External Service Nodes for AppQoE Services

Table 1. Feature History
Feature Name	Release Information	Description
Support for Multiple, External AppQoE Service Nodes	Cisco IOS XE Release 17.4.1a Cisco vManage Release 20.4.1	This feature allows you to configure multiple AppQoE service nodes that are external to the intercepting edge routers or AppQoE service controllers. It extends AppQoE support to edge routers in which AppQoE can't run as an integrated service node. This feature also allows AppQoE to scale, where integrated AppQoE has limitations on the throughput and number of connections. The ability to configure multiple AppQoE service nodes help meet the scale and throughput requirements of large enterprise sites, such as data centers.
Support for Additional Platforms as Controllers for AppQoE Service Nodes	Cisco IOS XE Release 17.5.1a Cisco vManage Release 20.5.1	This release extends the service controller role to additional device models—C8500L-8S4X and ASR1006-X.
Support for Automated MTU Setting for Tunnel Adjacency	Cisco IOS XE Release 17.5.1a	This feature enables a programmatic setting of the maximum transmission unit (MTU) size to 1500 for the network connecting the service controllers and service nodes. This automation prevents broken communication due to packet fragmentation that can bring down the throughput requirements.

Supported Devices for AppQoE Controllers and External Service Nodes

Devices Supported as Service Controllers

Release

Supported Devices

Cisco IOS XE Release 17.4.1a and later

Cisco ASR 1000 Series Aggregation Services Routers
- ASR1001X
- ASR1002X
- ASR1001-HX
- ASR1002-HX
Cisco Catalyst 8500 Series Edge Platforms:
- C8500-12X4QC
- C8500-12X

Cisco Catalyst 8000V Edge Software (Cisco Catalyst 8000V)

Note

If you configure Cisco Catalyst 8000V as a service controller, you cannot use the same instance as a service node.

Cisco IOS XE Release 17.5.1a and later

Cisco Catalyst 8500 Series Edge Platforms
- C8500L-8S4X
Cisco ASR 1000 Series Aggregation Services Routers
- ASR1006-X

Devices Supported as External Service Nodes

Release

Supported Platforms

Cisco IOS XE Release 17.4.1a and later

Cisco Catalyst 8000V
- Minimum RAM Requirement: 16 GB, to be configured as service plane heavy
- Minimum CPU: 8 Core

Note

If you configure Cisco Catalyst 8000V as a service node, you cannot use the same instance as a service controller.

Note

If you configure Cisco Catalyst 8000V as a service node, you cannot use the same instance as a service controller.

Note

For information on platforms supported as external service nodes for Data Redundancy Elimination (DRE), see Traffic Optimization with DRE.

Restrictions for External AppQoE Service Nodes

Only Cisco Catalyst 8000V instances can be configured with the service node role.
When Cisco Catalyst 8000V is configured as a service node, it can’t act as a service controller, even though Cisco Catalyst 8000V supports the service controller role.
Only one service cluster is supported per site.
Only one service controller group is supported per site and a service controller group can have up to eight service controllers. A maximum of eight service controllers is supported per site, and each service controller can have up to 64 service nodes.
Only one service node group is supported per AppQoE cluster.
VRRP is not supported for service controller to service node connectivity.
Although handling of asymmetrical flows isn’t built into AppQoE, you need to configure flow symmetry for all stateful features in Cisco SD-WAN.
If a service controller fails, the flows handled by that service controller are reset.

Ensure that the bootstrap configuration for the Cisco Catalyst 8000V instance being configured as the AppQoE service node is modified as follows:

Exclude any controller groups from the TLOC interfaces (exclude-controller-group 0 )
Ensure that the configuration includes omp shutdown

Note

This configuration prevents the AppQoE service node from participating in the SD-WAN data plane. The absence of this modification in the bootstrap configuration leads to generation of alarms indicating that OMP and Control Connections are down in Cisco vManage. However, the alarms are harmless and can be ignored if the recommended configuration is absent from bootstrap configuration.

Information about External AppQoE Service Nodes

Overview of External AppQoE Service Nodes

The support for configuring multiple, external Application Quality of Experience (AppQoE) service nodes provides high availability for TCP and DRE optimization. When AppQoE service nodes are external to the edge router acting as the service controller, the dependency on this intercepting router is reduced. Prior to the release of this feature, AppQoE service instances had to be configured on the service controller itself. You can now configure supported devices with the AppQoE service node role to optimize traffic based on sites and applications. This solution addresses the requirement of larger enterprises to have higher throughput and more number of connections.

