Create a VPN Cluster

Plan your branch and hub VPN topology to determine which branches communicate with each of your hubs. For more information, see Plan Your SD-WAN Configuration.
Log in to the Panorama Web Interface.
Specify IP address ranges for the IPSec VPN tunnels that Auto VPN configuration creates.
Auto VPN configuration creates a VPN tunnel between a hub and branches and assigns IP addresses to the tunnel endpoints. Enter subnet ranges that you want Auto VPN to use as VPN tunnel addresses. You can enter up to 20 IP prefix/netmask ranges. Auto VPN draws from that pool for VPN tunnel addresses, drawing from the largest range first (and then drawing from the next largest range when necessary). You must configure at least one range for the pool. If you don’t perform this step before pushing the configuration to a hub or branch, the Commit and Push will fail.
If you upgrade from an earlier SD-WAN Plugin release, you must check that your ranges are still correct. If it is not, enter new ranges. After you
Commit
, all tunnels are dropped and new tunnels are used, so perform this task during a time you have low traffic.
Select

Panorama

SD-WAN

VPN Clusters

.

At the bottom of the screen, select

VPN Address Pool

.

Add

one or more (up to 20)

Member

IP address and netmask ranges, for example, 192.168.0.0/16.

Click

OK

.
Configure the VPN cluster. Repeat this step to create VPN clusters as needed.
Select
Panorama
SD-WAN
VPN Clusters
and
Add
a VPN cluster.
Enter a descriptive name for the VPN cluster.
Underscores and spaces are not supported in the VPN cluster name and result in monitoring (
Panorama
SD-WAN
Monitoring
) data for the cluster not to be displayed. Choose the name of the VPN cluster carefully so you do not need to change the name in the future. SD-WAN monitoring data is generated based on the old cluster name and cannot be reconciled to a new cluster name, and will cause issues with the number of reported clusters when monitoring your VPN clusters or generating reports.
Select the VPN cluster
Type
.
Only
Hub-Spoke
VPN cluster type is supported in PAN-OS 10.0.2 and earlier 10.0 releases. Beginning with PAN-OS 10.0.3, you can Create a Full Mesh VPN Cluster with DDNS Service.
Add
one or more branch devices that you determined need to communicate with each other.
Select
Group HA Peers
to display the branch devices that are HA peers together.
Select the branch devices to add to the cluster.
Click
OK
.
Add
one or more hub devices that you determined need to communicate with the branch devices.
Up to four SD-WAN hub firewalls can be added to a VPN cluster. SD-WAN hubs in an HA configuration are considered as a single SD-WAN hub firewall.
MPLS and satellite link types will form tunnels with only the same link type; for example, MPLS-to-MPLS and satellite-to-satellite. Tunnels will not be created between an MPLS link and an Ethernet link, for example.
Select

Group HA Peers

to display the hub devices that are HA peers together.

Select the hubs to add to the cluster and click

OK

.

For any new or previously existing VPN cluster that has more than one hub, you must prioritize the hubs to determine a) that traffic be sent to a particular hub, and b) the subsequent hub failover order. The hub failover priority range is 1 to 4. If you upgrade, the default priority is set to 4. The plugin internally translates the hub failover priority to a BGP local preference number as shown in the following table. The lower the priority value, the higher the priority and local preference. A cluster supports a maximum of four hubs. An active/passive HA pair counts as one hub. Multiple hubs can have the same priority; an HA pair must have the same priority. Panorama uses the branch’s BGP template to push the local preference of the hubs to the branches in the cluster.

Hub Failover Priority	Local Preference
1	250
2	200
3	150
4	100

If multiple hubs have the same priority, Panorama enables ECMP in two places on each branch firewall to determine how branches select the path. ECMP is enabled for the virtual router (

Network

Virtual Routers

ECMP

) and

ECMP Multiple AS Support

is enabled for BGP (

Network

Virtual Routers

BGP

Advanced

).If all hubs in the cluster have a unique priority, ECMP is disabled on the branches. If a hub priority configuration changes, Panorama reevaluates whether to enable or disable ECMP.

