VPN Tunnel Egress Optimization

An CNA system at a multi-homed location can optimize VPN tunnels to other sites in the same way traffic is optimized to any known destination.

See Figure 1.

Figure 1:  VPN Tunnel Optimization

NOTE: In this and subsequent diagrams, ISPs are shown connected to separate routers. Likewise, VPN tunnels are shown terminating on separate VPN gateway devices. Neither of these is a requirement. The CNA system can work within just about any network topology.

The CNA system at your headquarters site will monitor traffic conditions between headquarters and the remote site through ISP A and ISP B, asserting its choice of most optimal path to ER1 and ER2.

To configure the CNA system to optimize a VPN, you need to:

• obtain measurements of traffic conditions between your headquarters VPN and your remote-site endpoints, by creating an active probe with a public address at your remote site as the target; this address can be an interface on your edge router (ER3) or, if your VPN will respond to either an ICMP or TCP probe, on the remote-site VPN itself
• create an CNA policy directing the decision-making process to give preferential treatment to the VPN addresses

Use the target or active-measurement group command to create active probes. This ensures that the CNA decision-maker process will have sufficient measurement data for your VPN sites to make routing decisions.

Use the decision-policy command to create a decision policy. (See Chapter 6: Decision Policies and Application Models in the CNA Basic Monitoring Guide for more information about decision policies.)

Include the priority-prefix command in the policy configuration so that the decision-maker process will give preferential treatment to any prefix associated with the policy.

Also include the route-assert-filter command with the force keyword so that the CNA system will assert routes to your VPN addresses. The prefixes for these addresses will be user defined, rather than obtained from BGP tables. Non-BGP prefixes become defined in the CNA database whenever you associate them with a decision policy. The CNA system will never assert a route to a non-BGP prefix unless you force it.

Finally, use the set-decision-policy command to associate the public addresses of your VPN endpoints with the decision policy. The VPN public address will be added to the CNA database so that the measurements obtained from the active probes will be available to the decision-maker process when it optimizes routes.

Once the active probes have gathered sufficient data, the CNA system in your headquarters location will begin optimizing routing for all packets departing your headquarters for your remote site.

The route selected by the CNA system will depend on which of the two headquarters-site service providers--ISP A or ISP B (Figure 1)--is experiencing the most optimum network conditions between your headquarters and the remote site, at any given time.

Note that this scenario has two significant limitations:

• no optimization for packets originating at the remote site and traveling back to headquarters
• no way to avoid traffic congestion or brownouts in ISP C’s network, which means the service provider serving your remote location represents a single point of failure for traffic destined for the remote network

Each of the remaining sections in this chapter describe alternatives for eliminating these limitations by optimizing the egress of VPN traffic itself.