Cisco SD-WAN 003 - SD-WAN VPNs Overview and SD-WAN Controllers Setup 

The best SD-WAN training so far on youtube, thanks Rob

This is excellent. Thank you for taking the time to put this together Rob.

Thank you very much Rob for this wonderful series - fantastic job

TQ sir for the tutorial. Hostname 00:52 RSA Key 01:04 Enable Web Server For SCEP 01:31 Create CA Server 01:47 Export Certificate 03:12 TFTF Server to Certificate 03:36 View CA Certificate 04:03 vManage Configuration 06:19 vManage: tftp CA Certificate 10:47 vManage: CSR 11:54

I'm 4 videos down and I have to say, best demo I've seen so far.

Excellent training Rob!

great person Rob, great videos. Big Thanks from India.

this is really informative....cheers Rob

Rob, this is amazing!! Thanks for sharing. If you can, please share the images. Thanks again, this the best course on youtube.

Very well explained

FYI, I'm running 20.3.3.1 on my vControllers and when I question mark out the request download command set, I do not see an option for tftp, but the parser still seems to accept if you try using tftp as the copy method. I have a feeling that Cisco took out the tftp transfer option because it's insecure. This is probably what's making everyone struggle with this part of the process. So I used the http copy method outlined below by @Tim Kerr from 3 months ago and that seemed to work for me. Thanks Rob and Tim!

Really good , thank you

Loving your channel. You added a default-route 10.255.10.0/24 10.255.1.1 but there was no explanation as to why. I do not see the 10.255.10.0/24 subnet in the topology diagram. I'm guessing it's a subnet in your home network but as I'm trying to follow along it was like a brick wall...lol

completed Lab 4 good Lab!!!

Your explanation is really clear and to the point, and I really happy to find your amazing channel. I have got some questions, hope you answer them to get a better understanding of SD-WAN. What's the purpose of the 10.255.1.0/24 static route? I mean, why vpn0 should know about this management network? You have mentioned that vpn0 is a transport VPN. So, is that mean if we have host A reside behind vEdge1 and host B reside behind vEdge2, the outer IP header will be the (underlay) IPs of the two vEdges and the inner IP will be for host A and B? Why we assigned a block of public IP address space for the controller's zone? Why did you expose it to the public? Why we have a broadband internet connection for each site? traditionally, only the HQ has internet access and all sites should go to the internet via HQ. Is SD-WAN architecture has proposed a new mechanism to filter and control the traffic from each site rather than backhaul it to the HQ? Thanks and appreciate your work.

if there's no effect when issuing the command in vManger # request download tftp://223.1.1.13/PKI.ca the easiest way to import the certificate with the following steps : 1- copy the output certificate after issue this command #crypto pki export PKI pem terminal 2- go to vManager and issue # vshell then # vi /home/admin/PKI.ca then past the certificate 3- continue the remaining steps in vManager #request root-cert-chain install /home/admin/PKI.ca

For those who were not able to load up the GUI, i had the same problem and i fixed it by tapping the following command in the interface eth1 : "ip dhcp-client", in order to have a compatible ip address with ur eve-ng VM. --------------------------- int eth1 ip dhcp-client no shut commit -------------------------

Hi Rob, I really like they way you explain things, I have managed to setup my lab for sdwan, i have imported ca on vManage and vSmart but i am not able to add on vEdge and vbond, from vBond and vEdge i can ping CA router but when i do tftp i cannot see any activity on CA router Although i dont get any error on vBond when i issue tftp command, I have tried 2 versions 16.2 and 18.4 but no luck Any thoughts ???

Hi Rob, first of all thanks a lot for this wonderful SDWAN course. I've one query, you downloaded and installed the root certificate of the CA on vManage CLI then again you copied the root CA certificate in vManage GUI and installed the same.. I'm wondering if both are the same things you're doing here..!!

