On-Premises SD-WAN Management with R82.20: Video, Slides, and Q&A

[PhoneBoy]

Presentation is attached below.
Q&A is in a response below the post.

[JonasNyquist]

There's no recording of the demo, or am I just too late for live and too early for "full" release? 🙂

/Jonas

[Amit_Navon]

@PhoneBoy The video captures only the speaker and not the shared screen.

If can't be fixed, let's add to the post the two YouTube links for the demos 

[PhoneBoy]

Zoom offers more than a dozen filetypes on the backend...simply uploaded the wrong one.
The original post should be updated accordingly.

[PhoneBoy · Accepted solution]

Q&A

Does steering application require https inspection to be enabled?

It is not required, but it allows Steering application to detect applications in HTTPS traffic. Steering can detect by DNS, SNI and other methods if HTTPSi is disabled.

Any limitation for Spark Appliances?

No limitations - SD-WAN will run the same on Spark appliances as well

Do these SD-WAN settings in SmartConsole sync w/ Infinity Portal and vice versa?

In the new SD-WAN management model, all SD-WAN configuration is part of Smart-1 Management, there is no specific SD-WAN Infinity Portal configuration. 

Do these SD-WAN settings in SmartConsole sync w/ Infinity Portal and vice versa?

No, it's either the management or the infinity Portal. To run in cloud - Smart-1 Cloud will be available.

All configs will be applied in SMS instead Spark web mgmt interface?

Yes - all SD-WAN configuration is done through the management console. No Gaia/Spark web mgmt console is required for SD-WAN configuration.

Can SD-WAN settings be configured in SmartConsole Web?

The demo was actually shown using SmartConsole Web, so yes.

Is there a path for existing portal-based SD-WAN customers to migrate to on-prem SD-WAN mgmt?

The path requires upgrading to R82.20+, then set up the configuration in management, then remove the GW from the portal and enable the SD-WAN blade in the management. We are working on an easier migration tool for the management configuration.

Can it work with R82 GW? Or do both the management system and the GW have to be R82.20?

On-premises management requires R82.20+ on management and gateways.

What type of remote site gateways are required to take advantage of SD-WAN e.g., would a 1550 appliance work assuming data center is all latest and greatest?

Spark devices supported on R82.0.x, 3920 Gateways and up running R82.20 SD-WAN

Is Grafana license provided with SD-WAN or is it part of a separate package?

The SD-WAN observability does not requires additional license. Grafana is open source and can be deployed without a license. There is license that can be purchased from grafana for on premise and cloud that provide additional capabilities such as reporting.

Can the Skyline observability solution be used/integrated with Smart-1 Cloud?

Yes, most data is collected directly from the gateways. Smart-1 cloud can also be configured to share data with the Skyline on-premises database.

Is SD-WAN supported on VSX?

Down the road, SD-WAN will be supported with VSNext (not legacy VSX).

Will we need a license for AIOps to use the Cloud-based SD-WAN reporting?

The AIOps will be available if you have SD-WAN license with version R82.20+ management

Does the AIOps monitoring also require R82.20, or can I use that today instead of the sd-wan application in Infinity Portal?

AIOps monitoring will replace the sd-wan application monitoring solution. Smart1 management -> AIOps is available Infinity portal management -> SD-WAN application monitoring.

Infinity Portal configured as MSSP does not support AIOPS. Some customers have gateways there, and use child tenants for different branches. Can we do something about that to support those GWs in the MSSP Tenant??

We support it - the GW needs to be in the children tenants. The parent see only aggregated data.

Do we need an additional blade for the Management besides SDWAN lic for GWs?

No.

What about spark GW?

Will be supported as well. EA version coming soon.

Will managing SD-WAN from Infinity Portal remain an option?

Currently.

PMTR-104980 show not support SD-WAN configuration at limitation section of sk185141. Will solve R82.20 ?