If you selected

Group HA Peers

, select the pair and click in the

Hub Failover Priority

field; enter a single

Priority

(range is 1 to 4), which applies to both hubs in the HA pair, and click

OK

.

The Hub Failover Priority for HA Peers window appears only for configured HA pairs. If you add a new HA pair, you must configure the Hub Failover Priority for each of the two new peers independently.

You will get an error message if you assign different priorities to hubs that are ungrouped HA peers and then you select

Group HA Peers

and

Submit

.

For hubs that are not HA pairs, select a hub and click in the

Hub Failover Priority

field; enter a priority (range is 1 to 4).
Click
OK
to save the VPN cluster.
Advertise additional prefixes at the branch to the hub.
The firewall automatically redistributes (advertises) all non-public, connected routes from the branch to the hub. You can also redistribute any additional prefixes from the branch to the hub. The
Prefix(es) to Redistribute
field accepts a list of prefixes, rather than just a single prefix.
Select
Panorama
SD-WAN
Devices
and select a branch firewall.
Select
BGP
and
Add
one or more IP addresses with netmask to
Prefix(es) to Redistribute
.
Click
OK
.
Commit
and
Commit to Panorama
.
(
SD-WAN Plugin 2.0.1 and later 2.0 releases
) If your hub firewalls in a hub-spoke VPN cluster have DHCP or PPPoE interfaces, you must use DDNS. Select
Network
Interfaces
Ethernet
and in the
Template
field, select Template-stack for a hub.
(
SD-WAN Plugin 2.0.1 and later 2.0 releases
) Select the interfaces whose IP address indicates
Dynamic-DHCP Client
or
PPPOE
, click
Override
on the bottom of the screen, and click
OK
to close.
(
SD-WAN Plugin 2.0.1 and later 2.0 releases
) Verify on Panorama that the DDNS settings were configured.
Select
Network
Interfaces
Ethernet
and select the same interface again.
Select
Advanced
DDNS
.
See that the DDNS settings were automatically configured with a
Hostname
and the
Vendor
set to
Palo Alto Networks DDNS
.
Click
OK
.
(
SD-WAN Plugin 2.0.1 and later 2.0 releases
)
Commit
and
Commit to Panorama
.
Push the configuration to the hub(s).
When Panorama creates virtual SD-WAN interfaces for hubs, Panorama doesn't necessarily create the interfaces using contiguous interface numbers. It might randomly skip an interface number, for example, sdwan.921, sdwan.922, sdwan.924, sdwan.925. Despite the discontiguous numbering, Panorama creates the correct number of SD-WAN interfaces. Use the operational CLI command
show interface sdwan?
to see the SD-WAN interfaces.
Select
Commit
and
Push to Devices
.
Edit Selections
on the lower left side of the screen.
Deselect
Filter Selected
.
Click on
Deselect All
.
Select your hub Device Group. Select
Include Device and Network Templates
at the bottom of the screen. You must push to hubs before pushing to branches.
Most branches have dynamic IP addresses through their service providers, so branches must initiate the IKE/IPSec connection because the hub doesn’t have the branches’ IP address.To ensure that the hub is ready to receive the IKE/IPSec connections, the hub’s configuration must be committed and pushed before the branch’s configuration. Thus, when the branch configurations are pushed and the branches initiate the connection to the hub, the hub is ready.
Select the
Templates
tab and
Deselect All
.
The
Push Scope
is the Device Group.
Push
the configuration to the hub(s).
Push the configuration to the branch(es) by repeating the prior step, but selecting your branch Device Group.
Refresh the IKE preshared key.
If you need to change the current IKE key that is used to secure the IPSec connections between VPN cluster devices, perform this step to randomly generate a new key for the cluster.
Perform this step when cluster members are not busy.
Select
Panorama
SD-WAN
VPN Clusters
and select a cluster.
At the bottom of the screen, select
Refresh IKE Key
.
A message appears notifying you that
Refreshing the IKE key will generate a new security association (SA) for every SD-WAN firewall in the VPN cluster. This may cause a service disruption. Do you wish to continue? Yes | No
Select
Yes
if you wish to continue.
Commit
.
After you
Refresh IKE Key
, you must commit to the entire cluster; a partial commit will bring down tunnels.
Push to Devices
.