Deployment Topologies of Virtual Interface

Let us learn about the deployment topologies of the virtual interface.
Virtual Interfaces can be configured on both branch and data center ION devices. A few sample deployment topologies are discussed below.

Controller Port Redundancy

Controller port redundancy is enabled for both branch and data center ION devices where applicable.
In this scenario, the virtual interface is used to provide physical redundancy from a single Prisma SD-WAN ION device with dual controller ports to two Layer 2 switches in the event of a port failure between the ION devices and one of the switches.
The ION device has each controller port physically connected to two different switches. A new virtual interface is configured with the two member interfaces, controller ports 1 and 2. IP address information is configured on the virtual interface controller port. In the event of a loss of a switch or controller port, controller connectivity remains uninterrupted.

Branch Deployments

Branch site deployments shown below include scenarios where a virtual interface is configured for port redundancy when an ION device is connected to a LAN switch or when a firewall is present.
Branch ION Device LAN Port Redundancy
In this scenario, the virtual interface is used to provide physical redundancy from a single ION device to two Layer 2 switches in the event of an uplink failure between the ION device and one of the switches.
The ION device is physically connected to two Layer 2 switches with VLAN 100 defined on each switch. A new virtual interface is configured with two member interfaces, ports 1 and 2. A sub-interface for VLAN 100 is created on the new virtual interface and the appropriate IP information is configured.
Once configured, the application traffic from clients connected to VLAN 100 is sent to the IP address (and corresponding MAC address) bound to the VLAN 100 sub-interface of the virtual interface. In the event of a physical interface failure, the other interface assumes the forwarding role for the failed interface.
Branch ION Device Internet Port Redundancy
In this scenario, a virtual interface is used to provide internet uplink port redundancy between a single branch ION device and an active / backup firewall pair. The firewall pair is responsible for inspecting untrusted internet traffic that is sent direct on the internet by the ION device.
The ION device is physically connected directly to each firewall. A new virtual interface is configured with two member interfaces, ports 1 and 2. Since a VLAN tag is not required for this configuration, the IP address information is configured directly on the virtual interface along with 'Used For Internet.' Corresponding port tracking should be configured on the firewall pair to ensure that a unit goes inactive or standby in the event of a failure of the port connected to the ION device.
For purposes of load-balancing or redundancy, these firewalls can be configured in an active-active or active-standby mode.

Data Center Deployments

Data Center deployments include scenarios where an ION device is deployed with two core peers in the same subnet with a firewall for internet circuits.
Redundancy in Data Center ION Device Deployment with 2 Core Peers in the Same Subnet
In this scenario, a virtual interface is used to provide redundant physical connections to a pair of Layer 3 core switches. The ION device is peering via BGP with both switches in the same IP network.
The Data Center ION device is physically connected to each of the Layer 3 Core switches with VLAN 10 defined on each switch. A new virtual interface is configured with two member interfaces, ports 1 and 2. A sub-interface for VLAN 10 is created on the new virtual interface and the appropriate IP information is configured. Corresponding BGP Peers are configured on both the ION device and the core switches.
The configured traffic forwards in an active-active fashion based upon the route table of the devices. In the event of an interface or core switch failure, continuous data center connectivity is enabled.
This scenario is applicable to both dual core control plane designs as depicted as well as single core control plane designs such as a switch stack.
Redundancy in Data Center ION Device Deployment with Internet Circuits and Firewall
In this scenario, a virtual interface is used to provide redundant physical connections to a pair of Layer 2 switches that are connected to an internet facing firewall pair. The ION device uses the firewall for the default gateway for the redundant internet facing ports.
The Data Center ION device is physically connected to each of the Layer 2 switches through an untagged switch interface. A new virtual interface is configured with two member interfaces, ports 1 and 2. Since a VLAN tag is not required for this configuration, the IP address information is configured directly on the virtual interface along with 'Connect to Internet' configuration. Configure the corresponding port tracking on the firewall pair to ensure that a unit goes inactive or standby in the event of a failure of the port connected to the ION device.

Recommended For You