{"id":91348,"date":"2020-08-12T07:42:24","date_gmt":"2020-08-12T05:42:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn"},"modified":"2020-08-12T07:42:24","modified_gmt":"2020-08-12T05:42:24","slug":"otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","title":{"rendered":"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Od augusta 2017, ke\u010f spolo\u010dnos\u0165 Cisco odk\u00fapila spolo\u010dnos\u0165 Viptela, sa hlavnou pon\u00fakanou technol\u00f3giou pre organizovanie distribuovan\u00fdch podnikov\u00fdch siet\u00ed stalo <b>Cisco SD-WAN<\/b>. V priebehu uplynul\u00fdch 3 rokov pre\u0161la technol\u00f3gia SD-WAN mnoh\u00fdmi zmenami, usmernen\u00fdmi ako kvalitat\u00edvnymi, tak aj kvantitat\u00edvnymi. V\u00fdrazne sa roz\u0161\u00edrili funk\u010dn\u00e9 mo\u017enosti a pridala sa podpora na klasick\u00fdch smerova\u010doch s\u00e9ri\u00ed <b>Cisco ISR 1000, ISR 4000, ASR 1000 a virtu\u00e1lnom CSR 1000v<\/b>. Z\u00e1rove\u0148 sa mnoh\u00ed z\u00e1kazn\u00edci a partneri Cisco na\u010falej p\u00fdtaj\u00fa \u2013 <i>v \u010dom spo\u010d\u00edvaj\u00fa rozdiely medzi Cisco SD-WAN a u\u017e zau\u017e\u00edvan\u00fdmi pr\u00edstupmi zalo\u017een\u00fdmi na tak\u00fdch technol\u00f3gi\u00e1ch, ako s\u00fa <b>Cisco DMVPN<\/b> a <b>Cisco Performance Routing<\/b> a ak\u00e9 s\u00fa tieto rozdiely d\u00f4le\u017eit\u00e9?<\/i> <\/p>\n<p>Tu je potrebn\u00e9 poznamena\u0165, \u017ee predt\u00fdm, ne\u017e sa technol\u00f3gia SD-WAN dostala do portf\u00f3lia Cisco, DMVPN spolu s PfR tvorili k\u013e\u00fa\u010dov\u00fa \u010das\u0165 v architekt\u00fare <b>Cisco IWAN (Intelligent WAN)<\/b>, ktor\u00e1 bola predchodcom plnohodnotnej technol\u00f3gie SD-WAN. Napriek v\u0161eobecn\u00e9mu prekryvu, ako v rie\u0161en\u00fdch \u00faloh\u00e1ch, tak aj v met\u00f3dach ich rie\u0161enia, IWAN nikdy nedosiahlo potrebn\u00fa \u00farove\u0148 automatiz\u00e1cie, flexibility a roz\u0161\u00edrite\u013enosti pre SD-WAN, a v priebehu \u010dasu sa rozvoj IWAN zna\u010dn\u00fdm sp\u00f4sobom spomalil. Technol\u00f3gie, ktor\u00e9 tvoria z\u00e1klad IWAN, v\u0161ak nezmizli, a mnoh\u00ed z\u00e1kazn\u00edci ich st\u00e1le \u00faspe\u0161ne pou\u017e\u00edvaj\u00fa aj na modernom vybaven\u00ed. Vznikla zauj\u00edmav\u00e1 situ\u00e1cia \u2013 to ist\u00e9 zariadenie Cisco umo\u017e\u0148uje vybra\u0165 najvhodnej\u0161iu technol\u00f3giu na vybudovanie WAN (klasick\u00fa, DMVPN+PfR alebo SD-WAN) v s\u00falade s po\u017eiadavkami a o\u010dak\u00e1vaniami z\u00e1kazn\u00edkov. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n\u010cl\u00e1nok nem\u00e1 v \u00famysle podrobne rozobera\u0165 v\u0161etky charakteristiky technol\u00f3gi\u00ed Cisco SD-WAN a DMVPN (spolu alebo bez Performance Routing) \u2013 na to je k dispoz\u00edcii obrovsk\u00e9 mno\u017estvo dostupn\u00fdch dokumentov a materi\u00e1lov. Hlavn\u00fdm cie\u013eom je pok\u00fasi\u0165 sa pos\u00fadi\u0165 k\u013e\u00fa\u010dov\u00e9 rozdiely t\u00fdchto technol\u00f3gi\u00ed. Predt\u00fdm, ne\u017e prejdeme k diskusii o t\u00fdchto rozdieloch, si v\u0161ak v kr\u00e1tkosti pripomenieme samotn\u00e9 technol\u00f3gie.<\/p>\n<h2>\u010co je Cisco DMVPN a na \u010do je potrebn\u00e9?<\/h2>\n<p>\nCisco DMVPN rie\u0161i \u00falohu dynamick\u00e9ho (=\u0161k\u00e1lovate\u013en\u00e9ho) pripojenia siete vzdialen\u00e9ho pobo\u010dky k sieti centr\u00e1lneho kancel\u00e1rie podniku pri pou\u017eit\u00ed r\u00f4znych typov komunika\u010dn\u00fdch kan\u00e1lov, vr\u00e1tane internetu (=s \u0161ifrovan\u00edm komunika\u010dn\u00e9ho kan\u00e1lu). Technicky to realizuje vytvoren\u00edm virtualizovanej nadstavbovej siete triedy L3. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sk\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"124\">VPN<\/a> v re\u017eime bod - mnohobody (point-to-multipoint) s logickou topol\u00f3giou typu \u201eHv\u011bzda\u201c (Hub-n-Spoke). Na to DMVPN vyu\u017e\u00edva kombin\u00e1ciu nasleduj\u00facich technol\u00f3gi\u00ed:<\/p>\n<ul>\n<li>IP smerovanie<\/li>\n<li>Multipoint GRE tunely (mGRE)<\/li>\n<li>Next Hop Resolution Protocol (NHRP)<\/li>\n<li>IPSec Crypto profily<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/a44d5ad8ed5dadd7fc9721002d8fa134.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAk\u00e9 s\u00fa hlavn\u00e9 v\u00fdhody Cisco DMVPN v porovnan\u00ed s klasick\u00fdm smerovan\u00edm pomocou MPLS VPN kan\u00e1lov?<\/p>\n<ul>\n<li>Na vytvorenie medzi-pobo\u010dkovej siete je mo\u017en\u00e9 pou\u017ei\u0165 ak\u00e9ko\u013evek komunika\u010dn\u00e9 kan\u00e1ly \u2013 vyhovuje v\u0161etko, \u010do dok\u00e1\u017ee zabezpe\u010di\u0165 IP-konektivitu medzi pobo\u010dkami, pri\u010dom prev\u00e1dzka bude \u0161ifrovan\u00e1 (kde treba) a vyv\u00e1\u017een\u00e1 (kde je to mo\u017en\u00e9).<\/li>\n<li>Automaticky sa vytv\u00e1ra plne prepojen\u00e1 topol\u00f3gia medzi pobo\u010dkami. Pri\u010dom medzi centr\u00e1lnymi a vzdialen\u00fdmi pobo\u010dkami \u2013 statick\u00e9 tunely a medzi vzdialen\u00fdmi pobo\u010dkami \u2013 dynamick\u00e9 tunely na po\u017eiadanie (pri existuj\u00facom prem\u00e1vke).<\/li>\n<li>Na smerova\u010doch centr\u00e1lnej a vzdialen\u00fdch pobo\u010diek rovnak\u00e1 konfigur\u00e1cia s presnos\u0165ou na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sk\/lir\/ipv4\/\"   title=\"IP adresy\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"820\">IP adresy<\/a> rozhrania. V\u010faka pou\u017eitiu mGRE nie je potrebn\u00e1 individu\u00e1lna konfigur\u00e1cia desiatok, stoviek alebo dokonca tis\u00edcok tunelov. Ako d\u00f4sledok, slu\u0161n\u00e1 \u0161k\u00e1lovate\u013enos\u0165 pri spr\u00e1vnom dizajne.<\/li>\n<\/ul>\n<p><\/p>\n<h2>\u010co je Cisco Performance Routing a na \u010do je potrebn\u00fd?<\/h2>\n<p>\nPri pou\u017eit\u00ed DMVPN na medzi-pobo\u010dkovej sieti zost\u00e1va nevyrie\u0161en\u00e1 jedna nesmierne d\u00f4le\u017eit\u00e1 ot\u00e1zka \u2013 ako dynamicky vyhodnoti\u0165 stav ka\u017ed\u00e9ho z DMVPN tunelov z h\u013eadiska s\u00faladu s po\u017eiadavkami kritickej prev\u00e1dzky pre na\u0161u organiz\u00e1ciu a op\u00e4\u0165 na z\u00e1klade tohto vyhodnotenia dynamicky rozhodova\u0165 o reroutingu? Ide o to, \u017ee DMVPN v tejto oblasti sa len m\u00e1lo l\u00ed\u0161i od klasick\u00e9ho smerovania \u2013 najlep\u0161ie, \u010do m\u00f4\u017eete urobi\u0165, je nastavi\u0165 mechanizmy QoS, ktor\u00e9 umo\u017e\u0148uj\u00fa prioritizova\u0165 prev\u00e1dzku v odch\u00e1dzaj\u00facom smere, ale nijako nezoh\u013ead\u0148uj\u00fa stav celej cesty v danom momente.<\/p>\n<p>A \u010do robi\u0165, ak je kan\u00e1l \u010diasto\u010dne degradovan\u00fd, a nie \u00faplne \u2013 ako to zisti\u0165 a vyhodnoti\u0165? DMVPN to samo o sebe nezvl\u00e1dne. Ke\u010f\u017ee kan\u00e1ly sp\u00e1jaj\u00face pobo\u010dky m\u00f4\u017eu prech\u00e1dza\u0165 cez r\u00f4znych poskytovate\u013eov slu\u017eieb, vyu\u017e\u00edvaj\u00fac pritom r\u00f4zne technol\u00f3gie, t\u00e1to \u00faloha sa st\u00e1va mimoriadne zlo\u017eitou. A pr\u00e1ve tu prich\u00e1dza na pomoc technol\u00f3gia Cisco Performance Routing, ktor\u00e1 do tej doby pre\u0161la nieko\u013ek\u00fdmi f\u00e1zami v\u00fdvoja.