Components of AppQoE Solution with External Service Nodes

AppQoE Cluster: An AppQoE controller and a group of AppQoE service nodes at a site.

Typically, data centers or regional data center sites, which require higher aggregated throughput, have an AppQoE cluster with external service nodes for TCP and DRE optimization.
AppQoE Controller: A supported Cisco IOS XE SD-WAN device that intercepts network traffic. Based on the AppQoE policy, the device distributes that traffic to one or more AppQoE service nodes.
AppQoE Service Nodes: Devices that are configured as AppQoE service nodes are TCP optimization instances that optimize and accelerate traffic. The optimization is based on the configuration in control policies.

From Cisco IOS XE Release 17.5.1a, the service nodes can also run the DRE feature to eliminate data redundancy and reduce bandwidth usage. For more information, see Traffic Optimization with DRE .

How External Service Nodes and Standalone Controllers Work

With Cisco SD-WAN supporting the creation of external service nodes from Cisco IOS XE Release 17.4.1a, service nodes are decoupled from the intercepting edge router or the service controller. You now have the option to configure supported devices as standalone service controllers and connect them to devices that are configured with the service node role.

Using Cisco vManage device templates, you can configure the following roles on supported devices:

Service Node
Service Controller

How Service Controllers and Service Nodes Interact

In Cisco IOS XE Release 17.4.1a, only Cisco Catalyst 8000V Edge Software (Cisco Catalyst 8000V) can be configured with the service node role. When you configure Cisco Catalyst 8000V instances with the service node role, a default AppQoE template is attached to them, which cannot be modified.
Service nodes in a site and the service controllers that they are connected to form a service cluster.
Service nodes do not communicate with each other and are not aware of the other service nodes in the cluster.
Service controllers initiate communication with the service nodes connected to them. This configuration is set up in the AppQoE feature template associated with a device template that has the service controller role defined.
Service controllers and service nodes can be adjacent to each other, or next or multiple hops away.
Service controllers communicate with the service nodes through service VPNs. However, service nodes communicate with service controllers through transport VPN or VPN 0.
Service nodes only respond to the service controller that they are connected with.
In Cisco vManage, the health of each AppQoE service node is represented by the colors Green or Yellow. Only nodes with Green status are considered for distribution of new flows. Any ongoing flows to service nodes showing as Yellow are redirected.

Sample Topology


*SN: Service node (up to 64 per controller)
*SC: Service controller (up to 8 per site)

The image above shows an example of Cisco SD-WAN deployment with service nodes that are external to the service controller. The image shows the deployment at both a branch site and a data center. Cisco IOS XE SD-WAN devices at the data center and branches form an AppQoE cluster with service nodes at their respective sites.

Best Practices and Recommendations

To ensure that the service nodes have sufficient capacity for AppQoE services, don't configure any other features on devices that have been configured with the service node role.
When you create an AppQoE cluster containing service controllers and service nodes, ensure that all the cluster members have the same ID as the site.
Ensure that service controllers and service nodes that form a cluster share the same Cisco SD-WAN site ID. If there’s a mismatch in the site IDs, the service nodes are reported as Yellow on the controller. This leads the service nodes being disregarded from distribution of flows for optimization.
Ensure that the maximum transmission unit (MTU) size of the network connecting the service controllers and service nodes is uniform across the complete traffic path. Otherwise, it can lead to broken communication due to packet fragmentation.

Configure AppQoE Controllers and Service Nodes

Configure AppQoE Service Nodes

From the Cisco vManage menu, choose Configuration > Templates.

Under Device Templates, click Create Template and choose From Feature Template.

Note

In Cisco vManage Release 20.7.x and earlier releases Device Templates is called Device.

In the Device Model field, choose C8000v.

Note

Only Cisco Catalyst 8000V instances can be configured as AppQoE service nodes. If you choose any other device, the Service Node option isn’t available in the Device Role field.

In the Device Role field, choose Service Node from the drop-down list.
Enter Template Name and Description.
Click Additional Templates. In the AppQoE field, notice that the Factory Default AppQoE External Service Node template is attached by default.

No further configuration is required for devices configured as AppQoE service nodes. Additional configuration for connecting the service nodes to a service node controller is done through the AppQoE controller configuration screens in Cisco vManage.
Attach the device template to the device.

Configure AppQoE Service Controller

From the Cisco vManage menu, choose Configuration > Templates.

Under Device Templates, click Create Template and choose From Feature Template.

