[Topic 237477]

About Kaspersky SD-WAN

Kaspersky SD-WAN is used to build Software-Defined Wide Area Networks (SD-WAN) for routing traffic over communication channels using Software Defined Networking (SDN) technology. The main advantage of such networks is the ability to automatically determine the most efficient routes for the traffic.

The SDN technology implies the separation of the control plane and the data plane. The control plane comprises an

Network Function Virtualization (NFV) is performed in accordance with the standards set out in the NFV MANO (NFV Management and Network Orchestration) specification of the European Telecommunications Standards Institute (ETSI).

The solution is intended for service providers, as well as organizations with a large branch network, and replaces standard routers in wide area networks. The deployment procedure is independent of particular transport technologies used on your network. The solution also supports sending traffic over multiple links based on application requirements regarding bandwidth and quality of service.

Kaspersky SD-WAN lets you do the following:

• Smart traffic control.
• Automatic configuration of CPE devices. This functionality makes deployment of devices on location less personnel-intensive.
• Centralized management of the network infrastructure through the orchestrator web interface. For example, you can use the orchestrator web interface to configure CPE devices and links.
• Continuous monitoring of the network topology and automatically responding to any changes. For example, you can configure the traffic to be switched to a backup link in case the main link fails.
• Automatic response of the network to changes in the quality of service of communication channels to meet the requirements of various applications used on the network.

The figure below shows a diagram of an SD-WAN network built using the Kaspersky SD-WAN solution.

SD-WAN network diagram

[Topic 249139]

Distribution kit

To learn more about purchasing the solution, please visit the Kaspersky website (https://www.kaspersky.com) or contact partner companies.

The distribution kit includes the following components:

• Docker containers for solution deployment:
  • knaas-ctl
  • knaas-orc
  • knaas-www
  • knass-vnfm
  • knaas-vnfm-proxy
• Firmware for installing and managing CPE devices.
• A file with the text of the End User License Agreement, which stipulates the terms and conditions that you must accept to use the solution.
• Kaspersky SD-WAN Online Help files that let you read documentation without an internet connection.

The content of the distribution kit may differ depending on the region in which the solution is distributed.

[Topic 239105]

Hardware and software requirements

The solution includes the following software modules:

• Orchestrator, which is part of the backend of the solution.
• Orchestrator web interface, which is part of the frontend of the solution.
• Orchestrator database (MongoDB version 5.0.7).
• VNFM

  Manages the lifecycle of virtual network functions using SSH, Ansible playbooks, scripts, and Cloud-init attributes.

  Manages the lifecycle of virtual network functions using SSH, Ansible playbooks, scripts, and Cloud-init attributes.

  Manages the lifecycle of virtual network functions using SSH, Ansible playbooks, scripts, and Cloud-init attributes.

  .
• NGINX web server for balancing HTTP and HTTPS requests to VNFMs and providing web proxies to CPE devices and VNFs.
• Redis 6.2.7 resident database.
• SD-WAN Controller.

Modules are deployed as Docker containers for stand-alone installation and scaling. If necessary, you can provision additional resources (CPU cores, RAM) to each module and distribute them among multiple servers to increase the overall performance of the solution.

Kaspersky SD-WAN components can be deployed on multiple physical servers or virtual machines (VMs). KVM and VMware virtualization platforms are supported. You must ensure the availability of servers or virtual machines for installing Kaspersky SD-WAN, an external Zabbix 5.0.26 monitoring system, and an SD-WAN Controller.

The controller can be deployed in two ways:

• As a VNF in the OpenStack cloud platform (Xena release). Controller nodes are hosted on compute nodes.
• As a
  PNF

  Pre-deployed ready-to-use network functions that are uploaded to the orchestrator web interface. The orchestrator can then handle additional configuration of the PNF.

  Pre-deployed ready-to-use network functions that are uploaded to the orchestrator web interface. The orchestrator can then handle additional configuration of the PNF.

  Pre-deployed ready-to-use network functions that are uploaded to the orchestrator web interface. The orchestrator can then handle additional configuration of the PNF.

  Pre-deployed ready-to-use network functions that are uploaded to the orchestrator web interface. The orchestrator can then handle additional configuration of the PNF.

  on separate virtual machines.

Before deploying Kaspersky SD-WAN, make sure that your network infrastructure meets the following hardware and software requirements.

Hardware requirements

Hardware requirements are listed in the following tables. Note that these requirements depend on the number of managed CPE devices used in the SD-WAN instance. The tables provide typical values, so if you need to calculate the exact requirements for your deployment scheme, please contact Kaspersky technical support.

Hardware requirements for servers or virtual machines for orchestrator deployment

Hardware requirements for servers or virtual machines for deployment of other components of the solution

If you need to connect more than 250 CPE devices, deploy additional SD-WAN Controller clusters.

For detailed information about the hardware requirements of the Zabbix monitoring system, see the official documentation of the Zabbix solution.

When deploying the solution, an offline map is configured. Consider the following disk space requirements:

• The offline map (central-fed-district-latest.osm.pbf) takes up approximately 100 GB.
• Geocoding data takes up approximately 10 GB.

We recommend considering the possibility of overcommitment at the resource planning stage for your SD-WAN instance deployment. The maximum overcommitment ratio available when deploying containers is 3. The ratio is determined by the following characteristics of the SD-WAN instance:

• Number of CPE devices in use
• Frequency of network state changes
• Traffic bandwidth
• Size of transmitted traffic packets

Channel requirements

The following channels are supported:

• MPLS transport networks
• Broadband links for connecting to the Internet
• Leased communication lines
• Wireless connections including 3G, 4G, LTE, and 5G
• Satellite communication channels

Software requirements

Docker 1.5 or later is required. The following 64-bit operating systems are supported:

• Ubuntu 20 LTS or later
• Astra Linux 1.7 or later (security level: "Orel").

Supported browsers

You can use the following browsers to manage the orchestrator web interface:

• Google Chrome 100 or later
• Firefox 100 or later
• Microsoft Edge 100 or later
• Opera 90 or later
• Safari 15 or later

CPE device requirements

Kaspersky SD-WAN supports the following devices:

• KESR-M1-R-5G-2L-W
• KESR-M2-K-5G-1L-W
• KESR-M2-K-5G-1S
• KESR-M3-K-4G-4S
• KESR-M4-K-2X-1CPU
• KESR-M4-K-8G-4X-1CPU
• KESR-M5-K-8G-4X-2CPU
• KESR-M5-K-8X-2CPU

Kaspersky experts carried out tests to confirm the functionality of CPE devices when providing the L3 VPN service (see the table below). DPI (Deep Packet Inspection) was not used on the tested devices, and traffic encryption was disabled.

Tested CPE device models (L3 VPN Service)

For more details about the specifications of CPE devices that you can use in Kaspersky SD-WAN, see the website of the solution.

[Topic 251413]

Shared storage requirements

Kaspersky SD-WAN uses shared storage (hereinafter also referred to as storage) to ensure fault tolerance. This storage contains the following directories with data that the orchestrator needs:

• backups — backup copies of VNF and PNF configurations
• firmware — CPE device firmware
• images — VNF images
• vnf_configs — files that can be used by scripts when configuring VNFs
• vnf_descriptions — VNF descriptors

We recommend using your own shared storage. The requirements for deploying the shared storage are as follows:

• Support for simultaneous read and write from multiple hosts.
• The recommended size depends on the size of the files being stored, but at least 40 GB of available protected space that supports further expansion.
• Bandwidth of the communication channel between the storage and the orchestrator must be at least 1 Gbps; 10-Gigabit Ethernet or 8-Gigabit FC (Fiber Channel) is recommended.
• The supported IOPS (input/output operations per second) value must be at least 250, at least 400 IOPS is recommended.
• Storage type:
  • NFS
  • iSCSI
  • FC
  • CephFS
• The storage must be mounted.
• Must stay available if the host restarts.

[Topic 248911]

What's new

Kaspersky SD-WAN 2.1 has the following new and improved functionality:

• The OSPF dynamic routing protocol is supported.
• Additional connection scenarios are now supported for connections between CPE devices when the SD-WAN gateway is behind NAT.
• Additional scenarios are now supported for CPE devices that use Internet and MPLS channels at the same time.
• Configuring of Controller IP addresses on WAN interfaces of CPE devices is supported.
• Now you can manage the SD-WAN topology map without a network connection.
• Added token and password rotation for CPE devices.
• Monitoring data can now be encrypted when it is sent outside the SD-WAN link.

[Topic 237688]

Architecture of the solution

Kaspersky SD-WAN includes the following components:

• The Orchestrator provides a graphical web interface for managing the infrastructure of the solution, including CPE devices. Note that the orchestrator can manage multiple SD-WAN instances.
• The SD-WAN Controller centrally manages CPE devices via the OpenFlow protocol, as well as the overlay network, on top of which you can create transport services.
• CPE devices form an SDN fabric in the form of an overlay network. CPE devices can be assigned the SD-WAN gateway role. In this case, links are automatically established from all other devices that are assigned the standard CPE role. If you plan to use SD-WAN gateways in the network topology, we recommend installing them in multiple instances for fault tolerance.
• Virtual Network Function Manager (hereinafter also referred to as VNFM) – Manages the configuration of
  Virtual Network Functions

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  Network functions implemented as virtual machines on Commercial Off The Shelf (COTS) computer platforms.

  (VNF) and CPE devices.

All components of the solution are deployed in data centers, with the exception of CPE devices, which are installed on remote locations. If you are deploying an SD-WAN instance using VNF, the following additional components may be included in the solution architecture:

• The SDN controller provides management and configuration of hardware and software switches in the data center. This component is optional.
• The VIM provides management of computational, networking, and storage resources. All of these resources are required for VNF to run.

Kaspersky SD-WAN has a distributed microservice architecture that is deployed as Docker containers (see the figure below). An SD-WAN Controller can comprise a single node or a cluster of three/five nodes. Cluster nodes of the controller are separate virtual machines and can run on different physical servers for fault tolerance.

Architecture of Kaspersky SD-WAN

[Topic 239025]

Redundancy and fault tolerance

Fault tolerance ensures continuous and uninterrupted transmission of traffic over the SD-WAN network and functioning of network services. Fault tolerance is enhanced by the use of redundancy and failover mechanisms at different levels of the network infrastructure, for example, you can create backup service interfaces.

A fault-tolerant network can remain operational in case of minor problems as well as major disasters involving central components such as routers, links, and data centers. When a component fails, a backup component of the same type takes its place. For example, you can create a backup link to which traffic is transferred if the main link becomes unavailable.

Fault tolerance makes it easier to balance the load across multiple links by optimizing the utilization of traffic bandwidth and avoiding congestion. This helps avoid any existing link becoming a bottleneck in the network topology.

Kaspersky SD-WAN maintains continuous operation in the event of the following types of faults:

• Failure of a central component, such as orchestrator, SD-WAN Gateway, or SD-WAN Controller
• Failure or overload of communication channels between geographically redundant central components, when network components are located at geographically dispersed locations to make data storage more reliable
• Failure or congestion of communication channels between CPE devices and SD-WAN gateways

[Topic 239027]

Redundancy of central components of the solution

Kaspersky SD-WAN supports two component deployment schemes: N+1 and 2N+1.

The N+1 deployment scheme means that one backup component is deployed alongside an active component. If the active component fails, the backup component instantly takes its place, ensuring continuity of operation.

The 2N+1 deployment scheme is an expanded version of N+1 and differs in that it has an additional level of redundancy. In this scheme, the active component consists of two sets. These are synchronized with each other, and one can take the place of the other if a malfunction occurs. One extra backup component is also deployed. This redundancy scheme allows components to remain operational even when multiple failures occur in a row.

The table below shows the redundancy schemes and protocols that are used for different components of the solution.

Redundancy schemes for components of the solution

An example of locating solution components in geographically dispersed data centers is shown in the figure below. All subsequent figures use the same symbols:

• orchestrator — orc
• orchestrator web interface — www
• orchestrator database — orc-dbs
• SD-WAN Controller and its database — ctl
• SD-WAN gateway — GW

For components of the solution that are N+1 redundant, two nodes are deployed in separate data centers. Each of the nodes is in the active state. You can use a virtual IP address or DNS service to select the node to which requests are directed.

Placing solution components in geographically dispersed data centers

Components that are 2N+1 redundant form a cluster. This cluster contains one primary node and two nodes providing redundancy. You can designate one of the nodes as an arbiter to economize resources and reduce the requirements for the links.

If a cluster node is designated as an arbiter, it does not contain a database and you cannot make it the primary node. The arbiter node takes part in voting when the primary node is selected and exchanges periodic service packets (heartbeats) with other nodes.

The figure below shows an example of an failure at one of the locations and how the solution responds to it. This example shows an accident in which the nodes of the solution component cluster fail at location 1.

Accident at location 1

If nodes of the solution component cluster at location 1 fail, the following events occur:

1. Node orc-dbs 2 and arbiter node orc-dbs 3 lose contact with node orc-dbs 1, and subsequently vote for a new primary node.
2. Arbiter node orc-dbs 3 cannot be the primary node, therefore orc-dbs 2 becomes the primary node and informs the orchestrator of its role.
3. Node ctl 2 and arbiter node ctl 3 lose contact with node ctl 1, and subsequently vote for a new primary node.
4. Arbiter node ctl 3 cannot be the primary node, therefore ctl 2 becomes the primary node and informs the orchestrator of its role.

The figure below shows an accident in which the nodes of the solution component cluster fail at location 2.

Accident at location 2

If nodes of the solution component cluster at location 2 fail, the following events occur:

1. Node orc-dbs 1 and arbiter node orc-dbs 3 lose contact with node orc-dbs-2, after which node orc-dbs 1 remains the primary node.
2. Node ctl 1 node and arbiter node ctl 3 lose contact with node ctl 2, after which node ctl 1 remains the primary node.

The figure below shows an example of an accident in which the connection between location 1 and location 2 is severed.

Connection failure between location 1 and location 2

If cluster nodes of solution components at location 1 and location 2 cannot connect to each other, the following events occur:

1. Node orc-dbs 1 loses contact with node orc-dbs 2.
2. Node orc-dbs 1 node remains the primary node because arbiter node orc-dbs 3 observes both locations operating normally.
3. Node ctl 1 loses contact with node ctl 2.
4. Node ctl 1 remains the primary node because arbiter node ctl 3 observes both locations operating normally.

The figure below shows an example of an accident in which the connection between location 1 and other locations is severed.

Failure of connections between location 1 and other locations

If cluster nodes of solution components at location 1 cannot connect to other locations, the following events occur:

1. Node orc-dbs 1 loses contact with node orc-dbs 2.
2. Node orc-dbs 2 becomes the primary node and informs the orchestrator of its role because the arbiter node orc-dbs 3 observes that location 1 is unavailable.
3. Node ctl 1 loses contact with node ctl 2.
4. Node ctl 2 becomes the primary node and informs the orchestrator of its role because arbiter node ctl 3 observes that location 1 is unavailable.

[Topic 239053]

Redundancy of communication channels between CPE devices

Kaspersky SD-WAN guards against interruptions in communication between CPE devices by simultaneously using all available communication channels, for example, Internet or LTE channels.

Active/Active mode

In this mode, all WAN interfaces of CPE devices are in the active state and transmit user traffic.

The SD-WAN Controller balances traffic using 2 to 16 transport paths (multipathing). Balancing evenly distributes traffic among links, which prevents congestion of individual links and performance problems for users. Three balancing modes are supported:

• Per flow balancing, taking into account information at levels L2 to L4. In this mode, two types of balancing are available:
  • Equal balancing — the streams are allocated evenly among paths.
  • Unequal balancing — the streams are allocated among paths proportionally to the costs of the links.
• Per packet — packets are allocated in proportion to the cost of the links during transmission.
• Broadcast — packets are sent to all links simultaneously to prevent losses.

In Active/Active mode, the CPE device remains available as long as at least one communication channel is operational.

Active/Standby mode

In this mode, you must select the primary and reserve transport paths for the traffic. In this case, balancing is not used. Rules for using the reserve WAN interface in a situation when the path through the main WAN interface becomes unavailable are loaded to the CPE device in advance. In this case, if the main transport path is disrupted, packet switching rules are not rewritten, and the device sends the packets through the reserve interface.

You can configure redundancy at the transport service level. When creating the transport service, you specify reserve service interfaces (reserve SI) on the selected CPE device or on another device. We recommend creating the primary and reserve service interfaces on different devices. Traffic is switched to the reserve service interface if the primary SI is unavailable.

The solution supports creating reserve service interfaces for all types of L2 transport services.

The figures below show typical examples of communication interruptions between CPE devices:

• Failure of one of the CPE devices.

  

• Failure of a WAN interface of one of the CPE devices.

  

• Loss of connectivity between two CPE devices.

  

• Failure of a LAN interface of one of the CPE devices.

  

[Topic 239165]

Ensuring security

Security in Kaspersky SD-WAN is ensured in the

• User authentication and authorization
• Use of secure management protocols
• Encryption of control traffic
• Secure connection of CPE devices

Secure management protocols

We recommend using HTTPS when communicating with the SD-WAN network through the orchestrator web interface or API. You can upload your own certificates to the web interface or use automatically generated self-signed certificates. The solution uses several protocols to transmit control traffic to its components (see the table below).

Protocols for transmitting control traffic

Secure connection of CPE devices

The solution uses the following mechanisms to identify CPE devices during installation and registration:

• Discovery of CPE device by DPID.
• Deferred registration. You can select the state of the CPE device after successful registration: Activated or Deactivated. A deactivated CPE device must be manually activated after making sure it is installed at the location.
• Two-factor authentication — the client receives a key that must be entered on the CPE device to activate it.

During registration, the CPE device verifies the authenticity of the orchestrator certificate and subsequently sends its DPID and token to the orchestrator. The orchestrator checks if the DPID and token against its database and, if the check is successful, provides the device with information necessary for connecting to the network as well as configuration. The device then establishes a connection with the SD-WAN Controller, which in turn programs the behavior of the device for subsequent traffic processing.

If the DPID is missing from the inventory, the CPE device is displayed with the Unknown status and does not connect to the SD-WAN network.