<\/p>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/be885ce87f36c143be1450c7e8587701.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00dalohou Cisco Performance Routing (\u010falej len PfR) je meranie stavu ciest (tunelov) prenosu d\u00e1t na z\u00e1klade k\u013e\u00fa\u010dov\u00fdch metr\u00edk d\u00f4le\u017eit\u00fdch pre sie\u0165ov\u00e9 aplik\u00e1cie \u2013 <b>latencia, variabilita latencie (jitter) a strata paketov (v percent\u00e1ch)<\/b>. Okrem toho m\u00f4\u017ee by\u0165 meran\u00e1 aj vyu\u017e\u00edvan\u00e1 \u0161\u00edrka p\u00e1sma. Tieto merania prebiehaj\u00fa \u010do najbli\u017e\u0161ie k re\u00e1lnemu \u010dasu (pokia\u013e je to mo\u017en\u00e9 a opodstatnen\u00e9) a v\u00fdsledok t\u00fdchto meran\u00ed umo\u017e\u0148uje smerova\u010du, ktor\u00fd pou\u017e\u00edva PfR, dynamicky prij\u00edma\u0165 rozhodnutia o potrebe zmeny smerovania ur\u010dit\u00fdch typov d\u00e1t.<\/p>\n<p>Tak\u017ee \u00falohu kombin\u00e1cie DMVPN\/PfR m\u00f4\u017eeme stru\u010dne charakterizova\u0165 nasledovne:<\/p>\n<ul>\n<li>Umo\u017eni\u0165 z\u00e1kazn\u00edkovi pou\u017e\u00edva\u0165 na WAN sie\u0165 ak\u00e9ko\u013evek komunika\u010dn\u00e9 kan\u00e1ly<\/li>\n<li>Zabezpe\u010di\u0165 maxim\u00e1lne mo\u017en\u00e9 kvality d\u00f4le\u017eit\u00fdch aplik\u00e1ci\u00ed na t\u00fdchto kan\u00e1loch<\/li>\n<\/ul>\n<p><\/p>\n<h2>\u010co je Cisco SD-WAN?<\/h2>\n<p>\nCisco SD-WAN je technol\u00f3gia, ktor\u00e1 vyu\u017e\u00edva pr\u00edstup SDN na vytvorenie a prev\u00e1dzkovanie WAN siete organiz\u00e1cie. To konkr\u00e9tne znamen\u00e1 vyu\u017e\u00edvanie takzvan\u00fdch kontrolerov (softv\u00e9rov\u00fdch komponentov), ktor\u00e9 zabezpe\u010duj\u00fa centralizovan\u00fa orchestru a automatizovan\u00e9 nastavenie v\u0161etk\u00fdch komponentov rie\u0161enia. Na rozdiel od kanonick\u00e9ho SDN (v \u0161t\u00fdle Clean Slate) sa v Cisco SD-WAN pou\u017e\u00edva nieko\u013eko typov kontrolerov, z ktor\u00fdch ka\u017ed\u00fd vykon\u00e1va svoju \u00falohu \u2013 to bolo z\u00e1merne uroben\u00e9 s cie\u013eom zabezpe\u010di\u0165 lep\u0161iu \u0161k\u00e1lovate\u013enos\u0165 a geo-rezervovanie.<\/p>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/555191e4b49b2b473bee72cdf118a328.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV pr\u00edpade SD-WAN zost\u00e1va \u00faloha vyu\u017e\u00edvania ak\u00fdchko\u013evek typov kan\u00e1lov a zabezpe\u010denia fungovania biznis aplik\u00e1ci\u00ed, ale z\u00e1rove\u0148 sa roz\u0161iruj\u00fa po\u017eiadavky na automatiz\u00e1ciu, \u0161k\u00e1lovate\u013enos\u0165, bezpe\u010dnos\u0165 a flexibilitu takejto siete.<\/p>\n<h2>Diskusia o rozdieloch<\/h2>\n<p>\nAk teraz za\u010dneme analyzova\u0165 rozdiely t\u00fdchto technol\u00f3gi\u00ed, bud\u00fa spada\u0165 do jednej z kateg\u00f3ri\u00ed:<\/p>\n<ul>\n<li>Architektonick\u00e9 rozdiely \u2013 ako s\u00fa rozdelen\u00e9 funkcie medzi r\u00f4zne komponenty rie\u0161enia, ako je organizovan\u00e1 interakcia t\u00fdchto komponentov a ako to ovplyv\u0148uje mo\u017enosti a flexibilitu technol\u00f3gie?<\/li>\n<li>Funk\u010dn\u00e9 mo\u017enosti \u2013 \u010do m\u00f4\u017ee jedna technol\u00f3gia, \u010do in\u00e1 nem\u00f4\u017ee? Je to naozaj tak\u00e9 d\u00f4le\u017eit\u00e9?