This limitation was lifted in R82.10. Will be supported in R82.20 as well and with Smart1 management"
This was an awesome session! Thank you!

Will it be easy to migrate the rules or configurations from the old (current) SD-WAN to this new on-prem R82.20 SD-WAN?

Not currently, but this is planned.

[ilkerd]

Hello,

We see that in the demo, when SD-WAN is enabled with the R82.20 on-premises management server, it provides the ability to perform Application-level QoS for the first time.

I downloaded the R82.20 EA release, but the traditional QoS blade was not available.

- Is it now necessary to purchase an SD-WAN license in order to perform QoS? Is Application-level QoS not available without an SD-WAN license?

- Does the SD-WAN policy support inline layers? If not, when will this capability be introduced?

- Will SD-WAN-capable ASICs and next-generation hardware be arriving soon?

- Is the Virtual Router feature on the roadmap? This already existed in the VSX infrastructure, and together with SD-WAN it could work wonders.

- Will information regarding SD-WAN performance figures be included in the datasheets?

- Will it be possible to apply SD-WAN policy and Application-level QoS to Remote Access VPN traffic?

- Why was the SD-WAN policy moved to a separate shared layer? Is any enhancement planned in this area going forward? Also, what will the behavior be when Application-level QoS and the limiter object in the Application Control blade rules are used together?

- Will Application-level QoS statistics be observable in real time?

- When a guarantee limit is used together with Application-level QoS, how can metrics such as their current bandwidth utilization be monitored?

- Will Application-level QoS or SD-WAN in R82.20 disable the SSL decryption and IPsec crypto acceleration features on the NVIDIA ASIC you are planning?

- When will genuinely useful, detailed documentation regarding R82.20 start to be shared?

We are truly very excited about R82.20.

Thanks.

[Amit_Navon]

Hello @ilkerd ,

See my feedbacks per each Q:

I downloaded the R82.20 EA release, but the traditional QoS blade was not available?

OoS blade will be available, however as of R82.20 GA it will be blocked if SD-WAN blade is enabled in order to avoid misconfiguration what both are enabled.

- Is it now necessary to purchase an SD-WAN license in order to perform QoS? Is Application-level QoS not available without an SD-WAN license?

See my previous answer, it can be used if SD-WAN is not activated.

- Does the SD-WAN policy support inline layers? If not, when will this capability be introduced?

R82.20 GA will allow SD-WAN as shared policy, further enhancements are in the roadmap. 

Can you please explain possible use case for inline steering policy?

- Will SD-WAN-capable ASICs and next-generation hardware be arriving soon?

SD-WAN is supported on all of current and future check point HW form factors.

- Is the Virtual Router feature on the roadmap? This already existed in the VSX infrastructure, and together with SD-WAN it could work wonders. VSX support was de-prioritized.

SD-WAN will support VSNext in future releases.

- Will information regarding SD-WAN performance figures be included in the datasheets?

SD-WAN impact in overall firewall performance is marginal, it is advised to size according to the threat prevention blade. 

- Will it be possible to apply SD-WAN policy and Application-level QoS to Remote Access VPN traffic?

See my previous answer for SD-WAN and QoS blade.

- Why was the SD-WAN policy moved to a separate shared layer? Is any enhancement planned in this area going forward? Also, what will the behavior be when Application-level QoS and the limiter object in the Application Control blade rules are used together?

Already provide answer above.

- Will Application-level QoS statistics be observable in real time?

SD-WAN QoS KPI are part of the data provided in the SD-WAN observability

- When a guarantee limit is used together with Application-level QoS, how can metrics such as their current bandwidth utilization be monitored?

- Will Application-level QoS or SD-WAN in R82.20 disable the SSL decryption and IPsec crypto acceleration features on the NVIDIA ASIC you are planning?

- When will genuinely useful, detailed documentation regarding R82.20 start to be shared?

SD-WAN documentation is available

BR,Amit