Note

In Cisco vManage Release 20.7.x and earlier releases Device Templates is called Device.

In the Device Model field, choose any one of the devices that support the service controller role. See the Supported Platforms section in this chapter for a complete list of devices that support the service controller role.

In the Device Role field, choose SDWAN Edge from the drop-down list.

Note

The SDWAN cEdge option is only visible for devices that support the service controller role.

Enter Template Name and Description.
Click Additional Templates. In the AppQoE field, you can either choose an existing AppQoE feature template or create a new one. This procedure includes steps to create a new AppQoE template for the device being configured with the service controller role.
Click the drop-down list for the AppQoE field and then click Create Template.
In the Template Name and Description fields, enter a name and description for your template respectively.

In the Controller area, enter the requested details.

Controller IP address: Enter the service-side interface IP address of the controller. This is the IP address that the controller uses to communicate with the service nodes connected to it in a service cluster.
Service VPN: Specify the service VPN ID in which the LAN-side connections of the service nodes reside. The VPN ID can be anyone from the following ranges: from 1 through 511, or from 513 through 65527.

Service Node IP 1: Enter the IP address of the service nodes to enable the service controllers to communicate with the service nodes.

Note

Click + next to the Service Node IP field to add more service nodes. You can add up to 64 service nodes for a single service controller.

Note

From Cisco vManage Release 20.6.1, the AppQoE feature template allows you to configure multiple service node groups and add the external service nodes to such groups. You can configure a maximum of 32 service node groups per cluster. The name range of a service node group is SNG-APPQOE0 to SNG-APPQOE31.

However, if the version of the device that you are configuring as a service controller is lower than Cisco IOS XE Release 17.6.1a, and you use Cisco Cisco vManage Release 20.6.1 to configure the AppQoE template for such device, ensure that you configure only one service node group, even though the template allows you to configure multiple service node groups.

Attach the device template to the device.

Configure AppQoE Service Controllers and Nodes Using the CLI

This section provides example CLI configurations to configure TCP optimization using external service nodes and standalone service controllers connected to such service nodes.

Configure an External Service Node

Enable TCP optimization.


Device# config-transaction 
Device(config)# sdwan appqoe tcpopt enable  
Device(config-appqoe)# no sslproxy enable

Create a virtual port group interface.


Device(config)# interface VirtualPortGroup virtual-port-group-number 
Device(config-if)# service-insertion appqoe 
Device(config-if)# ip address ip-address mask

Create a service node group.


Device(config)# service-insertion service-node-group appqoe  service-node-group-name 
Device(config-service-insertion-sng)# service-node service-node-ip-address

Configure the service node as service plane heavy.


Device(config)# platform resource service-plane-heavy

Note

If you configure Cisco Catalyst 8000V as service-plane heavy, you need to reload it to enable the service plane..

Here's the complete configuration example for creating service nodes.


config-transaction

 sdwan appqoe tcpopt enable
  no sslproxy enable
  !

 service-insertion service-node-group appqoe SNG-APPQOE

  device-role service-node
  service-node 192.168.2.2 
  !
 
 interface VirtualPortGroup1
  ip address 192.168.2.1 255.255.255.0
  service-insertion appqoe
  !

  interface GigabitEthernet 2
   description SN_LAN_Interface in VPN0 
   ip address 192.0.2.1 255.255.255.0
   !

 platform resource service-plane-heavy

 system
  system-ip 198.51.100.1
  site-id 78200
 !

Configure a Service Controller

Create a service controller and assign it to a service controller group.


Device# config-transaction  
Device(config)# service-insertion appnav-controller-group appqoe  appqoe-controller-group-name 
Device(config-service-insertion-acg)# appnav-controller controller-ip-address

Create a service node group and add service nodes to it.


Device(config)# service-insertion service-node-group appqoe  service-node-group-name 
Device(config-service-insertion-sng)# service-node service-node-ip-address

Note

You can configure multiple external service nodes in a service node group.

Configure service context for the controller and service node groups.