<\/li>\n<\/ul>\n<p><\/p>\n<h3>V \u010dom spo\u010d\u00edvaj\u00fa architektonick\u00e9 rozdiely a s\u00fa naozaj d\u00f4le\u017eit\u00e9?<\/h3>\n<p>\nV ka\u017edej z uveden\u00fdch technol\u00f3gi\u00ed existuje mno\u017estvo \u201epohybuj\u00facich sa \u010dast\u00ed\u201c, ktor\u00e9 sa l\u00ed\u0161ia nielen rolou, ale aj princ\u00edpmi vz\u00e1jomnej interakcie. Na tom, ako dobre s\u00fa tieto princ\u00edpy premyslen\u00e9, priamo z\u00e1vis\u00ed \u0161k\u00e1lovate\u013enos\u0165, odolnos\u0165 vo\u010di poruch\u00e1m a celkov\u00e1 efekt\u00edvnos\u0165 rie\u0161enia. <\/p>\n<p>Pozrime sa podrobnej\u0161ie na r\u00f4zne aspekty architekt\u00fary:<\/p>\n<p><b>Data-plane<\/b> \u2013 \u010das\u0165 rie\u0161enia zodpovedaj\u00faca za prenos pou\u017e\u00edvate\u013esk\u00e9ho prev\u00e1dzky medzi zdrojom a pr\u00edjemcom. V DMVPN a SD-WAN sa realizuje vo v\u0161eobecnosti rovnak\u00fdm sp\u00f4sobom na samotn\u00fdch smerova\u010doch na b\u00e1ze Multipoint GRE tunelov. Rozdiel je v tom, na \u010dom sa zaklad\u00e1 potrebn\u00e1 sada parametrov t\u00fdchto tunelov:<\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> \u2013 ide o striktne dvoj\u00farov\u0148ov\u00fa hierarchiu uzlov s topol\u00f3giou typu \u201eHv\u011bzda\u201c alebo Hub-n-Spoke. Statick\u00e1 konfigur\u00e1cia Hubu a statick\u00e1 v\u00e4zba Spoke na Hub s\u00fa povinn\u00e9, rovnako ako interakcia cez protokol NHRP na vytvorenie data-plane konektivity. V d\u00f4sledku toho <b>s\u00fa zmeny na Hube zna\u010dn\u011b s\u0165a\u017een\u00e9<\/b>, t\u00fdkaj\u00face sa napr\u00edklad zmeny\/pripojenia nov\u00fdch WAN kan\u00e1lov alebo zmeny parametrov existuj\u00facich.<\/li>\n<li>v <b>SD-WAN<\/b> \u2013 ide o plne dynamick\u00fd model zis\u0165ovania parametrov nastaven\u00fdch tunelov s d\u00f4razom na control-plane (protokol OMP) a orchestration-plane (interakcia s ovl\u00e1da\u010dom vBond na \u00falohy zis\u0165ovania ovl\u00e1da\u010dov a NAT traversal). Pri tom m\u00f4\u017eu by\u0165 ak\u00e9ko\u013evek dan\u00e9 topol\u00f3gie, vr\u00e1tane hierarchick\u00fdch. V r\u00e1mci stanoven\u00e9ho pridelen\u00e9ho tunelov\u00e9ho topol\u00f3gie je mo\u017en\u00e1 flexibiln\u00e1 konfigur\u00e1cia logickej topol\u00f3gie v ka\u017edom jednotlivom VPN (VRF).<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/21c65d83989db5975ca87c90fed3b476.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Control-plane<\/b> \u2013 funkcie v\u00fdmeny, filtrovania a modifik\u00e1cie smerovej a inej inform\u00e1cie medzi komponentmi rie\u0161enia. <\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> \u2013 sa realizuje iba medzi smerova\u010dmi Hub a Spoke. Priama v\u00fdmena smerovej inform\u00e1cie medzi Spoke nie je mo\u017en\u00e1. V d\u00f4sledku toho <b>bez funk\u010dn\u00e9ho Hubu nie je mo\u017en\u00e9 fungovanie control-plane a data-plane.<\/b>, \u010do kladie na Hub dodato\u010dn\u00e9 po\u017eiadavky na vysok\u00fa dostupnos\u0165, ktor\u00e9 nie v\u017edy m\u00f4\u017eu by\u0165 splnen\u00e9.