Thread by @danieldibswe

For the last couple of years I have worked extensively with #SDWAN. Let me share with you some of the common design mistakes that I see, often to save a few bucks, which ends up costing more in the end. Let's focus on the transports. A 🧵

Don't cheap out on bandwidth. Bandwidth is relatively
cheap. Get two INET transports, from different
providers if possible. Have them be the same BW
and use them equally. Having them different BW
will complicate the design and policy.

2/7

For dual router sites, connect both routers to
both of the transports. This allows for faster
convergence and no need to configure TLOC
extension. ISP needs to provide two ports,
though.

3/7

Don't let your ISP play stupid games with you.
Do NOT procure some kind of active/backup setup
like this with VRRP and different BW depending
on what router is active. This is horrible to
operate and complicates your design. No, god no.

4/7

Running an overlay comes with some overhead, of course.
That means a lower MSS as IPSec takes up some of those
precious bytes. Calculate the overhead and see if the
ISP can support a larger MTU to account for this. This
is not a must but having 1500 bytes available is nice.

5/7

Often Zero Touch Provisioning relies on device getting
IP address via DHCP. Ask your ISP if they can provide
a public IP via DHCP. Surprisingly often, they can't,
and there are some workarounds but your life is easier
if you have DHCP on your interfaces.

6/7

Avoid NAT. Yes, many scenarios still work, depending on
the type of NAT, but having a network without NAT makes
the probability of your tunnels coming up a lot higher
and easier to troubleshoot the data plane. Get a public
IP for your devices.

7/7