Prerequisites for Cisco Catalyst SD-WAN Remote Access

Prerequisite details

1. Public IP address

   Remote access clients connecting by internet must be able to connect to an SD-WAN RA headend through a static public IP address. Configure the remote access clients with the DNS name or the static public IP address of the SD-WAN RA headend.

   Note

   When remote access clients connect through a private WAN, the SD-WAN RA headend does not require a static public IP address.

   The static public IP address may be one of these:

   • Static public IP address on a firewall that provides access to the remote access headend

   • Static public IP on the remote access headend device

     • Static public IP on a TLOC interface

       A TLOC interface has built-in security, only allowing the protocols required for Cisco Catalyst SD-WAN operation, such as transport layer security/data datagram transport layer security (TLS/DTLS) and IPsec on predetermined ports. To enable any additional protocols, explicitly configure the TLOC interface to allow the protocols.

       When you use a TLOC interface as the WAN interface providing a static IP for an SD-WAN RA headend, Cisco Catalyst SD-WAN automatically detects that SD-WAN RA is enabled and allows the IKEv2 and IPsec protocols required for remote access operation.

       To enable Cisco AnyConnect remote access clients to download the AnyConnect VPN profile from the SD-WAN RA headend, enable the HTTPS/TLS protocol (TCP port 443) on the TLOC interface.

       Starting from Cisco IOS XE Catalyst SD-WAN Release 17.12.1a, HTTPS/TLS protocol (TCP port 443) on the TLOC interface is automatically enabled on detecting SD-WAN RA configuration.

     • Static public IP on a non-TLOC interface

       In contrast with a TLOC interface, a non-TLOC interface does not have any built-in security and does not block any traffic. When you use a non-TLOC interface as the WAN interface providing a static IP for an SD-WAN RA headend, we recommend that you configure an inbound and outbound access-list on the WAN interface to allow only the protocols required for SD-WAN RA. These are IKEv2 and IPsec. To enable Cisco AnyConnect remote access clients to download the AnyConnect VPN profile from the SD-WAN RA headend, enable the HTTPS/TLS protocol (TCP port 443).

2. Configure remote access clients to connect to the SD-WAN RA headend

   Remote access clients must be pre-configured with the DNS names or the IP addresses of the SD-WAN RA headend devices, including primary and backup devices if you have configured backup devices.

   • In a scenario where remote access clients connect by public internet, the addresses are static public IP addresses.

   • In a scenario where remote access clients connect by private WAN, the addresses are private IP addresses.

3. Firewall policy to allow IKEv2/IPsec and TLS traffic

   If the SD-WAN RA headend is behind a firewall, then the firewall must allow these protocols and ports in the inbound and outbound directions:

   • Inbound:

     • IKEv2: UDP ports 500 and 4500

     • IPsec: IP protocol ESP

     • TLS: TCP 443

     • Source IP address: Any

     • Destination IP address: SD-WAN RA headend public IP

   • Outbound:

     • IKEv2: UDP ports 500 and 4500

     • IPsec: IP protocol ESP

     • TLS: TCP 443

     • Source IP address: SD-WAN RA headend public IP

     • Destination IP address: Any

4. Private IP pool to assign a unique address to each remote access client

   This is optional if all of the remote access users connect by hardware remote access client.

   In remote access solutions, the remote access headend assigns a private IP address to each remote access client. The remote access client uses the assigned IP as the source IP address for the remote access VPN inner traffic (traffic that has not yet been encrypted for VPN). The assigned IP enables the remote access headend to identify and route return traffic to the remote access client.

   Each SD-WAN RA headend requires a unique private IP pool from which to assign IP addresses to remote access clients. An SD-WAN RA headend can share the private IP pool across all the service VPNs that a remote access user may be placed in.

   This is optional if the remote access clients are limited to small office clients using a hardware remote access client.

5. Summary-route configuration

   For each remote access client, the SD-WAN RA headend adds a static host route to the assigned IP address in the service VPN in which the remote access user is placed, based on the user's identity.

   When SD-WAN RA assigns an IP address to a remote access client, it creates a static route for the assigned IP address. The static route specifies the VPN tunnel of the remote access client connection. The SD-WAN RA headend advertises the static IP within the service VPN of the remote access client. Cisco Catalyst SD-WAN uses the overlay management protocol (OMP) to advertise the static routes to all edge devices in the service VPN. Advertising each route to all edge devices creates a problem for scaling because individually advertising the static routes for thousands of remote access clients may diminish performance.

   To avoid advertising a large number of static routes, you can configure OMP to advertise the IP pool subnet as a summary-route in each service VPN.

6. Capacity planning for the SD-WAN RA headend

   The SD-WAN RA headend shares the cryptographic accelerator, WAN bandwidth, and the router throughput capacity with Cisco Catalyst SD-WAN IPsec Depending on the number of remote access connections, and on the amount of remote access throughput that you intend for each Cisco IOS XE Catalyst SD-WAN device to support, you may require additional capacity.

   Note

   The maximum number of IPsec sessions supported on a Cisco IOS XE Catalyst SD-WAN device is shared between Cisco Catalyst SD-WAN IPsec/BFD and remote access IPsec sessions. Similarly, the IPsec throughput capacity of a device is shared between Cisco Catalyst SD-WAN and remote access IPsec.

7. CA server

   The CA server provisions certificates on Cisco IOS XE Catalyst SD-WAN devices for SD-WAN RA headend authentication with the remote access clients, if the headend is configured to use certificate-based authentication.The CA server must support the simple certificate enrollment protocol (SCEP) for certificate enrollment.

   The CA server must be reachable from all the SD-WAN RA headends in a service VPN.

8. RADIUS/EAP server

   SD-WAN RA headends use a RADIUS/EAP server for authentication of remote access clients and for managing per-user policy.

   The RADIUS/EAP server must be reachable from all the SD-WAN RA headends in a service VPN.

Note

It is common to deploy the CA server and the RADIUS server together at a data center site in the service VPN.