<\/li>\n<li>v <b>SD-WAN<\/b> \u2013 riadenie pl\u00e1nom sa nikdy nevykon\u00e1va priamo medzi smerova\u010dmi \u2013 interakcia prebieha na z\u00e1klade protokolu OMP a mus\u00ed sa zabezpe\u010di\u0165 prostredn\u00edctvom \u0161peci\u00e1lneho typu ovl\u00e1da\u010da vSmart, \u010do umo\u017e\u0148uje vyv\u00e1\u017eenie, geo-z\u00e1lohovanie a centralizovan\u00e9 riadenie sign\u00e1lnej z\u00e1\u0165a\u017ee. \u010eal\u0161ou \u010drtou protokolu OMP je jeho zna\u010dn\u00e1 odolnos\u0165 vo\u010di strat\u00e1m a nez\u00e1vislos\u0165 od r\u00fdchlosti spojenia s ovl\u00e1da\u010dmi (v rozumn\u00fdch medziach, samozrejme). To umo\u017e\u0148uje \u00faspe\u0161ne umiestni\u0165 ovl\u00e1da\u010de SD-WAN v verejn\u00fdch alebo s\u00fakromn\u00fdch cloudov\u00fdch prostrediach s pr\u00edstupom cez internet.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/fd77c23b005705a9f8857d23a430ca7d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Politikov\u00e1 vrstva<\/b> \u2013 \u010das\u0165 rie\u0161enia, ktor\u00e1 je zodpovedn\u00e1 za definovanie, \u0161\u00edrenie a aplik\u00e1ciu politiky riadenia prev\u00e1dzky v distribuovanej sieti.<\/p>\n<ul>\n<li><b>DMVPN <\/b>\u2013 v skuto\u010dnosti je obmedzen\u00e9 politikami kvality slu\u017eieb (QoS), ktor\u00e9 s\u00fa nastavovan\u00e9 individu\u00e1lne na ka\u017edom smerova\u010di prostredn\u00edctvom CLI alebo \u0161abl\u00f3n Prime Infrastructure.<\/li>\n<li><b>DMVPN\/PfR<\/b> \u2013 politiky PfR s\u00fa vytv\u00e1ran\u00e9 na centralizovanom smerova\u010di Master Controller (MC) prostredn\u00edctvom CLI a potom sa automaticky \u0161\u00edria do pobo\u010dkov\u00fdch MC. Pri tom sa pou\u017e\u00edvaj\u00fa tie ist\u00e9 prenosov\u00e9 cesty polit\u00edk ako pre d\u00e1tov\u00fa vrstvu. Nie je mo\u017en\u00e9 rozlo\u017ei\u0165 v\u00fdmenu polit\u00edk, mapov\u00fdch inform\u00e1ci\u00ed a pou\u017e\u00edvate\u013esk\u00fdch d\u00e1t. \u0160\u00edrenie polit\u00edk predpoklad\u00e1 nutn\u00fa existenciu IP konektivity medzi Hub a Spoke. Funkcia MC m\u00f4\u017ee by\u0165 v pr\u00edpade potreby kombinovan\u00e1 s DMVPN smerova\u010dom. Je mo\u017en\u00e9 (ale nie povinn\u00e9) pou\u017ei\u0165 \u0161abl\u00f3ny Prime Infrastructure na centralizovan\u00e9 vytv\u00e1ranie polit\u00edk. D\u00f4le\u017eitou \u010drtou je, \u017ee politika je tvoren\u00ed glob\u00e1lne na celej sieti rovnako \u2013 <b>individu\u00e1lne politiky pre jednotliv\u00e9 segmenty nie s\u00fa podporovan\u00e9<\/b>.<\/li>\n<li><b>SD-WAN<\/b> \u2013 politiky spr\u00e1vy toku a kvality slu\u017eieb s\u00fa definovan\u00e9 centralizovane cez grafick\u00e9 rozhranie Cisco vManage, ktor\u00e9 je dostupn\u00e9 aj cez Internet (ak je to potrebn\u00e9). Roz\u0161iruj\u00fa sa prostredn\u00edctvom sign\u00e1lnych kan\u00e1lov priamo alebo nepriamo cez ovl\u00e1da\u010de vSmart (z\u00e1vis\u00ed od typu politiky). Nez\u00e1vis\u00ed od konektivity d\u00e1tovej vrstvy medzi smerova\u010dmi, preto\u017ee vyu\u017e\u00edvaj\u00fa v\u0161etky dostupn\u00e9 trasy prenosu toku medzi ovl\u00e1da\u010dom a smerova\u010dom.\n<p>Pre r\u00f4zne segmenty siete je mo\u017en\u00e9 flexibilne tvori\u0165 r\u00f4zne politiky \u2013 sf\u00e9ra pou\u017eitia politiky je definovan\u00e1 mno\u017estvom unik\u00e1tnych identifik\u00e1torov, ktor\u00e9 s\u00fa zahrnut\u00e9 v rie\u0161en\u00ed \u2013 \u010d\u00edslo pobo\u010dky, typ aplik\u00e1cie, smerovanie toku a pod.\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/ae897e83bf8a8be876af767f847d5cde.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Orchestr\u00e1cia plocha<\/b> \u2013 mechanizmy, ktor\u00e9 umo\u017e\u0148uj\u00fa komponentom dynamicky sa objavi\u0165, nakonfigurova\u0165 a koordinova\u0165 n\u00e1sledn\u00fa interakciu.