Using VNF

You can add a layer of security with VNFs deployed in the data center and/or on

• Next-Generation Firewall (NGFW)
• Protection from DDoS (Distributed Denial of Service) attacks
• Intrusion Detection System (IDS) and Intrusion Prevention System (IPS)
• Anti-Virus
• Anti-Spam
• Filtering system for URL and web content
• DLP (Data Loss Prevention) system for preventing confidential information leaks
• Secure Web Proxy

[Topic 240002]

User interface of the solution

Kaspersky SD-WAN can be managed through the orchestrator web interface. You can use the sections that are displayed in the menu (see the figure below) to configure individual components of the solution. When you go to a section, an additional menu with the section contents is displayed.

Kaspersky SD-WAN menu

The menu contains the following sections:

• Dashboard () — In this section, you can view information about the current state of solution components such as CPE devices, VNFs, and PNFs.
• Infrastructure () — In this section, you can manage the network infrastructure, for example, create domains, add data centers and VIMs. In addition, all SD-WAN Controllers available to you are displayed here.
• Catalog () — In this section, depending on your role, you can do the following:
  • The platform administrator can upload VNF/PNF packages and create network service templates.
  • A tenant administrator can create network services.
• SD-WAN () — In this section, you can manage CPE devices, SD-WAN instances, UNIs, as well as manage firmware and device certificates.
• Scheduler () — In this section, you can manage delayed tasks.
• Log () — In this section, you can view the logs of various components of the solution. For example, modifications made by users to CPE device configuration are displayed here.
• Tenants () — In this section, you can create tenants and provide various solution components to the tenants, such as CPE devices, VIMs, and UNIs. You can also use this section to connect to the orchestrator web interface of the tenant as an administrator.
• Users () — In this section, you can create users, user groups, and access permissions, as well as configure domain authentication.
• Confirmation () — In this section, you can manage confirmation requests.

When you navigate to one of the sections, the menu is initially collapsed. To expand the menu, hover your mouse cursor over the icon of one of the sections. You can click the expand button to disable the automatic minimization of the menu.

[Topic 239565]

Authentication in Kaspersky SD-WAN

To authenticate in Kaspersky SD-WAN:

1. In the address bar of your browser, enter the IP address or name of the Kaspersky SD-WAN server.
2. This opens the authentication page; on that page, enter your user name and password. The password must contain at least one uppercase A–Z character, lowercase characters, numerals, and special characters. Password length: 8 to 50 characters.
3. Click Log in.

After successful authentication, you are taken to the section or subsection that you set as the default page.

[Topic 251907]

Setting and resetting the default page

The default page is a section or subsection of the orchestrator web interface (including the SD-WAN Controller configuration menu) that is automatically displayed after your authentication.

To set or reset the default page:

1. Go to the section or subsection of the orchestrator web interface that you want to set as the default page.
2. In the lower part of the menu, click the settings button and in the drop-down list, select Set as the default page.

   The Default page is set message is displayed in the upper part.

3. To reset the default page, click the settings button and in the drop-down list, select Reset the default page.

   The Default page is reset message is displayed in the upper part. The Dashboard section is now the default page.

[Topic 248912]

Switching between light and dark theme

To switch between light and dark orchestrator web interface themes,

in the lower part of the menu, click the settings button and in the drop-down list, select one of the following values:

• Dark mode
• Light mode

[Topic 251910]

Limiting the duration of a user session when idle

By default, after authenticating in the orchestrator web interface, you can remain idle for 3,600 seconds, after which your user session is terminated. You can manually increase or decrease the maximum allowed idle time.

To specify the length of time after which your user session is terminated due to inactivity:

1. In the lower part of the menu, click the settings button and in the drop-down list, select Session expiration time.
2. This opens a window; in that window, enter the time in seconds after which you want to have the session terminated in case of inactivity. Range of values: 60 to 86,400. The default setting is 3,600.
3. Click Save.

[Topic 251902]

Viewing active user sessions

You can view a list of users that have used your account to authenticate in the orchestrator web interface.

To view active user sessions:

1. In the lower part of the menu, click the settings button and in the drop-down list, select Active sessions.

   A table of active user sessions is displayed.

2. If you want to terminate an individual user session, click End session next to that session.
3. If you want to terminate multiple user sessions at the same time:
   1. Select the check boxes next to the sessions.
   2. In the upper part of the page, click the Actions button and in the drop-down list, select End session.

[Topic 246843]

Configuring the Docker container log verbosity

Kaspersky SD-WAN automatically keeps logs of Docker containers, which are used to deploy and support solution components. You can select the verbosity level of these logs to monitor containers and restore them more quickly if failures occur.

When you open the log, the following buttons for selecting the level of detail are displayed in the upper part of the page, as well as next to each Docker container:

• Click TRACE to log the most complete information, including debug statements, for advanced troubleshooting.
• Click DEBUG to log detailed information, including variable values and function call records, for troubleshooting and understanding the way in which the container operates.
• Click INFO to log general information for understanding the way in which the container operates and looking up important events. This level of detail is selected by default for all containers.
• Click WARN to log errors or events that do not call for immediate intervention from the user, but may compromise the operation of the container.
• Click ERROR to log errors or exceptions that may compromise the operation of the container. Such records often require immediate intervention from the user.

To configure Docker container log verbosity:

1. In the lower part of the menu, click the settings button and in the drop-down list, select Log settings.

   A table of Docker containers is displayed.

2. Select the Docker container log verbosity:
   • To configure the verbosity level of all Docker containers, click the corresponding button in the General logging level section.
   • To configure the verbosity level of an individual Docker container, click the corresponding button in the Logging level column.

[Topic 251933]

Navigating to the orchestrator API

To navigate to the orchestrator API,

In the lower part of the menu, click the API button .

This opens a list of API commands that can be used to manage the orchestrator.

[Topic 262120]

Changing the language of the orchestrator web interface

The orchestrator web interface supports English and Russian languages.

To change the language of the orchestrator web interface,

click one of the following buttons in the lower part of the menu:

• EN to switch the language of the orchestrator web interface to English.
• RU to switch the language of the orchestrator web interface to Russian.

[Topic 246872]

Licensing of Kaspersky SD-WAN

This section covers basic concepts of Kaspersky SD-WAN licensing. If you need to scale the solution, you can purchase additional software and hardware licenses.

[Topic 246870]

About the End User License Agreement

The End User License Agreement is a binding agreement between you and AO Kaspersky Lab, stipulating the terms on which you may use the program. The text of the End User License Agreement in supported languages is located in the license <language code>.rtf files included in the Kaspersky SD-WAN distribution kit.

Read through the terms of the End User License Agreement carefully before you start using Kaspersky SD-WAN.

By confirming that you agree with the End User License Agreement, you signify your acceptance of the terms of the End User License Agreement. You can do this in one of the following ways:

• Initialize the KNAAS_EULA_AGREED environment variable before starting the Kaspersky SD-WAN Docker container:

  export KNAAS_EULA_AGREED=yes

  In this case, when starting the Kaspersky SD-WAN Docker container, pass the KNAAS_EULA_AGREED environment variable using the -e option:

  docker run -e KNAAS_EULA_AGREED [OPTIONS] IMAGE [COMMAND] [ARG...]

• Initialize the KNAAS_EULA_AGREED environment variable directly when starting the Kaspersky SD-WAN Docker container:

  docker run -e KNAAS_EULA_AGREED=yes [OPTIONS] IMAGE [COMMAND] [ARG...]

If the KNAAS_EULA_AGREED environment variable is not initialized or is initialized with the value no (KNAAS_EULA_AGREED=no), this means that you do not agree with the terms of the End User License Agreement. In this case, when starting the Kaspersky SD-WAN Docker container, an error message is displayed, and Kaspersky SD-WAN does not start.

[Topic 246869]

About data provision

The following third-party solutions are integrated into Kaspersky SD-WAN:

• Zabbix monitoring system
• OpenStack platform for creating cloud services and storage
• OpenStreetMap geographic maps

User data that may be introduced to Zabbix, OpenStack, or OpenStreetMap as a result of integration are not sent outside the perimeter of the organization's infrastructure.

Kaspersky protects received information in accordance with requirements stipulated by applicable law and Kaspersky policies.

[Topic 256060]

Managing Kaspersky SD-WAN domains

In Kaspersky SD-WAN, domains are logical groups of network resources that can consist of one or more data centers. Network resources necessary for the functioning of the solution are distributed between domains.

[Topic 241716]

Creating a domain

To create a domain:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the upper part of the page, click + Domain.
3. This opens a window; in that window, in the Name field, enter the name of the domain. Range of values: 1 to 50 characters.
4. If necessary, in the Description field, enter a brief description of the domain. Maximum length: 100 characters.
5. Click Create.

The domain is created and displayed in the Resources panel. You can now add data centers to this domain to combine them into a single logical group.

[Topic 256064]

Editing a domain

To edit a domain:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the Resources panel, select the Domain tab.

   A list of domains is displayed.

3. Click the settings button next to the domain and in the drop-down list, select Edit.
4. This opens a window; in that window, edit the settings that you want to change. For a description of the settings, see the instructions for creating a domain.
5. Click Save.

[Topic 256065]

Deleting a domain

Deleted domains cannot be restored.

To delete a domain:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the Resources panel, select the Domain tab.

   A list of domains is displayed.

3. Click the settings button next to the domain and in the drop-down list, select Delete.
4. In the confirmation window, click Delete.

The domain is deleted and is no longer displayed in the Resources pane.

[Topic 256067]

Managing data centers

Central components of Kaspersky SD-WAN, with the exception CPE devices, are located in data centers.

A data center is a centralized location for computer systems and associated components, such as servers, data storage systems, networking devices, and security systems. They are used for storing, distributing and transferring large amounts of data. Data center resources are provided to SD-WAN instances.

Note that when adding a data center, you must specify the web address of the deployed VNFM.

[Topic 241718]

Adding a data center

Before adding a data center, you must create a domain.

To add a data center:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the upper part of the page, click + Data center.
3. This opens a window; in that window, in the Name field, enter the name of the data center. Range of values: 1 to 50 characters.
4. If necessary, in the Description field, enter a brief description of the data center. Maximum length: 100 characters.
5. In the Domain drop-down list, select the domain to which you want to add the data center.
6. In the VNFM URL field, enter the web address of the Virtual Network Function Manager. The data center uses the address that you entered to connect to the VNFM and gain access to the VNFs that the VNFM is managing. To verify that the VNFM is available, you can click Test connection.
7. If necessary, enter the address of the data center in the Location field.
8. Click Create.

The data center is created and displayed in the Resources pane.

[Topic 256073]

Migrating a data center

When you migrate a data center, it is transferred from one Kaspersky SD-WAN domain to another. Consolidating multiple data centers into one location can reduce rent and the number of operations performed, as well as improve overall performance.

When your organization's offices or individual users experience lag when using the SD-WAN network, migrating the data center to a location closer to the offices or users provides more reliable connectivity.

You can also move your data center to a more cost-effective location that, for example, allows using cloud services or renting equipment jointly with other organizations.

To migrate a data center:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the Resources pane, select the Data center tab.

   A list of data centers is displayed.

3. Click the settings button next to the data center and in the drop-down list, select Migrate.
4. This opens a window; in that window, select the domain to which you want to migrate the data center.
5. Click Migrate.

The data center migration begins; upon completion, the data center is displayed under the new domain in the Resources pane.

[Topic 256071]

Editing a data center

To edit a data center:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the Resources pane, select the Data center tab.

   A list of data centers is displayed.

3. Click the settings button next to the data center and in the drop-down list, select Edit.
4. This opens a window; in that window, edit the settings that you want to change. For a description of the settings, see the instructions for adding a data center.
5. Click Save.

[Topic 256072]

Deleting a data center

Deleted data centers cannot be restored.

To delete a data center:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the Resources pane, select the Data center tab.

   A list of data centers is displayed.

3. Click the settings button next to the data center and in the drop-down list, select Delete.
4. In the confirmation window, click Delete.

The data center is deleted and is no longer displayed in the Resources pane.

[Topic 256074]

Managing VIMs

Before deploying a VNF in a data center, you must add at least one

[Topic 242217]

Configuring the VIM

Expand all | Collapse all

Deploying a VIM in the data center implies centralized management of the VNF lifecycle, while a VIM deployed on a uCPE device allows delivering VNFs to remote locations and managing these VNFs locally.

You can configure the VIM in the data center or in the

• Configuring a VIM in a data center.

  To configure a VIM in a data center:

  1. In the menu, go to the Infrastructure section.

     The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

  2. In the upper part of the page, click + VIM.
  3. This opens a window; in that window, in the Domain and Data center drop-down lists, select the domain and data center where the VIM is deployed.
  4. In the Name field, enter the name of the VIM.
  5. In the IP field, enter the IP address or domain name for connecting the orchestrator to the VIM.
  6. In the Port field, enter the port number for connecting the orchestrator to the VIM identification service. The default setting is 5,000.
  7. In the Protocol drop-down list, select the protocol for connecting the orchestrator to the VIM:
     • http (selected by default)
     • https
  8. In the Login and Password fields, enter the name and password of an OpenStack account with administrator privileges to authenticate the orchestrator in the OpenStack cloud platform. If authentication is successful, the orchestrator gains access to managing the virtual infrastructure that is available to the administrator.
  9. If necessary, change the advanced orchestrator authentication settings in the OpenStack cloud platform:
     1. In the Administrator project field, enter the name of the administrator project for orchestrator authentication in this project.
     2. In the Domain field, enter the OpenStack domain name for orchestrator authentication in this domain.
  10. In the Behind NAT drop-down list, select whether the VIM is behind NAT (Network Address Translation):
      • Enabled to indicate that the VIM is behind NAT and network address translation happens when it interacts with the SD-WAN instance.
      • Disabled to indicate that the VIM is not behind NAT. This is the default.
  11. If necessary, specify the overcommitment ratios for physical resources:
      1. In the CPU overcommitment field, enter the CPU core overcommitment ratio. The default setting is 1.
      2. In the RAM overcommitment field, enter the RAM overcommitment ratio. The default setting is 1.
      3. In the Disk overcommitment field, enter the disk space overcommitment ratio. The default setting is 1.

      Overcommitment ratios let you provision virtual machines with more virtual resources than physically present. This is possible because, as a rule, virtual machines do not simultaneously use all available physical resources to the maximum. For example, if you specify a disk space overcommitment factor of 3, the available virtual disk space can be three times as large as the disk space physically available on the host.

      When configuring overcommitment, consider how the capabilities of your hardware relate to the requirements of the virtual machines. If you specify a high overcommitment ratio for physical resources and virtual machines happen to use them up, this may lead to the network lagging and/or parts of network becoming completely unavailable.

  12. If necessary, in the Parallelism field, enter the maximum number of simultaneous operations between the orchestrator and the VIM. The default setting is 1. This setting lets you reduce the overall processing time for operations, but creates an additional load on the virtual infrastructure.

      We recommend not changing the default value unless the overall operation processing speed is critical for you.

  13. In the SDN cluster drop-down list, select the SDN cluster to which OpenStack is connected, or None if OpenStack is not connected to an SDN cluster.
  14. In the Maximum number of VLANs field, enter the maximum number of VLANs that you plan to use on the VIM. This setting lets the orchestrator keep track of the number of segments available for use. Range of values: 0 to 4,094.
  15. If the VIM supports SR-IOV, enter the physnet name in the SR-IOV physical network field. The orchestrator uses the SR-IOV physical network name to connect virtual machines with the SR-IOV interface type.
  16. If you are using a network with the VLAN segmentation type for management, in the VLAN physical network field, enter the VLAN ID.
  17. If you selected an SDN cluster in the SDN cluster drop-down list, configure the connection to that cluster:
      1. If you need to map the logical networks of the SD-WAN instance to a physical network, enter the physnet name in the OpenStack physical network field.
      2. In the Interface group drop-down list, select the port group through which all OpenStack nodes are connected to the SDN cluster.
      3. In the Control group drop-down list, select the port group through which the OpenStack control nodes are connected to the SDN cluster.
      4. If necessary, in the Compute group drop-down list, select the port group through which OpenStack compute nodes are connected to the SDN cluster.
  18. If in the SDN cluster drop-down list, you selected None, configure the network:
      1. If you need to map the flat networks of the SD-WAN instance to a physical network, enter the physnet name in the Flat physical network field.
      2. If you need to map the VXLAN of the SD-WAN instance to a physical network, enter the physnet name in the VXLAN physical network field.
      3. In the Control network segmentation drop-down list, select the type of segmentation that is used to isolate and secure control plane traffic in the SD-WAN structure:
         • VLAN
         • VXLAN
      4. In the Control segment ID field, enter the segment ID of the management network. The range of values depends on the value selected in the Control network segmentation drop-down list:
         • If you selected VLAN, the range of values is 0 to 4,095.
         • If you selected VXLAN, the range of values is 0 to 16,000,000.
      5. In the Port security drop-down list, select whether Port security is enabled or not. Port security enhances network security at the level of Ethernet ports of switches. This functionality prevents unauthorized access to the network by limiting the number of MAC addresses that can be associated with one physical port. When enabled, only trusted devices with predefined MAC addresses can connect to the network. You can select one of the following options:
         • Enabled
         • Disabled
      6. In the Permit CIDR field, enter the allowed subnet address for the control network.
  19. Click Create.

  The VIM is added and displayed in the table on the Compute resources tab.

• Configuring a VIM in a uCPE template.

  To configure a VIM in a uCPE template:

  1. In the menu, go to the SD-WAN → CPE templates subsection.

     A table of CPE templates is displayed.

  2. Click the CPE template.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the VIM tab.

     The VIM settings are displayed.

