Cisco Viptela SD-WAN

The central branch office has a 192.168.30.0/24 network with the SD-WAN appliance terminating the Anycast GRE tunnel.

The central branch office has a 192.168.30.0/24 network with the SD-WAN appliance terminating the Anycast IPsec tunnel.

For this example scenario, a non-default template for SIG-Branch was created.

To create a Secure Internet Gateway (SIG) using vManage:

1. From Cisco vManage under Configuration, click Generic and Add Tunnel.
2. Refer to the table below for the setting fields and their options.

Transport & Management VPN settings

Basic Information settings

When creating the Feature Template, you can choose values that apply globally or that are device specific. For example, the Tunnel Source IP Address, Interface Name and fields from Update Tunnel are device specific and should be chosen accordingly.

For this example scenario, a non-default template for SIG-Branch-IPsec-Template was created.

To create a Secure Internet Gateway (SIG) using vManage:

1. From Cisco vManage under Configuration, click Generic and Add Tunnel.
2. Refer to the table below for the setting fields and their options.

From vManage, click Configuration > Templates. You should see the newly created template where you will update the device values.

Because the template was created to add GRE tunnels, you only need to update the device values. Note that VPN0 is the default, and the WAN interface used to build the tunnel must be part of VPN0.

From vManage, click Configuration > Templates. You should see the newly created template where you will update the device values.

In the example below, the template is the GCP-Branch-Template. Note that VPN0 is the default, and the WAN interface used to build the tunnel needs to be part of VPN0.

Refer to Configure tunnel endpoints for more information on creating a GRE tunnel.

For additional information on creating IPsec tunnels, refer to API documentation for IPsec tunnels Open external link .

• X-Auth-Email: Your Cloudflare email ID
• X-Auth-Key: Seen in the URL (dash.cloudflare.com//….)
• Account key: Global API token in Cloudflare dashboard

1. Test new IPsec tunnel creation

   Request
   curl -X POST "https://api.cloudflare.com/client/v4/accounts/<account;_id>/magic/ipsec_tunnels?validate_only=true" \
        -H "X-Auth-Email: [email protected]" \
        -H "X-Auth-Key: XXXXXXXXXX" \
        -H "Content-Type: application/json" \
        --data '{"ipsec_tunnels":[{"name":"IPSec_cisco","customer_endpoint":"35.239.85.133","cloudflare_endpoint":"172.64.241.205","interface_address":"10.49.0.11/31","description":"Tunnel for Cisco 8000v"}]}'
   

2. Create new IPSec tunnel

   Request
   curl -X POST "https://api.cloudflare.com/client/v4/accounts/<account;_id>/magic/ipsec_tunnels?validate_only=true" \
        -H "X-Auth-Email: [email protected]" \
        -H "X-Auth-Key: XXXXXXXXXX" \
        -H "Content-Type: application/json" \
        --data '{"ipsec_tunnels":[{"name":"IPSec_cisco","customer_endpoint":"35.239.85.133","cloudflare_endpoint":"172.64.241.205","interface_address":"10.49.0.11/31","description":"Tunnel for Cisco 8000v"}]}'
   

   Response
   {
   "result": {
   "ipsec_tunnels": [
   {
   "id": "XXXXXXXXXX",
   "interface_address": "10.49.0.11/31",
   "created_on": "2022-05-03T23:03:19.104194Z",
   "modified_on": "2022-05-03T23:03:19.104194Z",
   "name": "IPsec_cisco",
   "cloudflare_endpoint": "172.64.241.205",
   "customer_endpoint": "35.239.85.133",
   "description": "Tunnel for Cisco 8000v",
   "health_check": {
   "enabled": true,
   "target": "35.239.85.133",
   "type": "reply"
   }
   }
   ]
   },
   "success": true,
   "errors": [],
   "messages": []
   }
   

3. Generate Pre Shared Key (PSK) for Tunnel

Use the tunnel ID from the response in Step 2. Save the pre-shared key generated in this step as you will need it to set up tunnels on the Orchestrator.

Request
curl -X POST "https://api.cloudflare.com/client/v4/accounts/<account;_id>/magic/ipsec_tunnels/<tunnel;_id>/psk_generate?validate_only=true" \
     -H "X-Auth-Email: [email protected]" \
     -H "X-Auth-Key: XXXXXXXXXX" \
     -H "Content-Type: application/json"

Response
{
"result": {
"ipsec_id": "<ipsec;_id>",
"ipsec_tunnel_id": "<tunnel;_id>",
"psk": "XXXXXXXXXX",
"psk_metadata": {
"last_generated_on": "2022-05-06T17:37:03.70965667Z"
}
},
"success": true,
"errors": [],
"messages": []
}

Refer to Configure static routes for more information on configuring your static routes.

Define static routes on the 8000v router so Cloudflare can route traffic between sites.

For the purpose of the tutorial, create a route for the subnet 10.1.2.0/24 on the GCP branch to be routed via the established IPSec tunnel between the 8000v appliance and Cloudflare

Refer to Configure static routes for more information on configuring your static routes.

In the example below, a request for neverssl.com was issued, which has a Cloudflare policy blocking traffic to neverssl.com.

On the client VM (192.168.30.3), a blocked response is visible.

A matching blocked log line is visible from the Cloudflare logs.

Validate east-west traffic

The example shows a client in AWS (10.1.2.23), which can ping the private IP of the router in GCP (192.168.30.3).

The traceroute shows the path going from the client (10.1.2.23)
→ to the AWS lan0 IP on the EdgeConnect (10.1.2.47)
→ to the Cloudflare private IPSec endpoint IP (10.0.0.10)
→ to the GCP private tunnel endpoint IP (10.49.0.10)
→ to the GCP workload (192.168.30.3).

This validates the east-west traffic flow through Cloudflare Magic WAN.

​To validate traffic flow from the local subnet through Cloudflare’s Secure Web Gateway, perform a curl as shown in the example below.

On the client VM (192.168.30.3), a blocked response is visible.

You can validate the request went through Gateway with the presence of the Cf-Team response header, or by looking at the logs in the dashboard under Logs > Gateway > HTTP.

You can also verify traffic flow through the established IPSec tunnel on the Cisco Device Dashboard > Interface.