<\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> vz\u00e1jomn\u00e9 objavovanie medzi smerova\u010dmi je zalo\u017een\u00e9 na statickej konfigur\u00e1cii zariaden\u00ed Hub a pr\u00edslu\u0161nej konfigur\u00e1cii zariaden\u00ed Spoke. Dynamick\u00e9 objavovanie sa uskuto\u010d\u0148uje len pre Spoke, ktor\u00fd oznamuje svoje parametre pripojenia zariadeniu Hub, ktor\u00e9 je vopred zahrnut\u00e9 do konfigur\u00e1cie Spoke. <b>Bez IP-konektivity Spoke aspo\u0148 s jedn\u00fdm Hub nie je mo\u017en\u00e9 vytvori\u0165 ani d\u00e1tov\u00fa, ani kontroln\u00fa rovinu.<\/b><\/li>\n<li>v <b>SD-WAN<\/b> Orchestr\u00e1cia komponentov rie\u0161enia prebieha s pou\u017eit\u00edm ovl\u00e1da\u010da vBond, s ktor\u00fdm mus\u00ed ma\u0165 ka\u017ed\u00fd komponent (smerova\u010de a ovl\u00e1da\u010de vManage\/vSmart) vopred nastaven\u00fa IP-konektivitu.\n<p>P\u00f4vodne komponenty nepoznaj\u00fa parametre pripojenia medzi sebou \u2013 na to potrebuj\u00fa prostredn\u00edka-orchestr\u00e1tora vBond. V\u0161eobecn\u00fd princ\u00edp je nasleduj\u00faci \u2013 ka\u017ed\u00fd komponent v po\u010diato\u010dnej f\u00e1ze zist\u00ed (automaticky alebo staticky) len parametre pripojenia k vBond, potom vBond informuje smerova\u010d o ovl\u00e1da\u010doch vManage a vSmart (predt\u00fdm objaven\u00fdch), \u010do umo\u017e\u0148uje automatick\u00e9 nadviazanie v\u0161etk\u00fdch potrebn\u00fdch sign\u00e1lnych spojen\u00ed. <\/p>\n<p>Nasleduj\u00faci krok nov\u00e9ho smerova\u010da je z\u00edska\u0165 inform\u00e1cie o ostatn\u00fdch smerova\u010doch v sieti prostredn\u00edctvom OMP v\u00fdmeny s ovl\u00e1da\u010dom vSmart. Takto dok\u00e1\u017ee smerova\u010d, ktor\u00fd zo za\u010diatku v\u00f4bec nevie o parametroch siete, \u00faplne automaticky zisti\u0165 a pripoji\u0165 sa k ovl\u00e1da\u010dom a potom takisto automaticky zisti\u0165 a vytvori\u0165 konektivitu s ostatn\u00fdmi smerova\u010dmi. Pri tom s\u00fa parametre pripojen\u00ed v\u0161etk\u00fdch komponentov na za\u010diatku nezn\u00e1me a po\u010das prev\u00e1dzky sa m\u00f4\u017eu meni\u0165.\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/19cae5336892c6fa9140b09c124123a7.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Management-plane<\/b> \u2013 \u010das\u0165 rie\u0161enia, ktor\u00e1 zabezpe\u010duje centralizovan\u00e9 riadenie a monitoring.<\/p>\n<ul>\n<li><b>DMVPN\/PfR<\/b> \u2013 \u0161pecializovan\u00e9 management-plane rie\u0161enie nie je predpokladan\u00e9. Pre z\u00e1kladn\u00fa automatiz\u00e1ciu a monitoring je mo\u017en\u00e9 vyu\u017eitie tak\u00fdch produktov, ako je Cisco Prime Infrastructure. Ka\u017ed\u00fd smerova\u010d m\u00e1 mo\u017enos\u0165 riadenia cez pr\u00edkazov\u00fd riadok CLI. <b>Integr\u00e1cie s extern\u00fdmi syst\u00e9mami cez API nie s\u00fa predpokladan\u00e9.<\/b><\/li>\n<li><b>SD-WAN<\/b> \u2013 v\u0161etka \u0161tandardn\u00e1 interakcia a monitoring sa realizuje centralizovane prostredn\u00edctvom grafick\u00e9ho rozhrania ovl\u00e1da\u010da vManage. V\u0161etky funkcie rie\u0161enia s\u00fa dostupn\u00e9 na konfigur\u00e1ciu prostredn\u00edctvom vManage, ako aj prostredn\u00edctvom \u00faplne zdokumentovanej kni\u017enice programov\u00e9ho rozhrania REST API.