  4. In the Port field, enter the port number for connecting the orchestrator to the VIM identification service. The default setting is 5,000.
  5. In the Protocol drop-down list, select the protocol for connecting the orchestrator to the VIM:
     • http (selected by default)
     • https
  6. In the Login and Password fields, enter the name and password of an OpenStack account with administrator privileges to authenticate the orchestrator in the OpenStack cloud platform. If authentication is successful, the orchestrator gains access to managing the virtual infrastructure that is available to the administrator.
  7. If necessary, specify advanced orchestrator authentication settings in the OpenStack cloud platform:
     1. In the Administrator project field, enter the name of the administrator project for orchestrator authentication in this project.
     2. In the Domain field, enter the OpenStack domain name for orchestrator authentication in this domain.
  8. If you are using a network with the VLAN segmentation type for management, in the VLAN physical network field, enter the VLAN ID.
  9. In the Behind NAT drop-down list, select whether the VIM is behind NAT (Network Address Translation):
     • Enabled to indicate that the VIM is behind NAT and network address translation happens when it interacts with the SD-WAN instance.
     • Disabled to indicate that the VIM is not behind NAT. This is the default.
  10. If necessary, specify the overcommitment ratios for physical resources:
      1. In the CPU overcommitment field, enter the CPU core overcommitment ratio. The default setting is 1.
      2. In the RAM overcommitment field, enter the RAM overcommitment ratio. The default setting is 1.
      3. In the Disk overcommitment field, enter the disk space overcommitment ratio. The default setting is 1.

      Overcommitment ratios let you provision virtual machines with more virtual resources than physically present. This is possible because, as a rule, virtual machines do not simultaneously use all available physical resources to the maximum. For example, if you specify a disk space overcommitment factor of 3, the available virtual disk space can be three times as large as the disk space physically available on the host.

      When configuring overcommitment, consider how the capabilities of your hardware relate to the requirements of the virtual machines. If you specify a high overcommitment ratio for physical resources and virtual machines happen to use them up, this may lead to the network lagging and/or parts of network becoming completely unavailable.

  11. In the Maximum number of VLANs field, enter the maximum number of VLANs that you plan to use on the VIM. This setting lets the orchestrator keep track of the number of segments available for use. Range of values: 0 to 4,094.
  12. In the upper part of the settings area, click Save to save the configuration of the CPE template.

[Topic 256077]

Viewing VIM usage

You can see which compute resources are being used by the VIM to more efficiently manage the network infrastructure and, if necessary, optimize its usage.

To view VIM usage:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Select the Compute resources tab.

   A table of VIMs is displayed.

3. Click Management next to the VIM and in the drop-down list, select Show usage.

This opens a window with information about utilization of the following compute resources by the VIM:

• CPU
• RAM
• Disk space
• Network segments

[Topic 256075]

Editing a VIM

To edit a VIM:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Select the Compute resources tab.

   A table of VIMs is displayed.

3. Click Management next to the VIM and in the drop-down list, select Edit.
4. This opens a window; in that window, edit the settings that you want to change. For a description of the settings, see the instructions for adding a VIM.
5. Click Save.

[Topic 256076]

Deleting a VIM

Deleted VIMs cannot be restored.

To delete a VIM:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Select the Compute resources tab.

   A table of VIMs is displayed.

3. Click Management next to the VIM and in the drop-down list, select Delete.
4. In the confirmation window, click Delete.

The VIM is deleted and is no longer displayed in the table.

[Topic 256081]

Managing subnets

Subnets let you divide your network into segments, as enable efficient management of IP addresses and network resources by separating control traffic from user traffic.

When you create a subnet, you add a range of IP addresses. Addresses in this range are automatically assigned to devices on the subnet. You must add at least one IP address range for each data center used in your organization.

[Topic 241749]

Creating a subnet

To create a subnet:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. In the upper part of the page, click + Subnet.
3. This opens a window; in that window, in the Domain and Data center drop-down lists, select the domain and data center to which the subnet belongs.
4. In the Name field, enter the name of the subnet.
5. In the IP version drop-down list, select the version of IP addresses that the subnet uses:
   • IPv4 (selected by default)
   • IPv6
6. In the CIDR field, enter the IP address and subnet mask. Format of the value: <IP address>/<subnet mask>, for example, 192.168.2.0/24.
7. In the Gateway field, enter IP address of the default gateway that network devices on the subnet must use to communicate with other networks.
8. Under IP range, click + Add to add a range of IP addresses, and in the fields that are displayed, enter the starting and ending values for the range. IP addresses from the range are assigned to network devices on the subnet. You can add multiple ranges.

   You must add at least one IP address range for each data center used in your organization.

9. Under DNS, click + Add to add a DNS server, and in the field that is displayed, enter IP address of the server. Network devices receive the IP address of the DNS server together with IP addresses from the range. DNS servers make it possible for network devices to resolve domain names into IP addresses and thus support DNS-reliant applications such as browsers and email. You can add multiple servers.
10. Under Static routes, click + Add to add a static route, and in the field that is displayed, enter the route. Network devices receive the static route together with IP addresses from the range. Static routes allow controlling the routing of traffic between subnets, for example, to optimize traffic transmission, route certain types of traffic to a specific destination, or establish a connection between two remote locations. You can add multiple routes.
11. Click Create.

The subnet is created and displayed in the table on the IPAM tab.

[Topic 256086]

Editing a subnet

To edit a subnet:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Select the IPAM tab.

   A table of subnets is displayed.

3. Click Management next to the subnet and in the drop-down list, select Edit.
4. This opens a window; in that window, edit the settings that you want to change. For a description of the settings, see the instructions for creating a subnet.
5. Click Save.

[Topic 256089]

Deleting a subnet

Deleted subnets cannot be restored.

To delete subnets:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Select the IPAM tab.

   A table of subnets is displayed.

3. Click Management next to the subnet and in the drop-down list, select Delete.
4. In the confirmation window, click Delete.

The subnet is deleted and is no longer displayed in the table.

[Topic 246833]

Viewing logs

Logs help you detect errors that occur during the operation of the solution, and provide technical support. Kaspersky SD-WAN does not send logs outside the perimeter of your organization's IT infrastructure; all log files are stored locally.

To view log entries:

1. In the menu, go to the Logs section.

   The log management page is displayed.

2. In the Data centers pane, select the data center.
3. In the Resources pane, select a component of the solution.
4. In the Logs pane, select one of the following tabs to display log entries of a specific type:
   • Tasks for tasks performed by the user, such as an entry about adding a VIM.
   • Events for events that occur during the operation of the solution, for example, a tunnel being connected.
   • Service requests for service requests to specific components of the solution, for example, a request to register a CPE device.

By default, the log displays tasks, events, and service requests for the whole time period and with all statuses. You can display only the entries that you need by using filters in the upper part of the page.

[Topic 256158]

Service Requests

Expand all | Collapse all

Service requests are tasks that are performed while solution components are working and are automatically created when a user does something. For example, when a user applies a CPE template to a device, a corresponding service request is created. You can use service requests to monitor ongoing operations.

In Kaspersky SD-WAN, service requests are created at the level of tenants, CPE devices, and SD-WAN instances. To view service requests, use the following instructions:

• Viewing service requests for a tenant.

  To view service requests for a tenant:

  1. In the menu, go to the Tenants section.

     The tenant management page is displayed.

  2. Under Tenants, select a tenant.

  Service requests are displayed under Service requests.

  You can click the name of the service request to open a step-by-step execution log for the service request that includes detailed information for each step. The log contains information about the steps at which the errors occurred, as well as a detailed description of the errors themselves.

• Viewing service requests for a CPE device.

  To view service requests for a CPE device:

  1. In the menu, go to the SD-WAN section.

     By default, the CPE subsection is displayed with a table of CPE devices.

  2. Click the CPE device.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the Service requests tab.

  The service request table is displayed. You can click the ID of the service request to open a step-by-step execution log for the service request that includes detailed information for each step. The log contains information about the steps at which the errors occurred, as well as a detailed description of the errors themselves.

• Viewing service requests for an SD-WAN instance.

  To view service requests for an SD-WAN instance:

  1. In the menu, go to the SD-WAN → SD-WAN instances subsection.

     A table of SD-WAN instances is displayed.

  2. Click the relevant SD-WAN instance.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the Service requests tab.

  The service request table is displayed. You can click the ID of the service request to open a step-by-step execution log for the service request that includes detailed information for each step. The log contains information about the steps at which the errors occurred, as well as a detailed description of the errors themselves.

If necessary, you can delete a service request created at the CPE device or SD-WAN instance level to halt the operation associated with that request. To do so, use the following instructions:

• Deleting a service request for a CPE device.

  Deleted service requests cannot be restored.

  To delete a service request for a CPE device:

  1. In the menu, go to the SD-WAN section.

     By default, the CPE subsection is displayed with a table of CPE devices.

  2. Click the CPE device.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the Service requests tab.

     The service request table is displayed.

  4. Delete service requests:
     • To delete an individual service request, click Delete next to the service request.

       The service request is deleted and is no longer displayed in the table.

     • If you want to delete all service requests, at the top of the settings area, under Actions, click Delete all service requests.

       All service requests are deleted and are no longer displayed in the table.

• Deleting a service request for an SD-WAN instance.

  Deleted service requests cannot be restored.

  To delete a service request for an SD-WAN instance:

  1. In the menu, go to the SD-WAN → SD-WAN instances subsection.

     A table of SD-WAN instances is displayed.

  2. Click the relevant SD-WAN instance.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the Service requests tab.

     The service request table is displayed.

  4. Delete service requests:
     • To delete an individual service request, click Delete next to the service request.

       The service request is deleted and is no longer displayed in the table.

     • If you want to delete all service requests, at the top of the settings area, under Actions, click Delete all service requests.

       All service requests are deleted and are no longer displayed in the table.

[Topic 254772]

Managing network services

Network services relay traffic over the network and apply network functions such as WAN optimization, traffic shaping and identification, and data protection. Multiple network services can be combined into a service chain to sequentially apply the functions of these services to traffic when it is transmitted to its destination.

You can create a network service template to easily deploy this service within tenants.

The main network service responsible for the deployment and operation of Kaspersky SD-WAN is the SD-WAN service. This service is the first to be created, it encompasses the components that are part of the control plane. At least one SD-WAN service is deployed within each SD-WAN instance.

Network services and their templates are created using a graphical design tool. It allows visually constructing a service topology by placing the following components into it:

• Network components such as VNF and PNF.
• Links, such as P2P, P2M and M2M transport services, as well as OpenStack connections, such as the OS 2 Shared network.
• UNIs and WAN interfaces.

Links are connected to network components and interfaces to create the topology of the network service. You can link separately created network services by placing a shared network service (shared NS) in their topology.

An example of a network service topology is shown in the figure below.

An example of a network service topology

[Topic 260364]

User roles and actions with network services

The table below lists user roles and the actions they can perform to manage network services. If you have the platform administrator role, you can authenticate in the web interface of the tenant as an administrator and perform the needed actions.

User roles and actions with network services that are available to them

Page top

[Topic 244161]

Uploading a VNF or PNF package to the orchestrator

VNF and PNF packages are ZIP archives that contain the components necessary for deploying and managing virtual and physical network functions. You can prepare your own network function package and define how the management interface of function must appear in the web interface of the orchestrator.

Each package has the following structure:

• VNFD (Virtual Network Function descriptor) or PNFD (Physical Network Function descriptor) descriptor files in YAML format. These are configuration files that provide detailed information about the network function, and contain specifications such as specifications for deployment, network connections, and hardware resources.
• The 'scripts' folder. This folder contains scripts and executable files that are used to deploy and configure the network function. For example, scripts may include automation tasks, installation operations, and unique actions that are required for deployment.

The VNF package structure additionally includes the 'images' folder, which contains image files as well as resources necessary for the proper functioning of the VNF, such as binaries, firmware, and icons.

If you have the platform administrator role, you must upload the VNF and/or PNF package to the orchestrator web interface to gain the ability to add them to the network service topology and apply them to traffic passing through these services.

Note that the SD-WAN Controller is also deployed as a VNF or PNF.

To upload a VNF or PNF package to the orchestrator:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the upper part of the page, click + VNF or + PNF.
3. Select a VNF or PNF package file.

The uploaded network function is displayed in the Catalog panel.

[Topic 260362]

Network service template

You can create a network service template and assign it to the tenants for which you want to deploy that network service. This lets you avoid the need to create a network service for each of your tenants individually.

When creating a template, a network service topology is constructed, with all the necessary network components, connections, and interfaces that connect to each other. A tenant to which a template is assigned can replace abstract topology components with real ones and deploy the network service.

[Topic 244164]

Creating a network service template

Before creating a template, you must upload all necessary VNF or PNF packages to the orchestrator.

To create a network service template:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the upper part of the page, click + Template.

   The graphical design tool for building the network service topology is displayed.

3. Drag the following network components from the Catalog pane to the graphical design tool to add them to the topology:
   • Virtual network functions.
   • Physical network functions.
   • Shared network services. If a shared network service is added to a topology of multiple network services, it can be used to interconnect those network services.
   • Network service template. If, when creating a network service template, you place another template in the topology, the topology is constructed in accordance with that template, and you can then edit the topology by adding or removing components.

   To remove an added network component, click it and select Delete from the drop-down list.

4. Drag the following links from the Links tab in the lower part of the screen to the graphical design tool to add the links to the topology:
   • P2P — P2P transport service
   • P2M — P2M transport service
   • M2M — M2M transport service

   The remaining links are relevant to network communication at the VIM level and are established between VNFs hosted by the OpenStack cloud platform:

   • OS shared — a network that can be shared by multiple tenants
   • OS vRouter — a router that provides L3 routing
   • OS VLAN — a network for transmitting tagged L2 traffic of the 802.1Q standard
   • OS VXLAN — a network that provides VXLAN tunneling
   • OS flat — a network for transmitting untagged L2 traffic

   To remove an added link click it and select Delete from the drop-down list.

5. In the lower part of the page, select the UNI tab and drag UNI and/or WAN interfaces to the graphical design tool to add them to the topology. To remove an added interface, click it and select Delete from the drop-down list.
6. Configure topology components.
7. Connect the links to the network components:
   1. Click a link and in the drop-down list, select Add leaf to connect a network component that has the Leaf role. If you clicked a P2M service, you can select Add root in the drop-down list to connect a network component that has the Root role.
   2. Click the network component icon and in the displayed window, select an interface for the connection.

   The link is connected to the network component, which is indicated in the topology by a line between them. For example, the figure below shows a VLAN connected to a VNF.

   

8. Connect the links to interfaces:
   1. Click a link and in the drop-down list, select Add leaf to connect an interface that has the Leaf role. If you clicked a P2M service, you can select Add root in the drop-down list to connect an interface that has the Root role.
   2. Click the intefrace icon.

   The link is connected to the interface, which is indicated in the topology by a line between them. For example, the figure below shows a P2P service connected to a UNI and WAN interface.

   

9. If necessary, assign backup interfaces to the UNI:
   1. Click the UNI and in the drop-down list, select Reserve.

      A backup interface can be assigned only for UNIs to which at least one link is connected.

   2. Click the icon of the interface that you want to use as a reserve interface.

   The interface is designated as the backup interface for the UNI, and a dotted line is displayed between the UNI, the backup interface, and the link connected to the UNI. For example, in the figure below, the WAN interface is the backup interface for the UNI.

   

10. If necessary, do the following:
    • Select the Description check box to display a description under each topology component. This check box is selected by default.
    • ClickArrange to align topology components vertically.
11. In the Name field, enter the name of the network service.
12. In the upper part of the page, click Save.

The network service template is created and displayed in the Catalog panel, on the Templates tab.

[Topic 256184]

Deleting a network service template

Deleted network service templates cannot be restored.

To delete a network service template:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Catalog pane, select the Templates tab.

   A list of network service templates is displayed.

3. Click the delete button next to the network service template.
4. In the confirmation window, click Delete.

The network service template is deleted and is no longer displayed in the Catalog panel.

[Topic 255976]

Creating a network service

You can create a network service manually or using a template. When you use a template to create a network service, the topology of the service is built in accordance of the topology of the template, and you can then modify it by adding or removing components.

To create a network service:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, click + Network service.

   The graphical design tool for building the network service topology is displayed.

3. If you want to use a template to create the network service, drag the template from the Catalog pane to the graphic designer.

   The topology is constructed in accordance with that template.

4. Drag the following network components from the Catalog pane to the graphical design tool to add them to the topology:
   • Virtual network functions.
   • Physical network functions.
   • Shared network services. If a shared network service is added to a topology of multiple network services, it can be used to interconnect those network services.

   When adding a network function, in the window that is displayed, select where you want to place it — in the data center or on the uCPE device.

   To remove an added network component, click it and select Delete from the drop-down list.

5. Drag the following links from the Links tab in the lower part of the screen to the graphical design tool to add the links to the topology:
   • P2P — P2P transport service
   • P2M — P2M transport service
   • M2M — M2M transport service

   The remaining links are relevant to network communication at the VIM level and are established between VNFs hosted by the OpenStack cloud platform:

   • OS shared — a network that can be shared by multiple tenants
   • OS vRouter — a router that provides L3 routing
   • OS VLAN — a network for transmitting tagged L2 traffic of the 802.1Q standard
   • OS VXLAN — a network that provides VXLAN tunneling
   • OS flat — a network for transmitting untagged L2 traffic

   When adding a OS VLAN, OS VXLAN, or OS flat connection, in the window that is displayed, select where you want to place it — in the data center or on the uCPE device.

   To remove an added link click it and select Delete from the drop-down list.

6. In the lower part of the page, select the UNI tab and drag UNI and/or WAN interfaces to the graphical design tool to add them to the topology. To remove an added interface, click it and select Delete from the drop-down list.
7. Configure topology components.
8. Connect the links to the network components:
   1. Click a link and in the drop-down list, select Add leaf to connect a network component that has the Leaf role. If you clicked a P2M service, you can select Add root in the drop-down list to connect a network component that has the Root role.
   2. Click the network component icon and in the displayed window, select an interface for the connection.

   The link is connected to the network component, which is indicated in the topology by a line between them. For example, the figure below shows a VLAN connected to a VNF.

   

9. Connect the links to interfaces:
   1. Click a link and in the drop-down list, select Add leaf to connect an interface that has the Leaf role. If you clicked a P2M service, you can select Add root in the drop-down list to connect an interface that has the Root role.
   2. Click the intefrace icon.

   The link is connected to the interface, which is indicated in the topology by a line between them. For example, the figure below shows a P2P service connected to a UNI and WAN interface.