Hi, Above commands only work on specific IOS version. I am using C3725-ADVENTERPRISEK9-M), Version 12.4(15)T14, in EVE -NG. Before doing configuration correct date and time of router else you will get errors when type command "crypto pki export PKI pem url flash:" like authentication error which have issue with wrong data and time on router.

BESTTTT

Hi Rob. Excellent video out there. I was wondering how can i access the GUI. I am stucked in that part i had configured everyhing according to the video. can you help thank you

With vManage version 20.3.3.1, I was able to progress up to 12:09, that is installing the certificate... eth1 IP is configured in the same subnet as the VM and it is reachable on ICMP... However, I am not able to load up the GUI... Any tips?

Thank you very much for this video that's very helpfull ! I have a question regarding the vBond IP address, does it have to be a public IP ? Because in Cisco documentation they say this is mandatory... but here you're using a Class C IP

I am getting a failed to generate CSR error now, no matter the image set version I use.

Hello Rob, thanks for the training. At time 34:12 you went back to the IOS-CA router to import the certificate from the vManager. The command you typed was "crypto pki server PKI request pkcs10 terminal" so you can import the cert. The router I'm using I can only type "crypto pki server PKI" the request is not there. The IOS version is 15.6. what verison of code you are using for the IOS-CA router?

Does anyone is getting the error "Failed to find device with uuid null" when installing the certificate on vManage?

Hey Rob i can not download Root cert chain from CA server what is the probelm?

Hi Rob, thanks for the video. I just loaded the lab diagram, turns out it shows a little bit different connection than yours, example, I got Gi0/9 --- to INET cloud, your video the port would be Gi0/7, did you made any changes? This is matters because the INET router Gi0/9 got no IP assigned yet it connected to cloud, is the router configuration really match the diagram, can help to explain that? Another quick question is, Mgmt cloud and Inet cloud all bond to EVE cloud0, I can see the settings but just make sure because use different name for the cloud but attached to same EVE cloud port.

Hi, i was having a problem with TFTP but it turned out i needed a synch'd NTP server. One question i have is what is the need to put the root certificate on the box via cli and then again via the GUI when doing the CSR?

Hi together, i tried to get the certificates installing , but there is no way always get error Jan-2022 16:48:30 UTC] Failed to process device request - Error type : application Error tag : operation-failed Error Message : log : Error: root-ca-chain unable to validate the certificate... Aborting ! Error info : install vmanage did work with http methode an did accept certificate but vbond isn´t, but used same methode connectivity is okay csr used via paste at ca certificate was granted but so far if i try to implement via install with vbond highligted get this error? Anyone an idea for that?

Hello Rob, thanks for uploading wonderful videos, need your small help as I am not able to install the PKI.ca in vManage and when tried to debug then no activity found on CA router even I tried to configure twice and following the same process, using same IOSv image for router and using vManage 18.4.4

My question is do we really need to request download the ca public cert from CA server on devices other than vManage ? when adding the controller under Configuration - Devices, the CSR should have been generated no matter you have uploaded and installed CA cert into the vBond and vSmart or not.

Hello, first of all thanks for your videos. Could you please share your DC-Switch configuration? Because, I did everything like you, but I cant ping from vBond any other devices.

what specs are you running on your pc? i would like to build a home lab

Hi Rob, I have been trying to use vmanage and access the GUI. I've tried to use five different versions of code with vManage but at login I can authenicate successfully but it will redrect my to login. I can upload vManage by importing the OVF to VMware workstation and login to access the GUI. I can't use my computer due to constrant in resources. I've uploaded it to my server but vmanage runs into a boot loop issue. I've posted this on cisco communities but so far nothing.

Hi, thank you so much for video, Is helping me get through a job interview. How is possible replicate your lab?? thank you so much

I am confused how you are able to hit the vManage web gui? My EVE-NG is a VM, and I can ssh to EVE-NG and see my pnet0 is tied to Eth1, but not seeing how to get the Gui to load...? I tried adding another nic to my VM on a different subnet and tied that nic to pnet2 and gave it an IP. Again I can't see any of this info outside of the VM to my local machine. How are you or anyone getting to the management cloud IP 10.255.1.110..?