Device(config)# service-insertion service-context appqoe/1   
Device(config-service-insertion-context)# appnav-controller-group appqoe-controller-group-name 
Device(config-service-insertion-context)# service-node-group service-node-group-name 
Device(config-service-insertion-context)# enable  
Device(config-service-insertion-context)# vrf default

Here's a complete configuration example for creating service controllers.


config-transaction

 service-insertion appnav-controller-group appqoe Test-ACgroup 
  appnav-controller 198.51.100.1 vrf 200 
  ! 

 service-insertion service-node-group appqoe Test-SNGroup 
  service-node 192.0.2.2 
  service-node 192.0.2.3
  service-node 192.0.2.4
  service-node 192.0.2.5
  ! 

 service-insertion service-context appqoe/1 
  appnav-controller-group ACG-APPQOE 
  service-node-group SNG-APPQOE 
  cluster-type service-controller
  enable 
  vrf default 
  ! 

  interface GigabitEthernet 1 
   description SC_To_SN_LAN_Interface in VPN200
   ip address 192.0.2.1 255.255.255.0
   vrf forwarding 200
   !

  system
   sytem-ip 198.51.100.10
   site-id 78200
   !

Monitor AppQoE Service Controllers and Nodes

Verify Device Role

Follow this procedure to verify the device role (service controller or service node) for a device after you configure the role using a device template.

From the Cisco vManage menu, choose Configuration > Templates.

Ensure that you are in the Device Templates area .

Note

In Cisco vManage Release 20.7.x and earlier releases Device Templates is called Device.

A list of available device templates is displayed.

Check the Device Role column for a device to know its role. SDWAN Edge implies that the device is configured as a service controller.

Monitor Traffic on Service Controllers

Alarms and Events

If a cluster isn't formed or is not operational, the device sends a notification to Cisco vManage. You can view such event notifications from the Monitor window of Cisco vManage. For some of these events, Cisco vManage also generates alarms. For information on how to view alarms and events for your devices, see Alarms, Events, and Logs

Monitor AppQoE Service Controllers and Nodes Using the CLI

Use the following CLI commands to view the statistics for AppQoE service controllers, service nodes, and clusters.

The following sample output shows the configuration details of service nodes in a service node group:

Device# show service-insertion type appqoe service-node-group
Service Node Group name : SNG-APPQOE
Service Context : appqoe/1
Member Service Node count : 2


Service Node (SN) : 10.1.1.1
Auto discovered : No
SN belongs to SNG : SNG-APPQOE
Current status of SN : Alive
System IP : 192.168.1.11
Site ID : 101
Time current status was reached : Wed Sep 23 11:01:49 2020

Cluster protocol VPATH version : 1 (Bitmap recvd: 1)
Cluster protocol incarnation number : 1
Cluster protocol last sent sequence number : 1601432656
Cluster protocol last received sequence number: 715749
Cluster protocol last received ack number : 1601432655

The following sample output shows the traffic statistics for service nodes in a service node group:

Device# show service-insertion type appqoe statistics service-node-group
Service Node Group: SNG-APPQOE
Number of Service Node(s): 2
Member Service Nodes:
IP Address
10.1.1.1
10.1.1.2

Aggregate of statistics from all SNs of the SNG:
------------------------------------------------
Time since statistics were last reset/cleared:

Aggregate number of probe requests sent to SN : 1435070
Aggregate number of probe responses received from SN: 715915
Aggregate number of invalid probe responses received
Total : 0
Incompatible version : 0
Authentication failed : 0
Stale response : 0
Malformed response : 0
Unknown response : 0
Aggregate number of times liveliness was lost with the SN : 1
Aggregate number of times liveliness was regained with the SN:2
Aggregare number of version probes sent to SN: 719033
Aggregate number of version probes received from SN: 2
Aggregate number of healthprobes sent to SN: 716037
Aggregate number of healthprobes received from SN: 715913


Aggregate traffic distribution statistics
-----------------------------------------
Packet and byte counts-
----------------------
Redirected Bytes : 1558757923174
Redirected Packets : 1945422189
Received Bytes : 1582477555093
Received Packets : 1908965233

The following sample output shows the configuration details of service controllers in a controller group:

Device# show service-insertion type appqoe appnav-controller-group
All AppNav Controller Groups in service context
Appnav Controller Group : ACG-APPQOE
Member Appnav Controller Count : 1
Members:
IP Address
10.1.1.100

AppNav Controller : 99.1.1.100
Local AppNav Controller : Yes
Current status of AppNav Controller : Alive
Time current status was reached : Mon Sep 21 19:09:08 2020
Current AC View of AppNav Controller
IP Address
10.1.1.100

Current SN View of AppNav Controller
IP Address
10.1.1.1

Cisco SD-WAN AppQoE Configuration Guide, Cisco IOS XE Release 17.x

Bias-Free Language

Book Title

Cisco SD-WAN AppQoE Configuration Guide, Cisco IOS XE Release 17.x

Chapter Title