   

10. If necessary, assign backup interfaces to the UNI:
    1. Click the UNI and in the drop-down list, select Reserve.

       A backup interface can be assigned only for UNIs to which at least one link is connected.

    2. Click the icon of the interface that you want to use as a reserve interface.

    The interface is designated as the backup interface for the UNI, and a dotted line is displayed between the UNI, the backup interface, and the link connected to the UNI. For example, in the figure below, the WAN interface is the backup interface for the UNI.

    

11. If necessary, do the following:
    • Select the Description check box to display a description under each topology component. This check box is selected by default.
    • ClickArrange to align topology components vertically.
12. In the Name field, enter the name of the network service.
13. Complete the network service creation:
    • To save the network service, click Save.
    • To save and immediately deploy a network service, click Deploy.

The network service is created and displayed in Network services panel. If you clicked Deploy, the deployment of the network service begins, which may take several minutes. You can interrupt the deployment by clicking Abort deploy.

[Topic 260313]

Configuring network service topology components

Expand all | Collapse all

You can configure network components, connections, and interfaces added to the topology of a network service template or an individual network service. Before you can configure topology components, you must open the topology.

To open the topology:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. Open the topology:
   • If you want to open the topology of a network service template, select the template in the Catalog panel.
   • If you want to open the topology of a network service, select the network service in the Network services panel.

The graphical design tool with the network service topology is displayed.

Use the following instructions to configure topology components:

• Configuring a VNF in the network service topology

  To configure a VNF in the topology:

  1. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  2. Select the Connection points tab and configure the VNF interfaces:
     1. In the Type drop-down list, select how you want to assign an IP address and subnet mask to the interface:
        • DHCP reservation to assign an IP address and subnet mask using DHCP.
        • AUTO to automatically assign an IP address and subnet mask. This is the default setting.
     2. If in the Type drop-down list, you selected DHCP reservation, follow these steps:
        1. In the IP field, enter the IP address of the interface.
        2. In the Mask field, enter the subnet mask.
     3. In the Description field, enter a brief description of the interface.
     4. If you want to make the interface a trunk port for processing traffic from multiple VLANs simultaneously, select the Trunk check box. When the check box is selected, the VNF interface is capable of transmitting and receiving tagged VLAN traffic, which contains an additional identifier (VLAN tag) that lets you identify and filter different VLANs in the network. This check box is cleared by default.
  3. Select the VNF settings tab and specify general VNF settings:
     1. In the Name field, enter the name of the VNF.
     2. In the Description field, enter a brief description of the VNF.
     3. In the Order field, enter the sequence number for deploying the VNF on the OpenStack cloud platform. When you deploy a network service, the VNF with the lowest number is the first to be deployed. If none of the VNFs added to the network service topology have a sequence number specified, all VNFs are deployed simultaneously.
  4. Specify the required settings on the remaining tabs. The number of tabs with settings that you can specify depends on the contents of the VNF package. Tabs are added to the package as variables.

     If you are having difficulty configuring certain settings, we recommend that you refer to the technical documentation provided by the VNF vendor or contact Kaspersky technical support.

  5. Click Save in the upper part of the settings area.
• Configuring a PNF in the network service topology.

  To configure a PNF in the topology:

  1. Click the PNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the PNF package.

  2. Select the PNF settings tab and specify general PNF settings:
     1. In the Name field, enter the name of the PNF.
     2. In the Description field, enter a brief description of the PNF.
     3. In the Order field, enter the sequence number for deploying the PNF. When you deploy a network service, the PNF with the lowest number is the first to be deployed. If none of the PNFs added to the network service topology have a sequence number specified, all PNFs are deployed simultaneously.
  3. Select the DC placement tab and select the data center that is hosting the PNF:
     1. In the Data center field, enter the name of the data center and select a value from the drop-down list.
     2. Click Apply.
  4. Go to the Management IP tab and in the IP fields, enter the IP addresses of the VDU control interfaces within the PNF. To check the availability of an address, click Test connection.
  5. Specify the required settings on the remaining tabs. The number of tabs with settings that you can specify depends on the contents of the PNF package. Tabs are added to the package as variables.

     If you are having difficulty configuring certain settings, we recommend that you refer to the technical documentation provided by the PNF vendor or contact Kaspersky technical support.

  6. Click Save in the upper part of the settings area.
• Configuring a P2P service in the network service template topology

  To configure a P2P service in the topology:

  1. Click the P2P service.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the transport service.
  3. If necessary, in the Description field, enter a brief description of the transport service.
  4. Click Save in the upper part of the settings area.
• Configuring a P2M service in the network service template topology

  To configure a P2M service in the topology:

  1. Click the P2M service.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the transport service.
  3. If necessary, in the Description field, enter a brief description of the transport service.
  4. In the Connection points field, enter the maximum number of connection points of the transport service. Range of values: 2 to 9,999. If you do not specify a value for this setting, the number of connection points is unlimited.
  5. In the Mode drop-down list, select whether you want to use the Default Forwarding Interface (hereinafter referred to as DFI) in the transport service. If the DFI role is assigned to a service interface, all unknown unicast traffic is sent to that service interface. Possible values:
     • Classic if you do not want to use DFI. This is the default setting.
     • DFI with FIB on root and leafs if you want to use DFI on the service interface with the Root role. The number of service interfaces with the Leaf role is not limited. Backup service interfaces can be added for each service interface.
     • DFI with FIB on leaf if you want to use DFI on the service interface with the Root role. The number of service interfaces with the Leaf role is not limited. Service interfaces with the Leaf role must be on the same CPE device. Backup service interfaces can be added for each service interface. Backup service interfaces with the Leaf role must be on the same CPE device, which must be different from the device hosting the primary service interfaces.
  6. In the MAC age (sec.) field, enter the time period in seconds during which entries are kept in the MAC table on the SD-WAN Controller. Range of values: 10 to 65,535. The default setting is 300.
  7. In the MAC learn mode drop-down list, select the action to apply to a series of frames when the first frame is sent to the SD-WAN controller to learn the source MAC address:
     • Learn and flood means the controller remembers the MAC address of the source and checks for the presence of the destination MAC address in the MAC address table. If the destination MAC address is not in the table, the series of frames is sent to all service interfaces added to the transport service, except for the interface on which the series of frames originally arrived. This is the default setting.
     • Learn and drop means the controller remembers the MAC address of the source and checks for the presence of the destination MAC address in the MAC address table. If the destination MAC address is not in the table, the series of frames is dropped.

     In both cases, if the destination MAC address is present in the MAC address table, the series of frames is sent to the corresponding service interface.

  8. In the MAC table size field, enter the maximum number of entries in the MAC table on the SD-WAN controller. Range of values: 0 to 65,535. 0 means the number of entries is not limited. The default setting is 100.
  9. In the MAC table overload drop-down list, select the policy for processing new MAC addresses when the MAC table SD-WAN Controller is full:
     • Flood means traffic with destination MAC addresses that have not been learned previously is transmitted as BUM traffic (Broadcast, unknown-unicast, and multicast). This is the default setting.
     • Drop means that traffic with previously destination MAC addresses that have not been learned previously is dropped.
  10. If necessary, use OpenStack DHCP to automatically assign IP addresses and configuration parameters to virtual machines:
      1. In the OpenStack DHCP drop-down list, select Enabled.
      2. In the CIDR field, enter the OpenStack IP address and subnet mask.
      3. In the Gateway field, enter the IP address of the gateway that routes traffic leaving the virtual network. This gateway connects the virtual network to external networks, such as the internet. The gateway address must be on the same subnet as the virtual machines and other network devices for them to communicate with each other.
      4. If you want to create a range of IP addresses, under Pools, click + Pool and in the fields that are displayed, enter the start and end values of the range. If a virtual machine requests an IP address, the DHCP server assigns an address from this range.

         The range must belong to the same subnet as the gateway, virtual machines, and other network devices so that they can communicate with each other, and the size of the range must accommodate the number of virtual machines on the network. You can create multiple ranges or delete a range by clicking Delete next to it.

      5. If you want to add a DNS server, under DNS, click DNS, and enter the IP address of the server in the field that is displayed. The DNS server allows virtual machines to resolve domain names to IP addresses.

         Information from the DNS server is sent to virtual machines via DHCP options, after which they can interact with devices on the virtual network, as well as gain access to the internet and other external networks using domain names instead of IP addresses. You can add multiple servers or delete a server by clicking Delete next to it.

  11. Click Save in the upper part of the settings area.
• Configuring an M2M service in the network service template topology

  To configure an M2M service in the topology:

  1. Click the M2M service.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the transport service.
  3. If necessary, in the Description field, enter a brief description of the transport service.
  4. In the Connection points field, enter the maximum number of connection points of the transport service. Range of values: 2 to 9,999. If you do not specify a value for this setting, the number of connection points is unlimited.
  5. In the MAC age (sec.) field, enter the time period in seconds during which entries are kept in the MAC table on the SD-WAN Controller. Range of values: 10 to 65,535. The default setting is 300.
  6. In the MAC learn mode drop-down list, select the action to apply to a series of frames when the first frame is sent to the SD-WAN controller to learn the source MAC address:
     • Learn and flood means the controller remembers the MAC address of the source and checks for the presence of the destination MAC address in the MAC address table. If the destination MAC address is not in the table, the series of frames is sent to all service interfaces added to the transport service, except for the interface on which the series of frames originally arrived. This is the default setting.
     • Learn and drop means the controller remembers the MAC address of the source and checks for the presence of the destination MAC address in the MAC address table. If the destination MAC address is not in the table, the series of frames is dropped.

     In both cases, if the destination MAC address is present in the MAC address table, the series of frames is sent to the corresponding service interface.

  7. In the MAC table size field, enter the maximum number of entries in the MAC table on the SD-WAN controller. Range of values: 0 to 65,535. 0 means the number of entries is not limited. The default setting is 100.
  8. In the MAC table overload drop-down list, select the policy for processing new MAC addresses when the MAC table SD-WAN Controller is full:
     • Flood means traffic with destination MAC addresses that have not been learned previously is transmitted as BUM traffic (Broadcast, unknown-unicast, and multicast). This is the default setting.
     • Drop means that traffic with previously destination MAC addresses that have not been learned previously is dropped.
  9. If necessary, use OpenStack DHCP to automatically assign IP addresses and configuration parameters to virtual machines:
     1. In the OpenStack DHCP drop-down list, select Enabled.
     2. In the CIDR field, enter the OpenStack IP address and subnet mask.
     3. In the Gateway field, enter the IP address of the gateway that routes traffic leaving the virtual network. This gateway connects the virtual network to external networks, such as the internet. The gateway address must be on the same subnet as the virtual machines and other network devices for them to communicate with each other.
     4. If you want to create a range of IP addresses, under Pools, click + Pool and in the fields that are displayed, enter the start and end values of the range. If a virtual machine requests an IP address, the DHCP server assigns an address from this range.

        The range must belong to the same subnet as the gateway, virtual machines, and other network devices so that they can communicate with each other, and the size of the range must accommodate the number of virtual machines on the network. You can create multiple ranges or delete a range by clicking Delete next to it.

     5. If you want to add a DNS server, under DNS, click DNS, and enter the IP address of the server in the field that is displayed. The DNS server allows virtual machines to resolve domain names to IP addresses.

        Information from the DNS server is sent to virtual machines via DHCP options, after which they can interact with devices on the virtual network, as well as gain access to the internet and other external networks using domain names instead of IP addresses. You can add multiple servers or delete a server by clicking Delete next to it.

     • If you want to allow sharing of the M2M service between different network services, select the Share network service check box. This check box is cleared by default.
  10. Click Save in the upper part of the settings area.
• Configuring a shared network (OS 2 SHARED) in the network service template topology

  To configure a shared network in the topology:

  1. Click the shared network.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the shared network.
  3. If necessary, in the Description field, enter a brief description of the shared network.
  4. Click Save in the upper part of the settings area.
• Configuring a virtual router (OS vRouter) in the network template service topology

  To configure a virtual router in the topology:

  1. Click the virtual router.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the virtual router.
  3. If necessary, in the Description field, enter a brief description of the virtual router.
  4. To set the 'up' value for the operating state of the virtual router, select the Administrative state check box. This check box lets you manage the operating state of the router without having to delete and recreate it. When this check box is selected, the router can relay traffic. This check box is cleared by default.
  5. Click Save in the upper part of the settings area.
• Configuring a VLAN in the network service topology.

  To configure a VLAN in the topology:

  1. Click the VLAN.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the VLAN.
  3. If necessary, in the Description field, enter a brief description of the VLAN.
  4. If necessary, use OpenStack DHCP to automatically assign IP addresses and configuration parameters to virtual machines:
     1. In the OpenStack DHCP drop-down list, select Enabled.
     2. In the CIDR field, enter the OpenStack IP address and subnet mask.
     3. In the Gateway field, enter the IP address of the gateway that routes traffic leaving the virtual network. This gateway connects the virtual network to external networks, such as the internet. The gateway address must be on the same subnet as the virtual machines and other network devices for them to communicate with each other.
     4. If you want to create a range of IP addresses, under Pools, click + Pool and in the fields that are displayed, enter the start and end values of the range. If a virtual machine requests an IP address, the DHCP server assigns an address from this range.

        The range must belong to the same subnet as the gateway, virtual machines, and other network devices so that they can communicate with each other, and the size of the range must accommodate the number of virtual machines on the network. You can create multiple ranges or delete a range by clicking Delete next to it.

     5. If you want to add a DNS server, under DNS, click DNS, and enter the IP address of the server in the field that is displayed. The DNS server allows virtual machines to resolve domain names to IP addresses.

        Information from the DNS server is sent to virtual machines via DHCP options, after which they can interact with devices on the virtual network, as well as gain access to the internet and other external networks using domain names instead of IP addresses. You can add multiple servers or delete a server by clicking Delete next to it.

  5. If you want to allow sharing of the network between different network services, select the Share network check box. This check box is cleared by default.
  6. If you need to segment the network into multiple VLANs, in the Segmentation ID field, enter the VLAN ID.
  7. Click Save in the upper part of the settings area.
• Configuring a VXLAN in the network service topology.

  To configure a VXLAN in the topology:

  1. Click the VXLAN.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the VXLAN.
  3. If necessary, in the Description field, enter a brief description of the VXLAN.
  4. If necessary, use OpenStack DHCP to automatically assign IP addresses and configuration parameters to virtual machines:
     1. In the OpenStack DHCP drop-down list, select Enabled.
     2. In the CIDR field, enter the OpenStack IP address and subnet mask.
     3. In the Gateway field, enter the IP address of the gateway that routes traffic leaving the virtual network. This gateway connects the virtual network to external networks, such as the internet. The gateway address must be on the same subnet as the virtual machines and other network devices for them to communicate with each other.
     4. If you want to create a range of IP addresses, under Pools, click + Pool and in the fields that are displayed, enter the start and end values of the range. If a virtual machine requests an IP address, the DHCP server assigns an address from this range.

        The range must belong to the same subnet as the gateway, virtual machines, and other network devices so that they can communicate with each other, and the size of the range must accommodate the number of virtual machines on the network. You can create multiple ranges or delete a range by clicking Delete next to it.

     5. If you want to add a DNS server, under DNS, click DNS, and enter the IP address of the server in the field that is displayed. The DNS server allows virtual machines to resolve domain names to IP addresses.

        Information from the DNS server is sent to virtual machines via DHCP options, after which they can interact with devices on the virtual network, as well as gain access to the internet and other external networks using domain names instead of IP addresses. You can add multiple servers or delete a server by clicking Delete next to it.

  5. If you want to allow sharing of the network between different network services, select the Share network check box. This check box is cleared by default.
  6. If you need to segment the network into multiple VXLANs, in the Segmentation ID field, enter the VXLAN ID.
  7. Click Save in the upper part of the settings area.
• Configuring a flat network in the network service template topology.

  To configure a flat network in the topology:

  1. Click the flat network.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the flat network.
  3. If necessary, in the Description field, enter a brief description of the flat network.
  4. If necessary, use OpenStack DHCP to automatically assign IP addresses and configuration parameters to virtual machines:
     1. In the OpenStack DHCP drop-down list, select Enabled.
     2. In the CIDR field, enter the OpenStack IP address and subnet mask.
     3. In the Gateway field, enter the IP address of the gateway that routes traffic leaving the virtual network. This gateway connects the virtual network to external networks, such as the internet. The gateway address must be on the same subnet as the virtual machines and other network devices for them to communicate with each other.
     4. If you want to create a range of IP addresses, under Pools, click + Pool and in the fields that are displayed, enter the start and end values of the range. If a virtual machine requests an IP address, the DHCP server assigns an address from this range.

        The range must belong to the same subnet as the gateway, virtual machines, and other network devices so that they can communicate with each other, and the size of the range must accommodate the number of virtual machines on the network. You can create multiple ranges or delete a range by clicking Delete next to it.

     5. If you want to add a DNS server, under DNS, click DNS, and enter the IP address of the server in the field that is displayed. The DNS server allows virtual machines to resolve domain names to IP addresses.

        Information from the DNS server is sent to virtual machines via DHCP options, after which they can interact with devices on the virtual network, as well as gain access to the internet and other external networks using domain names instead of IP addresses. You can add multiple servers or delete a server by clicking Delete next to it.

  5. If you want to allow sharing of the network between different network services, select the Share network check box. This check box is cleared by default.
  6. Click Save in the upper part of the settings area.
• Configuring interfaces in the network service topology.

  To configure an interface in the topology:

  1. Click the interface.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  2. In the Name field, enter the name of the interface.
  3. If necessary, in the Description field, enter a brief description of the interface.
  4. Click Save in the upper part of the settings area.

[Topic 260680]

Editing a network service topology

To edit a network service topology:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, select a network service.

   The graphical design tool with the network service topology is displayed.

3. In the upper part of the page, click Edit.
4. Edit the network service topology as necessary. For a description of the settings, see the following instructions:
   • Instructions for creating a network service.
   • Instructions for configuring network service topology components.
5. Click Deploy changes.

[Topic 256183]

Deploying a network service

If there is no communication between the orchestrator and the uCPE during the deployment of the network service, deployment is carried out when communication is restored.

To deploy a network service:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, select a network service.

