|
|
|
You can achieve a greater measure of optimization by also adding CNA at the remote site and optimizing VPN traffic in both directions. This can be accomplished by constructing mutiple IPsec/GRE tunnels at sites with a single ISP link and configuring CNA to choose between tunnels, or by using two or more ISP links at each site.
Figure 2: VPN Traffic Optimization
For example, in Figure 2 above, the headquarters site is connected to the Internet with three ISP links, and the VPN tunnels use these three links to reach ten different sites. Each of the ten remote sites have just one ISP link available. If each ISP link at headquarters can be used to reach each site, then for full path diversity, there will need to be thirty different tunnels, or site-links. Each separate site-link then needs to be measured. For each site, CNA will assess the performance of the three tunnels to that site and adjust the egress of VPN traffic by routing among the three site-links.
In this example, CNA could not be configured to have thirty different corresponding engine-links for this decision-making task. While this approach is indeed possible in smaller deployments, CNA quickly reaches scalability limits given the maximum of sixteen engine links that are supported. The more scalable solution is to configure engine links for each of the three ISP links and use a mapping of those three links to the thirty different site-links. The mapping is done both for measurements as well as route assertions. Within the CNA configuration, the mapping is done with link-groups; for each site, a link-group is defined that gives the site-specific information for each of the three ISP links.
Another aspect of the VPN design that must be considered is where the site-links can be controlled. In some instances, the site-links originate at a concentrator, such as a VPN gateway or a choke router, which may not treat them as routable interfaces and/or may not support the necessary BGP capability CNA requires for control. In this scenario, CNA indirectly controls the site-links by using the concentrator as the proxy for all remote VPN endpoints. In configuration terms, the concentrator itself is the next-hop address that CNA will assert in the decision-making process. A concentrator also lends itself to using the one-to-one mapping of engine-links and site-links, rather than link-groups.
The alternative is to have CNA control each site-link directly, where the remote tunnel IP address is the next-hop address asserted by CNA. Direct site-link control provides increased capacity for fine-grained performance optimization. Likewise, direct site-link control will most likely drive the use of link-groups, unless the total combination of sites and links is no more than sixteen.
NOTE: Combinations of concentrator and direct site-link control in the same CNA configuration are possible.
Regardless of the specific topology, CNA relies on several common elements for optimizing VPN traffic egress. These common elements include requirements for mapping remote sites and the links that connect them, measuring performance to remote sites, and choosing the best performing link to the remote sites.
|
|
|