Add a Branch Gateway

Create a new branch gateway site.

Select
Workflows
Branch Sites
Add Site
.
Add a
Site Name
and optionally enter description and tags.
Enable
Configure as a Branch Gateway Site
.
Add the other details to set up a site and click
Save & Exit
.

You must assign a device to the created branch gateway site, enable

L3 Direct Private WAN Forwarding

and

L3 LAN Forwarding

for the device and then configure interfaces.

Convert an existing branch site to a branch gateway site.

You can convert an existing branch site to a branch gateway site.

Ensure that:

The site is in
Control
mode.
You have enabled
L3 Direct Private WAN Forwarding
.
You have enabled
L3 LAN Forwarding
.
There aren’t any existing branch-to-branch VPN tunnels. If any tunnels exists, they will be deleted during the conversion process.

Select
Workflows
Branch Sites
and click the ellipsis menu for the site.
Select
Switch to Branch Gateway Site
.
Switching a branch site to a branch gateway site causes the ION device to reboot.
Alternatively, you can select
Branch Sites
, select a site and enable
Branch Gateway
.

Edit Branch Gateway settings.

(Optional)

After you create a branch gateway site, you can optionally edit the branch gateway site settings.

Select

Prefer LAN Default over WAN

in case your topology needs to take the LAN interface (with a default gateway) as the default route. This will mimic the path selection behavior of a data center site where all incoming WAN traffic is forwarded to the LAN peer.

For example, if the traffic is—Branch ↔Branch Gateway ↔ LAN (Firewall → Internet). Typically, the ION device will have a default route (0.0.0.0/0) on the internet (WAN) interfaces (with the next hop as the default gateway configured on the wan interface or from DHCP) to steer packets to the internet (for DIA or otherwise) if no other specific route exists. In this particular scenario, we need the Branch Gateway to take the LAN interface (which has a default gateway configured either statically or via DHCP) as a default route as against an Internet interface which would generally have a default route. This can be achieved by adding a default route with a lower Admin cost on the LAN interface than the WAN interface when you select

Prefer LAN Default over WAN

.

Maximum Branch Site Count Info

indicates the maximum number of branch sites that should be associated with a Branch Gateway site. If this number is exceeded, an incident will be generated. However, it will still be possible to associate branches to the branch gateway by joining the domain or through the establishment of manual tunnels.

Create VPNs between branch gateway or branch sites.

VPN tunnels are established as follows:

Branch -> Branch Gateway (Same Domain) —Automatically built Fabric VPN tunnels.
Branch -> Branch Gateway (Different Domain) — Manually defined Fabric VPN Tunnels.
Branch Gateway -> DC —Automatic VPN tunnel.
Branch Gateway -> Branch Gateway —Manually defined Fabric VPN Tunnels.

(Optional)
Changing the domain of a branch gateway.
Select a Branch Gateway site.
Click the ellipsis menu and select
Change Site Domain
.
Choose the required domain and click
Submit
.
To establish an automatic VPN tunnel between a branch site and a branch gateway site, ensure that both are in the same domain.
(Optional)
Create a manual VPN tunnel between two Branch Gateway sites.
Select
Workflows
Sites
and select a branch gateway site.
Select
Overlay Connections
Branch Gateway - Branch Gateway
Add Link
.
On the
Add Secure Fabric Link
pop-up, select a circuit and select the site for VPN establishment.

Prefix Advertisement

The Branch Gateway performs prefix advertisement and distribution in a variety of topologies.

Prefix Advertisement

Learned Via	Advertised To
Fabric Tunnel	LAN BGP Peer Standard VPN BGP Peer
Standard VPN Tunnel BGP Peer	Fabric (to branch) LAN BGP Peer
LAN BGP Peer	Fabric → yes LAN BGP Peer → yes Private WAN BGP Peer → yes
Private WAN BGP Peer	LAN BGP Peer → yes
LAN Static Route	Fabric → yes LAN BGP Peer → yes Private WAN BGP Peer → yes

Default Route in WAN BGP Peer

The existing BGP Global configuration is enhanced to allow an option to choose the default route as part of the prefix advertisement to WAN.

For a BGP peer, select

Advertise Default Route to Peer

to distribute the default route to the peer, instead of explicitly configuring a prefix via route-maps.