   The network service topology is displayed in the graphical design tool.

3. In the upper part of the page, click Deploy.

This starts the deployment of the network service, which may take several minutes. You can interrupt the deployment by clicking Abort deploy.

[Topic 256194]

Checking the consistency of a network service

A consistency check lets you make sure the network service is configured correctly. The check reveals problems and conflicts in the specified settings that can make the entire service inoperable.

To check the consistency of a network service:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, click the settings button next to the network service and in the drop-down list, select Check consistency.
3. In the confirmation window, click Confirm.

The consistency check starts.

[Topic 260610]

Redeploying a network service and its components

Expand all | Collapse all

You can redeploy a network service or its component to apply configuration changes, update your software to the latest version, or recover if problems occur.

Note that redeploying may result in short-term interruptions or temporary inoperability. When planning and coordinating redeployment activities, we recommend taking into account your organization's circumstances to minimize the disruptions.

To redeploy a network service or its component, use the following instructions:

• Redeploying a network service.

  Redeployment also lets you fix network service performance issues and eliminate bottlenecks.

  To redeploy a network service:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, click the settings button next to the network service and in the drop-down list, select Redeploy.
  3. In the confirmation window, click Confirm.

  This starts the redeployment of the network service, which may take several minutes. You can interrupt the deployment by clicking Abort deploy.

• Re-deploying VNFs.

  To redeploy a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Redeploy VNF.
  5. In the confirmation window, click Confirm.

  This starts the redeployment of the VNF, which may take several minutes. You can interrupt the deployment by clicking Abort deploy.

• Re-deploying VDUs.

  To redeploy a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Redeploy VDU.
  6. In the confirmation window, click Confirm.

  This starts the redeployment of the VDU, which may take several minutes. You can interrupt the deployment by clicking Abort deploy.

[Topic 260616]

Auto-Healing

Expand all | Collapse all

The Auto-Healing functionality automatically detects problems that arise during the operation of a network service and takes the actions necessary to fix them. Such actions may include restarting non-operational components, replacing unavailable network resources, or redirecting traffic to virtual machines / instances that still work.

If this functionality is enabled for a network service, its components are restored automatically. If this functionality is disabled, restoring the components requires manual intervention by the administrator. By default, this functionality is enabled.

If necessary, you can use Auto-Healing for individual components of the network service, even if the functionality as a whole is disabled. To manage Auto-Healing, use the following instructions:

• Enabling or disabling Auto-Healing for a network service.
• Using Auto-Healing for a VNF.

  To use Auto-Healing for a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Healing VNF.
  5. In the confirmation window, click Apply.

  Automatic VNF recovery begins.

• Using Auto-Healing for a VDU.

  To use Auto-Healing for a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Healing VDU.
  6. In the confirmation window, click Apply.

  Automatic VDU recovery begins.

[Topic 260423]

Managing VNFs and VDUs in a network service

After deploying a network service, you can manage VNFs and VDUs (Virtual Deployment Units) included in them.

A VDU is a virtual machine that hosts a VNF. It aggregates virtual computing resources, such as CPU and memory, required to run the VNF software, and also contains certain implementations of the network function, such as routing algorithms or load balancing logic.

Multiple VDUs can be combined into a single VNF to provide scalability and/or high availability. VDUs can be distributed across multiple physical servers; you can still manage them as a single VNF. VDUs interact with each other and other VNFs to perform their functions within a network service.

[Topic 260679]

Selecting a VNF flavour

Flavours are specified in the VNF package and define the characteristics and specifications of a VNF instance. Each flavour is a predefined set of assigned resources such as CPU, memory, and bandwidth. These resources determine the capabilities of the VNF instance and affect its performance.

To select a VNF flavour:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, select a network service.

   The graphical design tool with the network service topology is displayed.

3. Click the VNF.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

   By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

4. Click Scale to next to the flavour.

The VNF scales to the selected flavour.

[Topic 260441]

Viewing VDU settings

To view VDU settings:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, select a network service.

   The graphical design tool with the network service topology is displayed.

3. Click the VNF.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

   By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

4. Select the VDU management tab.

   A table of VDUs is displayed.

5. Click the name of the VDU whose settings you want to view.

This opens a window with VDU settings.

[Topic 260447]

Stopping and starting VNFs and VDUs

Expand all | Collapse all

Stopping VNFs/VDUs allows maintaining them and installing software updates.

When a VNF/VDU is not in use, it can be stopped to free up computing resources and use them for other purposes. You can also stop a VNF/VDU that is causing errors and faults to isolate the problematic component and resolve the issue while maintaining functionality.

To stop a VNF or VDU, use the following instructions:

• Stopping a VNF.

  A stopped VNF is no longer provided as part of the network service. We recommend scheduling VNF shutdowns so that they do not impact the functionality of the network service.

  To stop a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Power → Stop VNF.
  5. In the confirmation window, click Apply.

  The VNF is stopped.

• Stopping a VDU.

  A stopped VDU is no longer provided as part of the VNF. We recommend scheduling VDU shutdowns so that they do not impact the functionality of the VNF.

  To stop a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Power → Stop VDU.
  6. In the confirmation window, click Apply.

  The VDU is stopped.

If necessary, you can restart a stopped VNF or VDU. To do so, use the following instructions:

• Starting a VNF.

  To start a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Start VNF.
  5. In the confirmation window, click Apply.

  The VNF is started.

• Starting a VDU.

  To start a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Start VDU.
  6. In the confirmation window, click Apply.

  The VDU is started.

[Topic 260585]

Temporarily stopping and starting VNFs and VDUs

Expand all | Collapse all

You can pause or suspend the VNF/VDU to free up system resources, such as CPU and memory, and make them available to other, higher-priority components. This may be necessary when user activity temporary decreases and new network functions must be provided. This management approach conserves resources and ensures efficiency.

The difference between a paused and a suspended VNF/VDU is that when the VNF/VDU is in suspended, its configuration information is saved on the disk of the VNF/VDU. This allows completely shutting down VNF/VDU and moving it to another host machine. When the VNF/VDU is reactivated, its configuration is completely restored.

To temporarily stop a VNF/VDU, use the following instructions:

• Pausing or suspending a VNF.

  To pause or suspend a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Pause VNF or Suspend VNF.
  5. In the confirmation window, click Apply.

  The VNF is paused or suspended.

• Pausing or suspending a VDU.

  To pause or suspend a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Pause VDU or Suspend VDU.
  6. In the confirmation window, click Apply.

  The VDU is paused or suspended.

If necessary, you can unpause or reactivate the VNF/VDU. To do so, use the following instructions:

• Unpausing or reactivating a VNF.

  To unpause or reactivate a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Unpause VNF or Resume suspended VNF.
  5. In the confirmation window, click Apply.

  The VNF is unpaused or reactivated.

• Unpausing or reactivating a VDU.

  To unpause or reactivate a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Unpause VDU or Resume suspended VNF.
  6. In the confirmation window, click Apply.

  The VDU is unpaused or reactivated.

[Topic 260582]

Soft reboot of VNFs and VDUs

Expand all | Collapse all

You can use a soft reboot of a VNF/VDU to install software updates, including bug fixes, security improvements, and new functionality, without disrupting operation.

A soft reboot of a VNF/VDU also lets you restore its stability by clearing temporary or corrupted data that often causes errors and malfunctions.

If a VNF/VDU is running for a long time, soft-rebooting it can improve performance by freeing up unused computing resources.

To soft-reboot a VNF/VDU, use the following instructions:

• Soft reboot of a VNF.

  To soft-reboot a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Soft reboot VNF.
  5. In the confirmation window, click Apply.

  A soft reboot of the VNF is performed.

• Soft reboot of a VDU.

  To soft-reboot a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Soft reboot VDU.
  6. In the confirmation window, click Apply.

  A soft reboot of the VDU is performed.

[Topic 260583]

Hard reboot of VNFs and VDUs

Expand all | Collapse all

A hard reboot can be used to restore normal operation of a VNF/VDU if it is unresponsive or if multiple severe system errors occur. When performing a hard reboot, the VNF/VDU goes through a power off/power on cycle and subsequently returns to its last stable state.

Note that a hard reboot may cause the VNF/VDU to become temporarily unavailable.

We recommend using a hard reboot only if all other problem resolution measures, including a soft reboot, have been unsuccessful.

To hard-reboot a VNF/VDU, use the following instructions:

• Hard reboot of a VNF.

  To hard-reboot a VNF:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. In the upper part of the settings area, click Management and in the drop-down list, select Hard reboot VNF.
  5. In the confirmation window, click Apply.

  A hard reboot of the VNF is performed.

• Hard reboot of a VDU.

  To hard-reboot a VDU:

  1. In the menu, go to the Catalog section.

     The network service management page is displayed.

  2. In the Network services panel, select a network service.

     The graphical design tool with the network service topology is displayed.

  3. Click the VNF.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

     By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

  4. Select the VDU management tab.

     A table of VDUs is displayed.

  5. Click Management next to the VDU and in the drop-down list, select Hard reboot VDU.
  6. In the confirmation window, click Apply.

  A hard reboot of the VDU is performed.

[Topic 260603]

VDU snapshot

A snapshot of a VDU contains its complete configuration and can be used to restore that VDU in case of malfunctions.

You can take snapshots of multiple versions of the VDU, which is especially useful in the early stages of deployment and testing. If an update or modification causes problems, you can revert to the latest stable version using the corresponding snapshot. In this way, snapshots let you isolate errors and implement version control.

You can also use snapshots to scale your VDU by deploying multiple identical instances.

To take a snapshot of the VDU:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, select a network service.

   The graphical design tool with the network service topology is displayed.

3. Click the VNF.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

   By default, the Flavours tab is selected, which displays the flavours of virtual machines for the network function. Flavours are described in the VNF package.

4. Select the VDU management tab.

   A table of VDUs is displayed.

5. Click Management next to the VDU and in the drop-down list, select Snapshot.

   This opens a window with a table of snapshots.

6. In the Name field, enter the name of the snapshot.
7. In the Description field, enter a brief description of the snapshot.
8. Click Create.

The snapshot is created and displayed in the table.

[Topic 256190]

Viewing the network service log

To view the log of a network service:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, click the settings button next to the network service and in the drop-down list, select Open log.

The page with the network service log is displayed.

[Topic 256207]

Deleting a network service

Deleted network services cannot be restored.

To delete a network service:

1. In the menu, go to the Catalog section.

   The network service management page is displayed.

2. In the Network services panel, click the settings button next to the network service and in the drop-down list, select Delete.
3. In the confirmation window, click Delete.

The network service is deleted and is no longer displayed in the Network services pane.

[Topic 255208]

Managing confirmation requests

Confirmation requests are automatically created in the orchestrator web interface when a user with insufficient permissions performs an operation with components of the solution. You can choose whether a user's operations must be approved by the administrator when creating the user.

The confirmation request can be confirmed, denied, or deleted. When a request is confirmed, the associated operation is executed. Denied requests are saved in the web interface.

Administrators can review confirmation requests to assess the possible consequences of the corresponding operations and prevent prohibited or accidental operations with components critical to the operation of Kaspersky SD-WAN. Confirmation requests can also be used in internal audits to view operations performed by users and the administrators who confirmed or denied those transactions.

[Topic 256212]

Viewing confirmation requests

To view confirmation requests:

In the menu, go to the Confirmation section.

A table of confirmation requests is displayed. By default, requests are displayed for the entire period and with any status. You can display only the requests that you need by using filters in the upper part of the page.

[Topic 256213]

Confirming, denying, and deleting confirmation requests

To confirm, deny, or delete a confirmation request:

1. In the menu, go to the Confirmation section.

   A table of confirmation requests is displayed.

2. Manage the confirmation request:
   • Click Permit to confirm the request.
   • Click Deny to deny the request.
   • Click Delete to delete the request.

[Topic 251430]

Managing users

To manage Kaspersky SD-WAN, users must authenticate in the orchestrator web interface. You can create users whose credentials are stored in the local database of the solution or on a remote LDAP server. To use LDAP authentication, you must first configure the connection of the orchestrator to the LDAP server.

The solution supports importing user groups from external LDAP servers. To do so, you must create a user group corresponding to a group on the remote server; this lets users authenticate using the name of that group.

When creating individual users as well as groups, you can assign access permissions that determine which sections and/or subsections of the web interface they can use.

[Topic 251545]

Creating an LDAP connection

To let your users authenticate in the orchestrator web interface using credentials stored on a remote LDAP server, you must create an LDAP connection. The following LDAP servers are supported:

• OpenLDAP with Simple authentication and Simple SSL authentication.
• Microsoft Active Directory with Kerberos authentication and Kerberos SSL authentication.

The orchestrator cannot make changes on a connected LDAP server.

To configure a connection between the orchestrator and a remote LDAP server:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the LDAP connection tab.

   A table of LDAP connections is displayed.

3. In the upper part of the page, click + LDAP.
4. In the displayed settings area, in the Name field, enter the name of the LDAP connection.
5. In the Domain field, enter the FQDN of the domain in which the LDAP server is located.
6. In the Domain alias field, enter the domain alias (usually the NETBIOS name). The alias is used along with the FQDN of the domain when creating and authenticating users. For example, if the FQDN of the domain is 'example.com' and the alias is 'example', users can enter the following values when authenticating:
   • admin@example.com
   • admin@example
   • example.com\admin
   • example\admin
7. In the LDAP host field, enter the host name of the LDAP server. The following host name formats are supported:
   • ldap://<host name>:<port number> for a standard LDAP server. The default port is 389.
   • ldaps://<host name>:<port number> for a LDAP server with SSL authentication. The default port is 636.

   For example, if you enter ldap://example.com:100, the host name of the LDAP server is 'example.com' and the port number is 100.

8. In the Base DN field, enter the base distinguished name to be used by the orchestrator as the starting point for searching user accounts in the LDAP server directory. The following base distinguished name formats are supported:
   • OU=<value>,OU=<value> for authentication in OpenLDAP. A base distinguished name consists of one or more OU attributes that represent the structure of organizational units in the directory of the LDAP server. For example, if you enter OU=OU_example1,OU=OU_example2, the starting point for searching user accounts is organizational unit OU_example2, which is nested in OU_example1.
   • DC=<value>,DC=<value> for authentication in Microsoft Active Directory. The base distinguished name consists of two DC attributes that represent the domain components of the LDAP server. For example, if you enter DC=example,DC=com, the starting point for searching user accounts is the 'example.com' domain.
9. In the Search attribute drop-down list, select the attribute that the orchestrator must use to search for user accounts in the LDAP server directory:
   • uid (OpenLDAP) – the uid (user ID) for searching in OpenLDAP. This is the default setting.
   • sAMAccountName (Active Directory) – pre-Windows 2000 logon name for searching in Microsoft Active Directory.
10. In the Bind DN field, enter the distinguished name for authenticating the orchestrator on the LDAP server. The following distinguished name formats are supported:
    • UID=<value>,OU=<value> for authentication in OpenLDAP. A distinguished name consists of one UID attribute and one or more OU attributes. The UID attribute stands for the user ID, while the OU attributes represent the structure of organizational units in the LDAP server directory that contains the user. For example, if you enter UID=user_example,OU=OU_example, user user_example from organizational unit OU_example is used for authenticating the orchestrator on the LDAP server.
    • CN=<value>,OU=<value>,DC=<value>,DC=<value> for authentication in Microsoft Active Directory. A distinguished name consists of one CN attribute, one or more OU attributes, and two DC attributes. The CN attribute stands for the common name of the user, while the OU attributes represent the structure of organizational units in the LDAP server directory that contains the user. The final two DC attributes represent the components of the domain in which the user is located. For example, if you enter CN=user_example,OU=OU_example,DC=example,DC=com, user user_example in organizational unit OU_example in the example.com domain is used for authenticating the orchestrator on the LDAP server.
11. In the Bind password field, enter the password for authenticating the orchestrator on the LDAP server.
12. To check if the LDAP server is available, click Test authentication.
13. Click Create.

The LDAP connection is created and displayed in the table. The LDAP server can now be used when creating users or user groups.

[Topic 256217]

Editing an LDAP connection

To edit an LDAP connection:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the LDAP connection tab.

   A table of LDAP connections is displayed.

3. Click the LDAP connection.
4. In the displayed settings area, edit the settings that you want to change. For a description of the settings, see the instructions for creating a LDAP connection.
5. Click Save.

[Topic 256225]

Changing the password of an LDAP connection

To change the password of an LDAP connection:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the LDAP connection tab.

   A table of LDAP connections is displayed.

3. Click the LDAP connection.
4. In the upper part of the displayed settings area, click Management and in the drop-down list, select Change password.
5. This opens a window; type the new password in the New password text box. The password must contain at least one uppercase A–Z character, lowercase characters, numerals, and special characters. Password length: 8 to 50 characters.
6. In the Password confirmation field, enter the new password again.
7. Click Save.

The LDAP connection password is changed.

[Topic 256222]

Deleting an LDAP connection

Deleted LDAP connections cannot be restored.

To delete an LDAP connection:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the LDAP connection tab.

   A table of LDAP connections is displayed.

3. Click the LDAP connection.
4. In the upper part of the displayed settings area, click Management and in the drop-down list, select Delete.
5. In the confirmation window, click Delete.

The LDAP connection is deleted and is no longer displayed in the table.

[Topic 251431]

Creating access permissions

Access permissions determine which sections and subsections of the orchestrator web interface a user can view and/or edit. By default, the Full access permission is created in the solution, which grants users full access to managing the solution.

To create an access permission:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the Permissions tab.

   A table of access permissions is displayed.

3. In the upper part of the page, click + Permission.
4. In the displayed settings area, in the Name field, enter the name of the access permission. Maximum length: 250 characters.
5. Under Access rights, specify the level of user access to sections and subsections of the orchestrator web interface:
   • Editing lets users view the section/subsection and edit its settings.
   • Viewing only lets users view the section/subsection.
   • No access does not let users view the section/subsection.

   You can grant the selected level of access to all subsections within a section by selecting the Apply to subsections check box next to that section. This check box is cleared by default.

6. Click Create.

The access permission is created and displayed in the table. It can now be used when creating users or user groups.