\n<p>V\u0161etky nastavenia SD-WAN siete v vManage sa redukuj\u00fa na dva hlavn\u00e9 kon\u0161trukty \u2013 tvorba \u0161abl\u00f3n zariaden\u00ed (Device Template) a tvorba politiky, ktor\u00e1 ur\u010duje logiku fungovania siete a spracovania prev\u00e1dzky. Pri tom vManage, pri\u010dom preklad\u00e1 vytvoren\u00fa administr\u00e1torom politiku, automaticky vyber\u00e1, ak\u00e9 zmeny a na ktor\u00fdch individu\u00e1lnych zariadeniach\/ovl\u00e1da\u010doch je potrebn\u00e9 vykona\u0165, \u010do v\u00fdrazne zvy\u0161uje efekt\u00edvnos\u0165 a \u0161k\u00e1lovate\u013enos\u0165 rie\u0161enia.<\/p>\n<p>Cez rozhranie vManage je pr\u00edstupn\u00e1 nielen konfigur\u00e1cia rie\u0161enia Cisco SD-WAN, ale aj plnohodnotn\u00fd monitoring stavu v\u0161etk\u00fdch komponentov rie\u0161enia, a\u017e po aktu\u00e1lny stav metr\u00edk jednotliv\u00fdch tunelov a \u0161tatistiky vyu\u017e\u00edvania r\u00f4znych aplik\u00e1ci\u00ed na z\u00e1klade DPI anal\u00fdzy.<\/p>\n<p>Napriek centraliz\u00e1cii interakcie, v\u0161etky komponenty (kontrol\u00e9ry a smerova\u010de) maj\u00fa tie\u017e plne funk\u010dn\u00fd pr\u00edkazov\u00fd riadok CLI, ktor\u00fd je potrebn\u00fd v f\u00e1ze implement\u00e1cie alebo v pr\u00edpade n\u00fadzovej situ\u00e1cie na miestnu diagnostiku. V norm\u00e1lnom re\u017eime (pri existencii sign\u00e1lneho kan\u00e1la medzi komponentmi) je pr\u00edkazov\u00fd riadok na smerova\u010doch dostupn\u00fd iba na diagnostiku a nie na vykon\u00e1vanie lok\u00e1lnych zmien, \u010do zaru\u010duje lok\u00e1lnu bezpe\u010dnos\u0165 a jedin\u00fd zdroj zmien v takejto sieti \u2013 vManage.<\/li>\n<\/ul>\n<p>\n<b>Integrovan\u00e1 bezpe\u010dnos\u0165<\/b> \u2013 tu by sa malo hovori\u0165 nielen o ochrane pou\u017e\u00edvate\u013esk\u00fdch \u00fadajov pri prenose cez otvoren\u00e9 kan\u00e1ly, ale aj o celkovej bezpe\u010dnosti WAN siete na z\u00e1klade zvolenej technol\u00f3gie.<\/p>\n<ul>\n<li>v <b>DMVPN\/PfR<\/b> predpoklad\u00e1 sa mo\u017enos\u0165 \u0161ifrovania pou\u017e\u00edvate\u013esk\u00fdch \u00fadajov a sign\u00e1lnych protokolov. Pri pou\u017e\u00edvan\u00ed konkr\u00e9tnych modelov smerova\u010dov s\u00fa dodato\u010dne k dispoz\u00edcii funkcie firewallu s in\u0161pekciou prev\u00e1dzky, IPS\/IDS. Existuje mo\u017enos\u0165 segment\u00e1cie pobo\u010dkov\u00fdch siet\u00ed pomocou VRF. Mo\u017enos\u0165 autentiz\u00e1cie (jednofaktorovej) kontroln\u00fdch protokolov.\n<p>V tomto pr\u00edpade je vzdialen\u00fd smerova\u010d predvolene pova\u017eovan\u00fd za d\u00f4veryhodn\u00fd prvok siete \u2013 t.j. nie s\u00fa predpokladan\u00e9 a nezoh\u013ead\u0148uj\u00fa sa pr\u00edpady fyzickej kompromit\u00e1cie jednotliv\u00fdch zariaden\u00ed a mo\u017enos\u0165 neopr\u00e1vnen\u00e9ho pr\u00edstupu k nim, neexistuje dvojfaktorov\u00e1 autentiz\u00e1cia komponentov rie\u0161enia, \u010do v pr\u00edpade geograficky distribuovanej siete <b>m\u00f4\u017ee predstavova\u0165 v\u00e1\u017ene dodato\u010dn\u00e9 rizik\u00e1.<\/b> <\/li>\n<li>v <b>SD-WAN<\/b> Analogicky k DMVPN je predpokladan\u00e1 mo\u017enos\u0165 \u0161ifrovania pou\u017e\u00edvate\u013esk\u00fdch \u00fadajov, ale so zna\u010dne roz\u0161\u00edren\u00fdmi funkciami sie\u0165ovej bezpe\u010dnosti a L3\/VRF segment\u00e1ciou (MC, IPS\/IDS, URL filtrovanie, DNS filtrovanie, AMP\/TG, SASE, TLS\/SSL proxy a pod.). Pri tom sa v\u00fdmena \u0161ifrovac\u00edch k\u013e\u00fa\u010dov uskuto\u010d\u0148uje efekt\u00edvnej\u0161ie cez vSmart kontrol\u00e9ry (a nie priamo), po vopred stanoven\u00fdch sign\u00e1lnych kan\u00e1loch, chr\u00e1nen\u00fdch DTLS\/TLS \u0161ifrovan\u00edm na z\u00e1klade bezpe\u010dnostn\u00fdch certifik\u00e1tov. To zaru\u010duje bezpe\u010dnos\u0165 takejto v\u00fdmeny a poskytuje lep\u0161iu \u0161k\u00e1lovate\u013enos\u0165 rie\u0161enia a\u017e pre desiatky tis\u00edc zariaden\u00ed v jednej sieti.