|
|
|
In addition to optimizing VPN traffic among multiple tunnels or ISP links, the CNA system can also switch your traffic between a private WAN circuit (such as frame relay (FR) or Multi-Protocol Label Switching (MPLS), for example) and an Internet VPN, depending on which path is better able to handle the traffic at any given moment.
See Figure 4.
Figure 4: Optimized Hybrid Internet VPN and Private WAN
The CNA system at your headquarters site will send active probes to your remote site through the VPN IPsec tunnel and through the private WAN circuit. Based on measurements of the speed of these probes, plus preference criteria you enter into the CNA configuration, the CNA decision-maker process will assert either the WAN circuit or the VPN tunnel as the most optimal route to your remote site.
The CNA system at your remote site will operate as a mirror image of the headquarters device, optimizing the return traffic through either the WAN or VPN link. Note the interior routers are shown at the remote site, but they are not required, so long as the VPN gateway and/or the WAN edge router support BGP.
The VPN and firewall, shown separately in this diagram, may be the same device and are combined in subsequent diagrams.
NOTE: In this implementation layout, the CNA system only optimizes VPN traffic between the VPN and the WAN circuit. See the section Hybrid WAN with Multiple ISP Optimization for information about optimizing among the ISPs at the headquarters site.
If you are adding a VPN connection as a secondary connection along with an existing private WAN circuit, you will need to implement a routing protocol between your Internet VPN tunnels and private WAN links. This will need to be done as part of the VPN installation, prior to adding the CNA system to the network.
As far as the CNA system is concerned, any dynamic routing protocol will work.
Once the VPN is set up and working and you add an CNA system to the network in order to optimize the choice between the public or private network, you will need to establish a BGP peering session between the CNA system and the edge routers or VPN gateways. In this implementation, an CNA system sits behind your VPN firewall at both your headquarters location and the remote site.
|
|
|