[Topic 256229]

Editing access permissions

To edit an access permission:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the Permissions tab.

   A table of access permissions is displayed.

3. Click the access permission.
4. In the displayed settings area, edit the settings that you want to change. For a description of the settings, see the instructions for creating an access permission.
5. Click Save.

[Topic 256230]

Cloning access permissions

To clone an access permission:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the Permissions tab.

   A table of access permissions is displayed.

3. Click the access permission.
4. In the upper part of the displayed settings area, click Management and in the drop-down list, select Clone.
5. This opens a window; in that window, enter the name of the new access permission.
6. Click Clone.

A copy of the access right with the new name is added to the table.

[Topic 256231]

Removing an access permission

Deleted access permissions cannot be restored.

To remove an access permission:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the Permissions tab.

   A table of access permissions is displayed.

3. Click the access permission.
4. In the upper part of the displayed settings area, click Management and in the drop-down list, select Delete.
5. In the confirmation window, click Delete.

The access permission is deleted and is no longer displayed in the table.

[Topic 251515]

Creating a user

You can create users so to let them authenticate in the orchestrator web interface and manage the solution. To create a user that authenticates through a remote LDAP server, you must create an LDAP connection before following these instructions.

To create a user:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. In the upper part of the page, click + User.
3. In the displayed settings area, in the Source drop-down list, select the user authentication type:
   • Local to authenticate the user using credentials stored locally in the Kaspersky SD-WAN database. This is the default setting.
   • LDAP to authenticate the user using credentials stored on a remote LDAP server.
4. In the Username field, enter the local user name or the user name on the LDAP server. The LDAP server user name is specified in the user@domain or domain\user format.
5. If necessary, enter the local user password in the Password and Password confirmation fields. The password must contain at least one uppercase A–Z character, lowercase characters, numerals, and special characters. Password length: 8 to 50 characters. To see the entered password, you can click the show button .
6. In the Role drop-down list, select the role of the user:
   • The Administrator role grants the user access to the entire solution.
   • The Tenant role grants the user access only to the tenant that is assigned to the user.
7. If necessary, select an access permission for the user in the Permissions drop-down list.
8. If you need to create a confirmation request for every action that the user undertakes, select the Request confirmation is required check box. By default, this check box is cleared, and the user can freely edit the settings of the solution components.
9. In the First name field, enter the first name of the user.
10. In the Last name field, enter the last name of the user.
11. If necessary, enter the user's email address in the Email field.
12. If necessary, enter a brief description of the user in the Description field.
13. Click Create.

The user is created and displayed in the table.

[Topic 256232]

Editing a user

To edit a user:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Click the user.
3. In the displayed settings area, edit the settings that you want to change. For a description of the settings, see the instructions for creating a user.
4. Click Save.

[Topic 256233]

Changing user password

To change the password of a user:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Click the user.
3. In the upper part of the displayed settings area, click Management and in the drop-down list, select Change password.
4. This opens a window; type the new password in the New password text box. The password must contain at least one uppercase A–Z character, lowercase characters, numerals, and special characters. Password length: 8 to 50 characters. To see the entered password, you can click the show button .
5. In the Password confirmation field, enter the new password again.
6. Click Save.

The password of the user is changed.

[Topic 256234]

Activating or blocking a user

By default, users are created in the blocked state. You must unblock a user to let that user authenticate in the orchestrator web interface.

To block or unblock a user:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Click the user.
3. In the upper part of the displayed settings area, click Management and in the drop-down list, select Unblock or Block.

The user is unblocked or blocked.

[Topic 256235]

Deleting a user

Deleted users cannot be restored.

To delete a user:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Click the user.
3. In the upper part of the displayed settings area, click Management and in the drop-down list, select Delete.
4. In the confirmation window, click Delete.

The user is deleted and is no longer displayed in the table.

[Topic 251567]

Creating a user group

You can create a user group corresponding to a group on the LDAP server. Users in this group can authenticate in the orchestrator web interface. Note that users are added to the group on the LDAP server and the orchestrator plays no part in this process.

Before creating a user group, you must do the following:

• Create a user group on the LDAP server.
• Configure a connection between the orchestrator and the LDAP server.

To create a user group:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the Groups tab.

   A table of user groups is displayed.

3. In the upper part of the page, click + User group.
4. In the displayed settings area, in the Name field, enter the name of the user group on the LDAP server in the user@domain or domain\user format.
5. In the Role drop-down list, select the role of users in the group:
   • The Administrator role grants users in the group access to the entire solution.
   • The Tenant role grants users in the group access only to the tenant to which the group is assigned.
6. If necessary, select an access permission for the user group in the Permissions drop-down list.
7. Click Create.

The user group is created and displayed in the table.

[Topic 256237]

Editing a user group

To edit a user group:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the Groups tab.

   A table of user groups is displayed.

3. Click the user group.
4. In the displayed settings area, edit the settings that you want to change. For a description of the settings, see the instructions for creating a user group.
5. Click Save.

[Topic 256238]

Deleting a user group

Deleted user groups cannot be restored.

To delete a user group:

1. In the menu, go to the Users section.

   The user management page is displayed. The Users tab, which is selected by default, displays the table of users.

2. Select the Groups tab.

   A table of user groups is displayed.

3. Click the user group.
4. In the upper part of the displayed settings area, click Management and in the drop-down list, select Delete.
5. In the confirmation window, click Delete.

The user group is deleted and is no longer displayed in the table.

[Topic 256095]

Managing tenants

Tenants logically separate and isolate entities within the SD-WAN network. Each tenant sets its own management and configuration policies and has full control over its own networks and applications.

Within a multitenant network, multiple independent organizations, subdivisions, or clients use the same physical infrastructure and have their own virtual networks. In this case, a tenant cannot gain access to network resources assigned to another tenant. Multiple tenants can share the same IP address space.

[Topic 244173]

Creating a tenant

To create a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. If you are creating the first tenant, under Tenants, in the Name field, enter the name of the tenant.
3. If you are creating subsequent tenants, follow these steps:
   1. In the upper part of the Tenants block, click + Tenant.
   2. In the Name field, enter the name of the tenant.
4. If necessary, in the section in the lower part of the page, enter a brief description of the tenant.
5. Click the create button .

The tenant is created and displayed under Tenants.

[Topic 256099]

Assigning a VIM to a tenant

To assign a VIM to a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, select a tenant.
3. Under VIM, click + Edit.
4. This opens a window; in that window, select the a VIM. To select a VIM, you must first select the domain and data center in which this VIM is deployed.
5. Click Save.

The VIM assigned to the tenant is displayed under VIM.

[Topic 256104]

Assigning topology components to a tenant

To assign topology components to a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, select a tenant.
3. Under Catalog, select check boxes next to the topology components that you want to assign to the tenant.

The topology components are assigned to the tenant and displayed in the tenant's catalog after refreshing the page.

[Topic 256106]

Assigning compute resources to a tenant

To assign compute resources to a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, select a tenant.
3. In the upper part of the Resources section, click the settings button .
4. Click the resize button ∞ next to one of the following computation resources:
   • CPU — virtual CPU cores
   • RAM — RAM
   • Disk — disk space
5. In the displayed field, enter the amount of compute resource that you want to assign to the tenant.
6. Click the save button .

[Topic 256108]

Assigning a user to a tenant

To assign a user to a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, select a tenant.
3. Under User groups, click + Edit.
4. This opens a window; in that window, select the user that you want to assign to the tenant.
5. Click Save.

The user assigned to the tenant is displayed under Users.

[Topic 256102]

Assigning a user group to a tenant

To assign a user group to a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, select a tenant.
3. Under User groups, click + Edit.
4. This opens a window; in that window, select the user group that you want to assign to the tenant.
5. Click Save.

The user group assigned to the tenant is displayed under User groups.

[Topic 256109]

Authenticating as an administrator in the tenant's orchestrator web interface

To authenticate as an administrator in the tenant's orchestrator web interface:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, select a tenant.
3. Click Connect as tenant.

The tenant's orchestrator web interface opens in a new browser tab and you are authenticated as an administrator.

[Topic 256114]

Editing a tenant

To edit a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, click the settings button next to the tenant and in the drop-down list, select Edit.
3. Edit the settings as necessary. For a description of the settings, see the instructions for creating a tenant.
4. In the block that is displayed in the lower part of the page, click the save button .

[Topic 256115]

Deleting a tenant

Deleted tenants cannot be restored.

To delete a tenant:

1. In the menu, go to the Tenants section.

   The tenant management page is displayed.

2. Under Tenants, click the settings button next to the tenant and in the drop-down list, select Delete.
3. In the confirmation window, click Delete.

The tenant is deleted and is no longer displayed under Tenants.

[Topic 245420]

Managing SD-WAN instances

An SD-WAN instance is the Kaspersky SD-WAN solution deployed on multiple physical and/or virtual devices for a single

Centralized configuration of SD-WAN instances is achieved using SD-WAN instance templates. You can specify all settings in an SD-WAN instance template and then use it when deploying instances for individual tenants, thus avoiding the need to configure them individually. To use an SD-WAN instance template when deploying an instance for a tenant, the tenant must be added to the template.

When you deploy Kaspersky SD-WAN for the first time, a default SD-WAN instance template is automatically created in the orchestrator web interface. It cannot be deleted, but you can select a different default template.

If you deploy the solution for a tenant that is not added to any SD-WAN instance template, the default template is applied to that tenant.

If the settings specified in the SD-WAN instance template do not match the actual settings of the tenant's instance, the solution is not deployed. For example, you may encounter an error when deploying the solution for a tenant if the SD-WAN instance template that is being used specifies the number of SD-WAN Controller nodes that differs from the actual number of nodes that the tenant has.

You can pool SD-WAN instances for scalability and fault tolerance, especially if a great number of devices is used.

Each SD-WAN instance pool is a load balancer with CPE devices as the load. When creating a CPE device, you can assign it to a pool of SD-WAN instances or to individual instances from that pool. If you assign a device to a pool of SD-WAN instances, the orchestrator automatically selects from this pool the SD-WAN instance with the least number of devices and assigns the device to that instance. If the quantities of devices are the same, the SD-WAN instance is selected randomly.

[Topic 242562]

Creating an SD-WAN instance template

To create an SD-WAN instance template:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. In the upper part of the page, click + SD-WAN instance template.

This opens the SD-WAN instance templates subsection, which contains the table of SD-WAN instance templates. The template is created and displayed in the table. By default, the template is assigned a name in the "Template <template sequential number>" format.

[Topic 256244]

Setting the default SD-WAN instance template

To set the default SD-WAN instance template:

1. In the menu, go to the SD-WAN → SD-WAN instance templates subsection.

   A table of SD-WAN instance templates is displayed.

2. Click the SD-WAN Instance template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions, click Set as default template.

[Topic 256245]

Deleting an SD-WAN instance template

You cannot delete the default SD-WAN instance template. Deleted templates cannot be restored.

To delete an SD-WAN instance template:

1. In the menu, go to the SD-WAN → SD-WAN instance templates subsection.

   A table of SD-WAN instance templates is displayed.

2. Click the SD-WAN Instance template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Delete.
4. In the confirmation window, click Delete.

The SD-WAN instance template is deleted and is no longer displayed in the table.

[Topic 242988]

Adding a tenant to an SD-WAN instance template

Before you can add a tenant to an SD-WAN instance template, you must create a tenant and an SD-WAN instance template.

To add a tenant to an SD-WAN instance template:

1. In the menu, go to the SD-WAN → SD-WAN instance templates subsection.

   A table of SD-WAN instance templates is displayed.

2. Click the SD-WAN Instance template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Tenants tab.

   A table of tenants is displayed.

4. Click + Tenant.
5. This opens a window; in that window, select a tenant and click Add.
6. Click Save in the upper part to save the configuration of the SD-WAN instance template.

The tenant is added to the SD-WAN instance template and is displayed in the table.

[Topic 256249]

Removing a tenant from an SD-WAN instance template

To remove a tenant from an SD-WAN instance template:

1. In the menu, go to the SD-WAN → SD-WAN instance templates subsection.

   A table of SD-WAN instance templates is displayed.

2. Click the SD-WAN Instance template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Tenants tab.

   A table of tenants is displayed.

4. Click Delete next to the tenant.
5. Click Save in the upper part to save the configuration of the SD-WAN instance template.

The tenant is deleted from the SD-WAN instance template and is no longer displayed in the table.

[Topic 243028]

Configuring high availability

The solution architecture allows maintaining high availability of SD-WAN instances in the event of shutdown or overload of virtual machines, CPE devices, and SD-WAN Controllers. High availability of these components is achieved by installing redundant devices and connections between them.

We recommend that you take into account the need for high availability of solution components when deploying an SD-WAN instance.

To configure high availability:

1. In the menu, go to the SD-WAN → SD-WAN instance templates subsection.

   A table of SD-WAN instance templates is displayed.

2. Click the SD-WAN Instance template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the High availability tab.

   The high availability settings are displayed.

4. Select the number of SD-WAN Controller nodes to use when deploying an SD-WAN instance.
5. Click Save in the upper part to save the configuration of the SD-WAN instance template.

[Topic 243035]

Choosing a transport strategy

A transport strategy is a transport service encapsulation mechanism that includes the algorithm for adding a stack of traffic packet header tags and the type of these tags. Kaspersky SD-WAN temporarily supports one transport strategy, Generic VNI Swapping Transport.

To select a transport strategy:

1. In the menu, go to the SD-WAN → SD-WAN instance templates subsection.

   A table of SD-WAN instance templates is displayed.

2. Click the SD-WAN Instance template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Transport/service strategy tab.

   The selected transport strategy is displayed.

4. Make sure the Generic VNI swapping transport transport strategy is selected in the drop-down list.

[Topic 249094]

Adding a tenant to an SD-WAN instance

By default, an SD-WAN instance is deployed for one tenant, but you can add other tenants to an already deployed instance. In this case, the instance provides connectivity between CPE devices assigned to the tenants added to the instance. When adding a tenant, you can also limit the number of devices available to the tenant.

Before adding a tenant to an SD-WAN instance, you must create the tenant.

To add a tenant to an SD-WAN instance:

1. In the menu, go to the SD-WAN → SD-WAN instances subsection.

   A table of SD-WAN instances is displayed.

2. Click the relevant SD-WAN instance.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Tenant self-service tab.

   A table of tenants is displayed.

4. Click + Add.
5. This opens a window; in that window, select a tenant.
6. In the Maximum CPEs field, enter the maximum number of devices available for the tenant.
7. Click Add.

The tenant is added to the SD-WAN instance and is displayed in the table.

[Topic 256261]

Removing a tenant from an SD-WAN instance

To remove a tenant from an SD-WAN instance:

1. In the menu, go to the SD-WAN → SD-WAN instances subsection.

   A table of SD-WAN instances is displayed.

2. Click the relevant SD-WAN instance.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Tenant self-service tab.

   A table of tenants is displayed.

4. Click Delete next to the tenant.
5. In the confirmation window, click Delete.

The tenant is deleted from the SD-WAN instance and is no longer displayed in the table.

[Topic 256254]

Viewing devices assigned to an SD-WAN Instance

To view devices assigned to an SD-WAN instance:

1. In the menu, go to the SD-WAN → SD-WAN instances subsection.

   A table of SD-WAN instances is displayed.

2. Click the relevant SD-WAN instance.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Show associated CPEs.

The CPE subsection is displayed with a table of CPE devices. The table displays only those devices that are assigned to the SD-WAN instance.

[Topic 256252]

Deleting an SD-WAN instance

Deleting an instance also deletes all CPE devices assigned to the template as well as the network service in which the instance was deployed.

An alternative method of deleting an instance is to delete the network service in which it is deployed. Deleted SD-WAN instances cannot be restored.

To delete an SD-WAN instance:

1. In the menu, go to the SD-WAN → SD-WAN instances subsection.

   A table of SD-WAN instances is displayed.

2. Click the relevant SD-WAN instance.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Delete.
4. In the confirmation window, click Delete.

The SD-WAN instance is deleted and is no longer displayed in the table.

[Topic 245465]

Creating a pool of SD-WAN instances

To create a pool of SD-WAN instances:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. In the upper part of the page, click + SD-WAN instance pool.
3. This opens a window; in that window, enter the name of the SD-WAN instance pool.
4. Click Create.

This opens the SD-WAN instance pools subsection, which contains the table of SD-WAN instance pools. The SD-WAN instance pool is created and displayed in the table. Now you can add SD-WAN instances to the pool.

[Topic 256268]

Adding an SD-WAN instance to a pool

Before adding an SD-WAN instance to a pool, you must create a pool of SD-WAN instances.

To add an SD-WAN instance to the pool:

1. In the menu, go to the SD-WAN → SD-WAN instance pools subsection.

   A table of SD-WAN instance pools is displayed.

2. Click the SD-WAN instance pool.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the SD-WAN instances tab.

   A table of SD-WAN instances is displayed.

4. Click + SD-WAN instance.
5. This opens a window; in that window, select the SD-WAN instance that you want to add to the pool.
6. Click Add.
7. Click Save in the upper part to save the configuration of the SD-WAN instance pool.

The SD-WAN instance is added to the pool and displayed in the table.

[Topic 256270]

Removing an SD-WAN instance from a pool

To remove an SD-WAN instance from a pool:

1. In the menu, go to the SD-WAN → SD-WAN instance pools subsection.

   A table of SD-WAN instance pools is displayed.

2. Click the SD-WAN instance pool.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the SD-WAN instances tab.

   A table of SD-WAN instances is displayed.

4. Click Delete next to the SD-WAN instance.

   The SD-WAN instance is removed from the pool and is no longer displayed in the table.

5. Click Save in the upper part to save the configuration of the SD-WAN instance pool.

[Topic 256272]

Deleting a pool of SD-WAN instances

Deleted SD-WAN pools cannot be restored.

To create an SD-WAN instance pool:

1. In the menu, go to the SD-WAN → SD-WAN instance pools subsection.

   A table of SD-WAN instance pools is displayed.

2. Click the SD-WAN instance pool.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Delete.
4. In the confirmation window, click Delete.

The SD-WAN instance pool is deleted and is no longer displayed in the table.