Hello Rob I'm having a challenge getting controllers added on vManage. I have added vBond and vSmart but the hostname, system IP and site ID columns shows - also show control connection shows nothing

Rob, this command isn't working for my eve. database url flash: (On IOS-CA router) using ver: i86bi_LinuxL3-AdvEnterpriseK9-M2_15 Do you have any suggestions?

Hi Rob, not sure if you would be able to advise me on the below error I got when I was unshutting the CA server. I followed the exact steps as you stipulated. border-router(cs-server)#no shut %Some server settings cannot be changed after CA certificate generation. % There was a problem writing 'PKI.ser' to certificate storage. % Please verify storage accessibility % and enable the server again. border-router(cs-server)# *Jan 7 05:27:19.564: %PKI-3-CS_CRIT_STORAGE: Critical certificate server storage, flash0:PKI.ser, is inaccessible, server disabled. border-router(cs-server)# IOS version: border-router(cs-server)#do show ver | i IOS Cisco IOS Software, IOSv Software (VIOS-ADVENTERPRISEK9-M), Version 15.6(1)T, RELEASE SOFTWARE (fc1) ROM: Bootstrap program is IOSv Cisco IOSv (revision 1.0) with with 984313K/62464K bytes of memory. border-router(cs-server)# Thanks.

which software you use for presentation?

I have managed to bring up vBond, vSmart, and vManager but I am stuck to onboard the vEdge due missing .viptela file. I hope I could get .viptela file just for the lab sake :(

I keep getting this error when installing the cert on vMange Failed to retrieve device data Failed to find device with uuid null Any ideas? Have built lab again same issue thanks

Hi Rob when i try to generate certificate for vbond and vsmart and i copy CSR to CA ROUTER , and when press quit and this dont generate certificate which is already done for vManage. Any idea what is fix for this issue. Vsmart and Vbond already appear to vmanage but not showing system ip and site id for both but showing for vmanage.

Could u help understand how to configure IOS router as CA server for root certificate and CSR request to fullfill for vmanage ??

I am facing this Error : "Error: Not a valid certificate Failed to install the root certificate chain "

Hi Rob, can you advise why I am failing when installing CSR for vBond and also vSmart on the vManage? I spend many hours with repeating and trying to solve this :( Error type : application Error tag : operation-failed Error Message : log : Error: root-ca-chain unable to validate the certificate... Aborting ! ;;; I previously successfully installed the root certificate on all the controllers, I could see it in debugging on the IOS-CA ....

Hey rob why you do not reply our comments this is the third time that i want you ask a question that i can not download the root-cert-chain via tftp from my Root CA and you dont even care about our comments

I dont see any explanation for static routes added, just ruined the video

Do you guys receive these messages constantly on the CLI? vManage# Memory cgroup out of memory: Kill process 24918 (java) score 1054 or sacrifice child Killed process 25284 (controller) total-vm:63952kB, anon-rss:632kB, file-rss:7436kB, shmem-rss:0kB Memory cgroup out of memory: Kill process 24918 (java) score 1055 or sacrifice child Killed process 24918 (java) total-vm:3039196kB, anon-rss:520068kB, file-rss:31880kB, shmem-rss:0kB Memory cgroup out of memory: Kill process 26743 (java) score 1054 or sacrifice child Killed process 27103 (controller) total-vm:63952kB, anon-rss:632kB, file-rss:7436kB, shmem-rss:0kB Memory cgroup out of memory: Kill process 26743 (java) score 1055 or sacrifice child Killed process 26743 (java) total-vm:3039196kB, anon-rss:520084kB, file-rss:31856kB, shmem-rss:0kB

Hello Sir, How are you, I like you channel and recomend for every one its a very best channel for SDWAN learning, Sir if you don't mind could you shere this topology with me. thank you very much. CCIE # 47481 HCIE # 9339