0/0) on the internet (WAN) interfaces (with the next hop as the default gateway configured on the wan interface or from DHCP). This is to steer packets to the internet (for DIA or otherwise) if no other specific route exists. In this particular scenario, the branch gateway site needs to take the LAN interface. The LAN interface has a default gateway configured either statically or via DHCP as a default route as against an internet interface, which would generally have a default route. You can achieve this by adding a default route with a lower admin cost on the LAN interface than the WAN interface when you select Prefer LAN Default over WAN.

  Maximum Branch Site Count Info indicates the maximum number of branch sites that you can associate with a branch gateway site. If you exceed this number, Prisma SD-WAN generates an incident. However, it will still be possible to associate branches to the branch gateway by joining the domain or through the establishment of manual tunnels.
• Create VPNs between branch gateway sites or branch sites.

  Prisma SD-WAN establishes VPN tunnels as follows:

  • Branch -> Branch Gateway (Same Domain) — Prisma SD-WANautomatically builds Fabric VPN tunnels.
  • Branch -> Branch Gateway (Different Domain) — You need to manually configure Fabric VPN Tunnels.
  • Branch Gateway -> DC — Prisma SD-WAN automatically builds VPN tunnels.
  • Branch Gateway -> Branch Gateway — You need to manually configure Fabric VPN Tunnels.

  Avoid deploying Branch Gateways in a full mesh VPN topology when the same branch is connecting to more than one Branch Gateway.

  1. (Optional) Changing the domain of a branch gateway site.

     1. Select a branch gateway site.
     2. Click the ellipsis menu and select Change Site Domain.
     3. Choose the required domain and click Submit.

     Alternatively, you can select Branch Sites, select a site and then in the Branch Site Details section, click Edit Site and change the domain.

     To establish an automatic VPN tunnel between a branch site and a branch gateway site, ensure that both are in the same domain.
  2. (Optional) Create a manual VPN tunnel between two branch gateway sites.

     1. Select ConfigurationBranch Sites and select a branch site.
     2. Select Overlay ConnectionsBranch — Branch GatewayAdd Link.
     3. Select a circuit and select the site for VPN establishment on the Add Secure Fabric Link pop-up.
• Prefix Advertisement

  The branch gateway site performs prefix advertisement and distribution in a variety of topologies.

  Prefix Advertisement

  Learned Via	Advertised To
  Fabric Tunnel	LAN BGP Peer
  Standard VPN Tunnel BGP Peer	LAN BGP Peer
  LAN BGP Peer	Fabric → yes LAN BGP Peer → yes Private WAN BGP Peer → yes
  Private WAN BGP Peer	LAN BGP Peer → yes
  LAN Static Route	Fabric → yes LAN BGP Peer → yes Private WAN BGP Peer → yes

• Default Route in WAN BGP Peer.

  Prisma SD-WAN has enhanced the existing BGP Global configuration to allow an option to choose the default route as part of the prefix advertisement to WAN.

  For a BGP peer, select Advertise Default Route to Peer to distribute the default route to the peer, instead of explicitly configuring a prefix via route-maps.