[Topic 237615]

Managing CPE devices

Kaspersky SD-WAN lets you install CPE devices with the following technical characteristics at your organization's branches or client locations:

• Standard CPU architecture:
  • x86 (Intel 80x86)
  • Arm v8/64 (Advanced RISC Machine)
  • MIPS (Microprocessor without Interlocked Pipeline Stages)
• No vendor lock-in
• Minimal hardware requirements, such as CPU and RAM

Connected CPE devices are automatically registered in the inventory database and have direct internet access (DIA). You can use two types of CPE devices:

• Standard CPE devices — to provide additional VNFs from the data center or cloud, you must make the virtual CPE device part of the service chain. After providing the VNF, traffic is sent to its destination.
• Universal CPE (hereinafter also uCPE) — hosting VNFs locally improves response times, optimizes transport streams, and lets you manage these VNFs through the orchestrator web interface.

[Topic 238888]

Composition of CPE devices

CPE devices have the following external interfaces:

• One or more LAN interfaces. You can combine LAN interfaces to form a switch using Linux bridges. In this way, you can improve the speed of data transmission to network devices connected to the switch, optimize the use of network resources and prevent bottlenecks.

  If one of the interfaces fails, traffic can be moved to another interface that remains operational. Aggregating interfaces into a single switch also makes it easier to scale your network because you can add new interfaces to the switch as needed.

• One or more WAN interfaces. These interfaces can be wired or wireless.

Each CPE device has an OpenFlow software switch (virtual switch, hereinafter also referred to as softswitch), which is managed by the SD-WAN Controller and, by default, has interfaces with the following numbers:

• 1 (ovs-mgmt) — provides internal network management and configuration of the CPE device through the SD-WAN managementTunnel transport service after connecting to the orchestrator and SD-WAN Controller.
• 2 (ovs-lan) — provides a connection to a Linux bridge.
• 4800–4803 — GENEVE interfaces created for each WAN interface of the SD-WAN. The first GENEVE interface has the number 4800. Other GENEVE interfaces are assigned consecutive numbers. For example, the second GENEVE interface is assigned the number 4801.

  As the source IP address, you must assign the IP address of the corresponding WAN interface. As the destination interface, you must assign the GENEVE interface number.

After the CPE device receives the parameters of WAN interfaces, a separate routing table is created for each WAN interface.

The figure below shows the logic diagram of a CPE device.

Logic diagram of a CPE device

[Topic 238898]

Composition of uCPE devices

An uCPE device additionally supports deploying VNFs (as in a virtual data center infrastructure). The uCPE software must be installed on an x86 server. Each such device includes a hypervisor and VIM (OpenStack in minimal configuration). The rest of components required for VNF orchestration are located in the data center. The softswitch on the uCPE device has an additional OS-data interface.

The orchestrator begins interacting with the VIM on the uCPE device after the device registers itself and connects to the SD-WAN managementTunnel transport service.

You can create a network service on a uCPE device that is in the Disconnected state. In this case, the orchestrator monitors the availability of the uCPE device and creates a network service when the VIM begins responding to API requests.

The VIM on the uCPE device is assigned by default to the tenant for which the SD-WAN instance is deployed, but you can select a different tenant.

When creating a network service, you must select a VIM for VNF deployment. You can select a VIM in the data center that which is associated with the tenant, or a VIM on the uCPE device. If you remove a uCPE device, all service chains deployed on that device are deleted.

The figure below shows the logic diagram of a uCPE device.

Logic diagram of a uCPE device

[Topic 238920]

SD-WAN managementTunnel management transport service

Kaspersky SD-WAN uses the SD-WAN managementTunnel P2M transport service for managing and monitoring CPE devices. The root interfaces of this transport service are the service interfaces on one or more CPE devices behind which are the control plane components.

After a CPE device connects to an SD-WAN Controller, a service interface with the Access encapsulation type is automatically created on top of the ovs-mgmt OpenFlow interface. The orchestrator activates the CPE device and adds this service interface to the SD-WAN managementTunnel management transport service with the Leaf role (see the figure below).

CPE device management transport service

The IP address for managing the CPE device is determined automatically from the pool of addresses configured by you. When a CPE device is deleted, the IP address associated with it is returned to the address pool. The VNF and PNF components communicate with each other and with the orchestrator using public IP addresses.

You can provide access to the web console of the CPE device and configure an SSH connection to the console using a CPE template. Note that to do this, you do not need to configure IP connectivity with the device.

VNFM provides access to the device console through the SD-WAN managementTunnel transport service.

[Topic 237777]

Automatic configuration of CPE (ZTP) devices

Each CPE device has a unique DPID (Datapath Identifier). It is a 64-bit number that is generated based on a unique characteristic of the CPE device, such as the MAC address of the WAN0 interface or a serial number.

To use a CPE device, you must first create an entry for it in the web interface, and then connect the device itself to the orchestrator. Alternatively, you can connect the device to the orchestrator (in this case, it is displayed in the web interface with the Unknown status) and then create an entry. In both cases, the entry is associated with the device based on its DPID.

Two main scenarios exist for registering CPE devices: Zero Touch Provisioning (ZTP) or with additional configuration. Additional configuration includes, for example, assigning static IP addresses and creating routes, uploading security certificates, and generating tokens.

The CPE device is configured as follows:

1. If additional configuration is needed, URL activation is used.
2. The CPE device receives IP addresses of WAN interfaces and DNS servers as well as default routes from the service provider via DHCP.
3. The CPE device uses the FQDN or IP address of the orchestrator to connect to it, passes its own DPID, and obtains the public IP addresses of the SD-WAN Controller and SD-WAN gateways (if any). Certificates are also uploaded to the CPE device.
4. The CPE device establishes a TLS connection with the SD-WAN controller over the IP network using the service provider's network or the internet.
5. The SD-WAN Controller programs the CPE device to create links from each WAN interface.

To automatically configure a CPE device over the internet, you must configure public IP addresses of the orchestrator, controller, and SD-WAN gateways. NAT is supported for the following interfaces as an alternative to public IP addresses:

• tcp 443, 81 for the orchestrator
• tcp 6653 to 6656 for the SD-WAN Controller
• udp 4800 to 4803 for SD-WAN gateways

[Topic 246857]

CPE device statuses and states

CPE devices can have the following statuses:

• Unknown means that the device is connected to the orchestrator, but an entry was not created for it in the web interface.
• Waiting means that an entry was created for the device in the web interface, but the device is not connected to the orchestrator and/or is not registered.
• Registering means that the device is in the process of registration.
• Error means that an error occurred during the registration of the device.
• Registered means that the device has been registered successfully.
• Configuration means that the configuration of the device is being modified.

CPE devices can be in the following states:

• In relation to the orchestrator:
  • Activated means that the configuration of the assigned template has been applied to the device. You can connect such a device to transport services and use it to transmit traffic.
  • Deactivated (in the Waiting status) means that the configuration of the assigned template has not been applied to the device. You can make local changes to the device configuration before activating it.
  • Deactivated (in the Registered status) means that the device is blocked from transmitting traffic through the links and the orchestrator does not respond to requests coming from the device.
• In relation to the SD-WAN Controller:
  • Active means that the device is being managed by a Controller.
  • Inactive means that the device is not being managed by a Controller.

[Topic 245769]

Ensuring connectivity of CPE devices with SD-WAN Controllers

CPE devices establish a connection with SD-WAN Controllers via the OpenFlow protocol in the control plane through all WAN interfaces: a TCP session is established with all SD-WAN Controllers through each WAN interface of the CPE device.

The diagram below shows the principle of establishing connections between a CPE device and SD-WAN Controllers.

Establishing connections between SD-WAN Controllers and a CPE device

In the example above, in a cluster of three controllers and a CPE device six TCP sessions are established with two WAN interfaces:

• 10.0.1.1 → ctl1:6653
• 10.0.2.1 → ctl1:6654
• 10.0.1.1 → ctl2:6653
• 10.0.2.1 → ctl2:6654
• 10.0.1.1 → ctl3:6653
• 10.0.2.1 → ctl3:6654

Only one session is a primary session at any given time. The parameters for switching and restoring the main session are specified when configuring the connection of the CPE device to the SD-WAN network.

[Topic 246035]

Automatically updating the link cost based on maximum speed of the interface

If the speed of the WAN interface of the SD-WAN on the CPE device is higher than the network speed provided by the service provider, you must limit the maximum speed of that interface to match the network speed.

The link cost value is calculated based on the maximum speed parameter. The relation of the maximum speed and cost parameters is as follows:

• Maximum rate specifies the maximum interface bandwidth for correctly calculating logical queues for QoS. Measured in Mbps (megabits per second).
• Cost determines the weight of the interface in the topology and is calculated using the formula: Cost = 10,000,000 / Speed, where Speed is equal to the maximum speed value. The lower the cost value, the higher the priority of the link in the network topology.

When the maximum speed changes, the cost value changes for links in both directions. The lowest maximum speed value of the interfaces participating in the link is taken for the link.

You can manually specify the link cost as well as the maximum speed of the SD-WAN interface when creating it.

[Topic 256281]

CPE template

A CPE template contains the configuration of a CPE device. You can configure a template once and then apply it to the devices you create. This way you avoid the need to configure each device individually.

Note that certain CPE device settings can only be set in a template. For example, the template specifies the port number that the device uses to connect to the orchestrator. This setting cannot be changed on an individual device.

When you make changes to a CPE template, they are automatically applied to all devices that are using that template. After you finish managing the CPE template, you can proceed to create and configure individual devices. The device is configured in accordance with the applied template, but you can make local changes if not all settings meet your requirements.

[Topic 243166]

Creating a CPE template

To create a CPE template:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. In the upper part of the page, click + CPE template.
3. This opens a window; in that window, in the Name field, enter the name of the CPE template.
4. In the Type drop-down list, select the CPE template type:
   • CPE for a standard CPE device template. This is the default setting.
   • uCPE for a uCPE device template.
5. Click Create.

The CPE templates subsection is displayed with a table of CPE devices. The template is created and displayed in the table. You can now apply it to a CPE device when creating that device.

[Topic 256292]

Exporting a CPE template

You can export a CPE template configuration and then import it into another template.

To export a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Export.

An archive in the TAR.GZ format is saved on your local device.

The archive contains the following data:

• File with the description of the CPE template in XML format
• Script files
• Files required to run scripts, such as SSL certificates

The entire configuration is exported, including all settings specified on template tabs.

The saved configuration archive does not contain information about devices to which the original CPE template was applied.

[Topic 256289]

Importing a CPE template

When a CPE template is imported into another template, their configurations become identical. During import, you can select the tabs of the CPE template on which you want to keep the original configuration.

Before importing a CPE template, you must export a CPE template.

After the import, the CPE template remains applied to devices, but the configuration of those devices is not changed.

To import a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Import.
4. This opens a window; in that window, clear the check boxes next to the CPE template tabs that you want to leave unchanged after import.
5. In the File field, specify the path to the TAR.GZ archive.
6. Click Import.

The configuration of the CPE template is changed to match the imported template.

[Topic 256299]

Cloning a CPE template

When a CPE template is cloned, a copy of the template with a new name is created; this copy is initially not applied to any devices.

To clone a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Clone.
4. This opens a window; in that window, enter the name of the new CPE template.
5. Click Clone.

A copy of the CPE template is created and displayed in the table.

[Topic 256301]

Exporting settings and SD-WAN interfaces from a CPE template

From a CPE template, you can export the settings for connecting the device to the SD-WAN network, which are configured on the SD-WAN settings tab, as well as the configuration of SD-WAN interfaces that are configured on the SD-WAN settings → Interfaces tab.

To export settings and SD-WAN interfaces from a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Export SD-WAN settings.

A JSON file named <Template name>sdwan-config is saved to your local device.

[Topic 256303]

Exporting network interfaces from a CPE template

From the CPE template, you can export the configuration of network interfaces, which are configured on the Network settings tab.

To export network interfaces from a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Export network interfaces.

A file in JSON format with the name <Template name>-network-config is saved to your local device.

[Topic 256304]

Viewing devices that are using a CPE template

To view devices that are using a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Show associated CPEs.

The CPE subsection is displayed with a table of CPE devices. Only devices that are using the CPE template are listed in the table.

[Topic 256286]

Deleting a CPE template

You cannot delete a template that is currently applied to CPE devices. Deleted templates cannot be restored.

To delete a CPE template:

1. In the menu, go to the SD-WAN → CPE templates subsection.

   A table of CPE templates is displayed.

2. Click the CPE template.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Delete.
4. In the confirmation window, click Delete.

The CPE template is deleted and is no longer displayed in the table.

[Topic 244531]

Creating a CPE device

Expand all | Collapse all

Before connecting a CPE device to the orchestrator, you can create an entry for it in the web interface. When creating an entry, you must specify the DPID to subsequently map it to the connected device. When an entry is successfully mapped to a device, it is automatically registered.

You can create a CPE device for the current SD-WAN instance, as well as for a selected tenant or SD-WAN instance. To create a CPE device, use the following instructions:

• Creating a CPE device for the current SD-WAN instance.

  To create a CPE device for the current SD-WAN instance:

  1. In the menu, go to the SD-WAN section.

     By default, the CPE subsection is displayed with a table of CPE devices.

  2. In the upper part of the page, click + CPE.
  3. This opens a window; in that window, in the Name field, enter the name of the CPE device.
  4. In the DPID field, enter the DPID of the CPE device.
  5. In the State drop-down list, select the device state after registration:
     • Activated to apply the configuration of the CPE template to the device. An activated device can be connected to transport services and used to transmit traffic. This is the default setting.
     • Deactivated to not apply the configuration of the CPE template to the device. You can make local changes to the device configuration before activating it.
  6. If necessary, enter a brief description of the device in the Description field.
  7. Under Tenant, select the main tenant. You can select a pool of SD-WAN instances or an individual instance from the pool.
  8. If necessary, in the Customer tenant section, select a tenant for your client's organization.
  9. If necessary, in the UNI template section, select an UNI template to create the UNIs contained in the template on the device.
  10. Under CPE template, select a CPE template to configure the device in accordance with the configuration of that template.
  11. Click Next and specify the address of the CPE device location in the Address field. As you enter the address, you are prompted to select an address from a drop-down list.

      The address is displayed on the map.

  12. Click Create.

  The CPE device is created and displayed in the table. Now you can configure and use it for traffic transmission.

• Creating a CPE device for a tenant.

  To create a CPE device for a tenant:

  1. In the menu, go to the Tenants section.

     The tenant management page is displayed.

  2. Under Tenants, select a tenant.
  3. Under CPEs, click + CPE.
  4. This opens a window; in that window, in the Name field, enter the name of the CPE device.
  5. In the DPID field, enter the DPID of the CPE device.
  6. In the State drop-down list, select the device state after registration:
     • Activated to apply the configuration of the CPE template to the device. An activated device can be connected to transport services and used to transmit traffic. This is the default setting.
     • Deactivated to not apply the configuration of the CPE template to the device. You can make local changes to the device configuration before activating it.
  7. If necessary, enter a brief description of the device in the Description field.
  8. If necessary, in the Customer tenant section, select a tenant for your client's organization.
  9. If necessary, in the UNI template section, select an UNI template to create the UNIs contained in the template on the device.
  10. Under CPE template, select a CPE template to configure the device in accordance with the configuration of that template.
  11. Click Next and specify the address of the CPE device location in the Address field. As you enter the address, you are prompted to select an address from a drop-down list.

      The address is displayed on the map.

  12. Click Create.

  The CPE device is created and displayed under CPEs. Now you can configure and use it for traffic transmission.

• Creating a CPE device for an SD-WAN instance.

  To create a CPE device for an SD-WAN instance:

  1. In the menu, go to the SD-WAN → SD-WAN instances subsection.

     A table of SD-WAN instances is displayed.

  2. Click the relevant SD-WAN instance.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. In the upper part of the settings area, click CPE.
  4. This opens a window; in that window, in the Name field, enter the name of the CPE device.
  5. In the DPID field, enter the DPID of the CPE device.
  6. In the State drop-down list, select the device state after registration:
     • Activated to apply the configuration of the CPE template to the device. An activated device can be connected to transport services and used to transmit traffic. This is the default setting.
     • Deactivated to not apply the configuration of the CPE template to the device. You can make local changes to the device configuration before activating it.
  7. If necessary, enter a brief description of the device in the Description field.
  8. Under Tenant, select the main tenant. You can select a pool of SD-WAN instances or an individual instance from the pool.
  9. If necessary, in the Customer tenant section, select a tenant for your client's organization.
  10. If necessary, in the UNI template section, select an UNI template to create the UNIs contained in the template on the device.
  11. Under CPE template, select a CPE template to configure the device in accordance with the configuration of that template.
  12. Click Next and specify the address of the CPE device location in the Address field. As you enter the address, you are prompted to select an address from a drop-down list.

      The address is displayed on the map.

  13. Click Create.

  The web interface of the SD-WAN instance is opened in a new browser tab and you are authenticated as an administrator. By default, the CPE subsection is displayed with a table of CPE devices. The device is created and displayed in the table. Now you can configure and use it for traffic transmission.

[Topic 256311]

Specifying the address of a CPE device

To specify the address of a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Set location.
4. This opens a window; in that window, enter the address of the CPE device's location. As you enter the address, you are prompted to select an address from a drop-down list.

   The address is displayed on the map.

5. Click Save.

[Topic 245100]

Registering a CPE device

If a CPE device connects to the orchestrator and cannot be mapped to any of entries you created, the device must be registered. When registering a CPE device, connecting to the vendor's cloud services is not necessary.

To register a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Register.
4. In the State drop-down list, select the device state after registration:
   • Activated to apply the configuration of the CPE template to the device. An activated device can be connected to transport services and used to transmit traffic. This is the default setting.
   • Deactivated to not apply the configuration of the CPE template to the device. You can make local changes to the device configuration before activating it.
5. If necessary, enter a brief description of the device in the Description field.
6. Under Tenant, select the main tenant. You can select a pool of SD-WAN instances or an individual instance from the pool.
7. If necessary, in the Customer tenant section, select a tenant for your client's organization.
8. If necessary, in the UNI template section, select an UNI template to create the UNIs contained in the template on the device.
9. Under CPE template, select a CPE template to configure the device in accordance with the configuration of that template.
10. Click Next and specify the address of the CPE device location in the Address field. As you enter the address, you are prompted to select an address from a drop-down list.

    The address is displayed on the map.

11. Click Register.

The CPE device status changes first to Registering, then to Registered.

Your subsequent actions depend on the value selected in the State drop-down list:

• If you selected Activated, you can use the device to relay traffic.
• If you selected Deactivated, you must configure the device, then activate it, and only then can you use it to transmit traffic.

[Topic 256312]

Activating or deactivating a CPE device

When a device is activated, the CPE template is applied to it. A device that is not activated cannot be used for traffic transmission.

To activate or deactivate a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Activate or Deactivate.

[Topic 245418]

Using a web address to activate a CPE device

Kaspersky SD-WAN supports activation of CPE devices using a web address (URL-based ZTP). Activation using a web address simplifies and speeds up initial configuration of the CPE by automating the passing of settings in a web address and then applying the configuration.

By minimizing manual intervention, web address based activation reduces the qualification requirements for personnel that activates and configures the CPE device on location. This activation method is convenient for two-factor authentication or the initial application of basic network connectivity settings for connecting a CPE device to the orchestrator (for example, static IP or BGP).

The following special considerations apply to web address activation:

• Web address activation is available for CPE devices with firmware in the initial condition.
• CPE devices must not have the Unknown status.

You can specify the web address template for activation when configuring the CPE device connection to the SD-WAN network in the URL ZTP field.

To activate a CPE device using a web address:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions, click Get activation URL, and in the displayed window, copy the web address.
4. Send the web address to the user who will activate and configure the CPE device on location. The user must complete the following steps to activate the CPE device:
   1. Connect to the LAN interface of the CPE device and obtain an IP address via DHCP.
   2. Follow the link received or paste the web address into the address bar of the browser.
   3. Wait for the CPE device to receive the configuration, apply the received settings and restart.

[Topic 256314]

Connecting to the CPE device console

To connect to the console of a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Under Actions, click Open SSH console.

This opens a console window in a new browser tab.

[Topic 256309]

Deleting a CPE device

When you delete a CPE device, all service interfaces created on the device are automatically deleted. Deleted CPE devices cannot be restored.

To delete a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Delete.
4. In the confirmation window, click Delete.

The CPE device is deleted and is no longer displayed in the table.

[Topic 256313]

Viewing the password of a CPE device

To view the password of a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Show password.

This opens a window with the CPE device password.

[Topic 256316]

Restarting a CPE device

To restart a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions, click Reboot.
4. In the confirmation window, click Reboot.

[Topic 256317]

Shutting down a CPE device

A CPE device is shut down by sending the shutdown command to its operating system.

To shut down a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions, click Shutdown.
4. In the confirmation window, click Shutdown.

[Topic 256318]

Exporting settings and SD-WAN interfaces from a CPE device

From a CPE device, you can export the settings for connecting the device to the SD-WAN network, which are configured on the SD-WAN settings tab, as well as the configuration of SD-WAN interfaces that are configured on the SD-WAN settings → Interfaces tab.

To export settings and SD-WAN interfaces from a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Export SD-WAN settings.

A JSON file named <Template name>sdwan-config is saved to your local device.

[Topic 256319]

Exporting network interfaces from a CPE device

From the CPE device, you can export the configuration of network interfaces, which are configured on the Network settings tab.

To export network interfaces from a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. In the upper part of the settings area, under Actions click Export network interfaces.

A file in JSON format with the name <Template name>-network-config is saved to your local device.

[Topic 262117]

Searching for CPE devices

To find a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. In the upper part of the page, click the search button and enter your search criterion in the field that is displayed. For example, you can enter name, IP address, or one of the assigned tags of the CPE device.

The search results are displayed in the table.

[Topic 243195]

Automatic removal and deactivation of a CPE device

Expand all | Collapse all

You can specify the time after which an individual CPE device or all devices that use a certain CPE template are deleted or deactivated if communication with the SD-WAN Controller is lost.

Both functions are used to prevent theft of devices. The automatic deletion function is also used to clean up obsolete entries from the orchestrator web interface. Both functions are disabled by default.

To automatically delete or deactivate CPE devices, use the following instructions:

• Configuring automatic deletion and/or deactivation of an individual CPE device.

  To configure automatic deletion and/or deactivation of an individual CPE device:

  1. In the menu, go to the SD-WAN section.

     By default, the CPE subsection is displayed with a table of CPE devices.

  2. Click the CPE device.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the Deactivation tab.

     Automatic deletion and deactivation settings of the CPE device are displayed.

  4. Configure automatic deletion of the CPE device:
     1. Select the Override check box next to the Delete timeout (sec.) field to ignore the applied CPE template and be able to change automatic deletion settings. This check box is cleared by default.
     2. Select the Enable check box next to the Delete timeout (sec.) field to enable automatic deletion.
     3. In the Delete timeout (sec.) field, enter the time after which the device must be deleted if communication with the SD-WAN controller is not possible. Time period is specified in seconds. Range of values: 60 to 31,536,000. The entered value may not be lower than the value specified for the automatic deactivation function.
  5. Configure automatic deactivation of the CPE device:
     1. Select the Override check box next to the Deactivation timeout (sec.) field to ignore the applied CPE template and be able to change automatic deactivation settings. This check box is cleared by default.
     2. Select the Enable check box next to the Deactivation timeout (sec.) field to enable automatic deactivation.
     3. In the Deactivation timeout (sec.) field, enter the time after which the device must be deactivated if communication with the SD-WAN controller is not possible. The time period is specified in seconds. Range of values: 60 to 31,536,000. The entered value may not be greater than the value specified for the automatic deletion function.
  6. In the upper part of the settings area, click Save to save the configuration of the CPE device.
• Configuring automatic deletion and/or deactivation of all devices using a certain CPE template.

  To configure automatic deletion and/or deactivation of all devices using a certain CPE template:

  1. In the menu, go to the SD-WAN → CPE templates subsection.

     A table of CPE templates is displayed.

  2. Click the CPE template.

     The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

  3. Select the Deactivation tab.

     Automatic deletion and deactivation settings of the CPE device are displayed.

  4. Configure automatic deletion of all devices that use the CPE template:
     1. Select the Enable check box next to the Delete timeout (sec.) field to enable automatic deletion. By default, automatic deletion is disabled.
     2. In the Delete timeout (sec.) field, enter the time after which the device must be deleted if communication with the SD-WAN controller is not possible. Time period is specified in seconds. Range of values: 60 to 31,536,000. The entered value may not be lower than the value specified for the automatic deactivation function.
  5. Configure automatic deactivation of all devices that use the CPE template:
     1. Select the Enable check box next to the Deactivation timeout (sec.) field to enable automatic deactivation. By default, automatic deactivation is disabled.
     2. In the Deactivation timeout (sec.) field, enter the time after which the device must be deactivated if communication with the SD-WAN controller is not possible. The time period is specified in seconds. Range of values: 60 to 31,536,000. The entered value may not be greater than the value specified for the automatic deletion function.
  6. In the upper part of the settings area, click Save to save the configuration of the CPE template.

[Topic 244953]

Two-factor authentication of a CPE device

Two-factor authentication is used to securely register a CPE device. When two-factor authentication is enabled, a security key is written to the orchestrator's database, which you must manually enter on the device. For successful registration, the two security keys must match.

To set up two-factor authentication on a CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Activation tab.

   Two-factor authentication settings of the CPE device are displayed.

4. In the Two-factor authentication drop-down list, select one of the following values:
   • Enabled
   • Disabled (selected by default)
5. If you enabled two-factor authentication, click Generate under the Token field to generate a security key.
6. In the upper part of the settings area, click Save to save the configuration of the CPE device.
7. Enter the generated security key on the CPE device in the /etc/config/sdwan folder.

[Topic 256320]

Orchestrator certificates

To prevent MITM (man-in-the-middle) attacks, when communicating with the orchestrator, the CPE device checks whether the orchestrator certificate can be trusted. By default, root certificates of public certificate authorities are installed on devices.

If your orchestrator is using a certificate signed by a public certificate authority, you do not need to install an additional certificate on the devices. Otherwise, you must add the public root certificate used by the orchestrator on the devices by uploading the certificate to the orchestrator web interface.

Regarding certificate management, consider the following:

• Each time a new certificate is uploaded in the orchestrator web interface, the certificate is automatically distributed to CPE devices.
• When you first activate a CPE device using a web address, the certificate uploaded to the orchestrator is automatically installed on the device.
• 30 days before the certificate expiration date, the orchestrator begins displaying a notification each time a user authenticates in the orchestrator web interface.

[Topic 248730]

Uploading an orchestrator certificate

To upload an orchestrator certificate:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. In the upper part of the page, click + Certificate.
3. Specify the path to the certificate file in PEM format. Maximum file size: 128 KB.

Information about the uploaded certificate is displayed in the Certificate subsection. The certificate is automatically distributed to CPE devices. You can distribute the certificate manually.

[Topic 256323]

Viewing an orchestrator certificate

To view the orchestrator certificate:

In the menu, go to the SD-WAN → Certificate subsection.

The information page for the uploaded orchestrator certificate is displayed.

[Topic 256321]

Manually distributing an orchestrator certificate to CPE devices

You can manually distribute an orchestrator certificate to CPE devices without waiting for automatic distribution.

To manually distribute an orchestrator certificate to CPE devices:

1. In the menu, go to the SD-WAN → Certificate subsection.

   The information page for the uploaded orchestrator certificate is displayed.

2. In the upper part of the page, click Apply to CPEs.

[Topic 256325]

Exporting an orchestrator certificate

To export an orchestrator certificate:

1. In the menu, go to the SD-WAN → Certificate subsection.

   The information page for the uploaded orchestrator certificate is displayed.

2. In the upper part of the page, click Export.

A PEM file named 'cacert' is saved on your local device.

[Topic 256334]

Tags

Tags describe various parameters of the CPE device, such as model, software version, or geographical location. Tags help classify devices for various tasks. For example, you can use tags to group devices of the same model and then update the firmware on such devices.

When you create a CPE device, tags describing the model and tenant to which it belongs are automatically assigned to the device.

If necessary, you can assign tags to one or more CPE devices at the same time. Note that a device must have the Registered status for tags to be assigned to it.

Kaspersky SD-WAN does not support assigning two identical tags to the same CPE device.

[Topic 244664]

Assigning tags to CPE devices

To assign a tag to an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Tags tab.

   The tags assigned to the CPE device are displayed.

4. Enter the tag and click the assign button .
5. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To assign a tag to multiple CPE devices at the same time:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Select the check boxes next to CPE devices.
3. In the upper part of the page, in the Actions drop-down box, select Add tags.
4. This opens a window; in that window, enter the tag and click the assign button .
5. Click Add.

[Topic 256338]

Removing CPE device tags

To remove a tag from an individual CPE device:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

   The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button .

3. Select the Tags tab.

   The tags assigned to the CPE device are displayed.

4. Click the delete button next to the tag.
5. In the upper part of the settings area, click Save to save the configuration of the CPE device.

To remove a tag from multiple CPE devices at the same time:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Select the check boxes next to CPE devices.
3. In the upper part of the page, in the Actions drop-down box, select Delete tags.
4. This opens a window in which you can remove the tags:
   • Click the delete button next to the tag.
   • Enter the tag in the field and select it from the drop-down list.
5. Click Delete.

[Topic 251415]

Out-of-band management of CPE devices

As part of the deployed Kaspersky SD-WAN solution, the orchestrator interacts with CPE devices via an overlay SD-WAN network and is in-band. However, the solution also supports out-of-band management (hereinafter also referred to as OOB management), which involves the exchange of control traffic between the orchestrator and the devices through the underlay network via HTTPS or TLS without using links.

OOB management lets you manage and diagnose CPE devices even in the absence of established links. For example, you can use OOB management if you are using only local breakout connection points or when the SD-WAN suffers an accident.

After registration, the CPE device starts sending API requests to the orchestrator at a certain interval to retrieve new configurations. This time interval is specified when configuring the connection of the device to the SD-WAN in the Update interval (sec.) field.

When you make changes to the CPE device configuration in the web interface, the orchestrator saves the new configuration with the Waiting status. The device, in turn, receives this configuration the next time an API request is sent, and the configuration gets the Executing status. If the configuration is applied successfully, the device notifies the orchestrator, after which the configuration gets the Executed status. If the device reports that the configuration could not be applied, the status changes to Error.

Before applying the new configuration to the CPE device, the current configuration is copied. If the device cannot send a confirmation message to the orchestrator after successfully applying the new configuration, it is rolled back to the previous version after 3 attempts. In this case, the configuration on the orchestrator also changes to the Error status.

You can view configuration statuses on an individual CPE device.

To view the configuration statuses:

1. In the menu, go to the SD-WAN section.

   By default, the CPE subsection is displayed with a table of CPE devices.

2. Click the CPE device.

The settings area is displayed in the lower part of the page. You can expand the settings area to fill the entire page by clicking the expand button . The configurations and their statuses are displayed in the Out-of-band management table.

[Topic 256339]

Managing CPE devices in SD-WAN controller menu

When you create a CPE device, it is also displayed in the Switchessection of the settings menu of the SD-WAN Controller. In this subsection, you can manage the device and view its statistics. Devices are displayed in a table with the following columns:

• Name is the CPE device name.
• ID is the sequence number of the CPE device. You can use this column to determine the order in which devices were connected to the SD-WAN Controller. The device with the lowest sequence number was the first to connect to the controller.
• Status is the status of the CPE device in SD-WAN Controller. One of the following statuses can be displayed in this column:
  • Active means that the device is being managed by a Controller.
  • Inactive means that the device is not being managed by a Controller.
• Connection is the status of the connection of the CPE device to the SD-WAN Controller. One of the following statuses can be displayed in this column:
  • Connected means a TCP session is established between the device and the Controller.
  • Disconnected means no TCP session is established between the device and the Controller.
• MAC is the MAC address of the CPE device.
• Interface is one or more WAN interfaces of the SD-WAN of the CPE device for establishing a TCP session with the SD-WAN Controller.
• Primary session is the WAN interface through which the control connection is established between the CPE device and the SD-WAN Controller.
• IP is the IP address used by the CPE device to establish a TCP session with the SD-WAN Controller.
• Port is the port number that CPE device uses to establish a TCP session with the SD-WAN Controller.
• Created is the date and time when the CPE device was registered.
• Location is the address of the CPE device location.
• Latency (ms.) is the latency in milliseconds of the TCP session between the CPE device and the SD-WAN Controller. The value displayed is for the control connection.
• Description is a brief description of the CPE device.

Note that the Switch button displayed in the upper part of the page is not used to create new CPE devices. This action is performed in the SD-WAN section.

Viewing statistics on CPE devices lets you analyze and monitor the process of traffic transmission between these devices and adapt your network policies in accordance with the changing requirements of your organization.

We do not recommend editing the settings of CPE devices and OpenFlow interfaces in the Switches section because this may cause malfunctions of the SD-WAN network. You can edit the settings of CPE devices in the CPE subsection, and the settings of OpenFlow interfaces in the CPE device configuration on the SD-WAN settings tab.

[Topic 255755]

Viewing the OpenFlow table of a CPE device

To view the OpenFlow table of a CPE device:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Click Management next to the SD-WAN Controller and in the drop-down list, select Configuration menu.

   This opens the SD-WAN Controller configuration menu. By default, you are taken to the Controller nodes section, which displays a table of Controller nodes.

3. Go to the Switches section.

   A table of CPE devices is displayed.

4. Click Management next to the CPE device and in the drop-down list, select OpenFlow table.

The OpenFlow table of the CPE device is displayed. To switch between pages of the table, click Previous or Next.

[Topic 256341]

Viewing statistics of OpenFlow interfaces

To view the statistics of OpenFlow interfaces:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Click Management next to the SD-WAN Controller and in the drop-down list, select Configuration menu.

   This opens the SD-WAN Controller configuration menu. By default, you are taken to the Controller nodes section, which displays a table of Controller nodes.

3. Go to the Switches section.

   A table of CPE devices is displayed.

4. Click Management next to the CPE device and in the drop-down list, select Interface statistics.

   The table of statistics of OpenFlow interfaces is displayed.

5. If necessary, edit the table:
   • In the upper part of the page, click the settings button and in the drop-down list, select the parameters that you want to display in the statistics.
   • Click Clear statistics to clear statistics.

[Topic 256342]

Viewing statistics of queues on LAN interfaces

To view statistics of queues on LAN interfaces:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Click Management next to the SD-WAN Controller and in the drop-down list, select Configuration menu.

   This opens the SD-WAN Controller configuration menu. By default, you are taken to the Controller nodes section, which displays a table of Controller nodes.

3. Go to the Switches section.

   A table of CPE devices is displayed.

4. Click Management next to the CPE device and in the drop-down list, select Queue statistics.

The table of statistics of queues on LAN interfaces is displayed.

[Topic 256343]

Navigating to service interfaces on a CPE device

To navigate to service interfaces created on a CPE device:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Click Management next to the SD-WAN Controller and in the drop-down list, select Configuration menu.

   This opens the SD-WAN Controller configuration menu. By default, you are taken to the Controller nodes section, which displays a table of Controller nodes.

3. Go to the Switches section.

   A table of CPE devices is displayed.

4. Click Management next to the CPE device and in the drop-down list, select Service interfaces.

The Service interfaces subsection is displayed with a table of service interfaces.

[Topic 256344]

Viewing the specifications of a CPE device

To view the specifications of a CPE device:

1. In the menu, go to the Infrastructure section.

   The SD-WAN infrastructure management page is displayed. By default, the Network resources tab is selected, which displays the table of SD-WAN Controllers.

2. Click Management next to the SD-WAN Controller and in the drop-down list, select Configuration menu.

   This opens the SD-WAN Controller configuration menu. By default, you are taken to the Controller nodes section, which displays a table of Controller nodes.

3. Go to the Switches section.

   A table of CPE devices is displayed.

4. Click Management next to the CPE device and in the drop-down list, select Information about hardware.

This opens a window with the specifications of the CPE device.