\n<p>V\u0161etky sign\u00e1lne spojenia (kontrol\u00e9r-kontrol\u00e9r, kontrol\u00e9r smerova\u010d) s\u00fa tie\u017e chr\u00e1nen\u00e9 na z\u00e1klade DTLS\/TLS. Smerova\u010de s\u00fa pri v\u00fdrobe vybaven\u00e9 bezpe\u010dnostn\u00fdmi certifik\u00e1tmi s mo\u017enos\u0165ou v\u00fdmeny\/obnovenia. Dvojak\u00e1 autentifik\u00e1cia sa dosahuje povinn\u00fdm a s\u00fa\u010dasn\u00fdm splnen\u00edm dvoch podmienok pre funk\u010dnos\u0165 smerova\u010da\/kontrol\u00e9ra v SD-WAN sieti:<\/p>\n<ul>\n<li>Aktu\u00e1lny bezpe\u010dnostn\u00fd certifik\u00e1t<\/li>\n<li>Explicitn\u00e9 a vedom\u00e9 zaradenie ka\u017ed\u00e9ho komponentu administr\u00e1torom do \u201ebieleho\u201c zoznamu povolen\u00fdch zariaden\u00ed.<\/li>\n<\/ul>\n<p>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/13191eb92f25094112471a0ff3855cac.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>Funk\u010dn\u00e9 rozdiely medzi SD-WAN a DMVPN\/PfR<\/h2>\n<p>\nPri prechode k diskusii funk\u010dn\u00fdch rozdielov je potrebn\u00e9 poznamena\u0165, \u017ee mnoh\u00e9 z nich s\u00fa pokra\u010dovan\u00edm architektonick\u00fdch - nie je tajomstvom, \u017ee pri formovan\u00ed architekt\u00fary rie\u0161enia sa v\u00fdvoj\u00e1ri odvol\u00e1vaj\u00fa na tie mo\u017enosti, ktor\u00e9 chc\u00fa nakoniec z\u00edska\u0165. Po\u010fme si pribl\u00ed\u017ei\u0165 najv\u00fdznamnej\u0161ie rozdiely dvoch technol\u00f3gi\u00ed.<\/p>\n<h3>AppQ (Kvalita aplik\u00e1cie) \u2013 funkcie zais\u0165ovania kvality prenosu prev\u00e1dzky obchodn\u00fdch aplik\u00e1ci\u00ed<\/h3>\n<p>\nK\u013e\u00fa\u010dov\u00e9 funkcie predmetn\u00fdch technol\u00f3gi\u00ed s\u00fa zameran\u00e9 na to, aby sa \u010do najviac zlep\u0161il pou\u017e\u00edvate\u013esk\u00fd z\u00e1\u017eitok pri pou\u017e\u00edvan\u00ed obchodne kritick\u00fdch aplik\u00e1ci\u00ed v distribuovan\u00fdch sie\u0165ach. To je obzvl\u00e1\u0161\u0165 d\u00f4le\u017eit\u00e9 v podmienkach, ke\u010f \u010das\u0165 infra\u0161trukt\u00fary nie je pod kontrolou IT alebo dokonca nezaru\u010duje \u00faspe\u0161n\u00fd prenos \u00fadajov.<\/p>\n<p>DMVPN s\u00e1m o sebe neposkytuje tak\u00e9to mechanizmy. Najlep\u0161ie, \u010do je mo\u017en\u00e9 urobi\u0165 v klasickej DMVPN sieti, je klasifikova\u0165 odch\u00e1dzaj\u00facu prev\u00e1dzku pod\u013ea aplik\u00e1ci\u00ed a priorizova\u0165 ju pri prenose smerom k WAN kan\u00e1lu. V\u00fdber DMVPN tunela je v tomto pr\u00edpade zalo\u017een\u00fd len na jeho dostupnosti a v\u00fdsledku pr\u00e1ce smerovac\u00edch protokolov. Pri tom sa nijako nezoh\u013ead\u0148uje celkov\u00fd stav cesty\/tunela a jeho mo\u017en\u00e1 \u010diasto\u010dn\u00e1 degrad\u00e1cia z h\u013eadiska k\u013e\u00fa\u010dov\u00fdch metr\u00edk d\u00f4le\u017eit\u00fdch pre sie\u0165ov\u00e9 aplik\u00e1cie \u2013 oneskorenie, variabilita oneskorenia (jitter) a strata (%). V s\u00favislosti s t\u00fdm priamo porovn\u00e1va\u0165 klasick\u00fd DMVPN so SD-WAN \u010do sa t\u00fdka rie\u0161enia \u00faloh AppQ str\u00e1ca zmysel \u2013 DMVPN t\u00fato \u00falohu nem\u00f4\u017ee vyrie\u0161i\u0165. Po pridan\u00ed technol\u00f3gie Cisco Performance Routing (PfR) do tohto kontextu sa situ\u00e1cia men\u00ed a porovnanie s Cisco SD-WAN sa st\u00e1va rozumnej\u0161\u00edm. <\/p>\n<p>Predt\u00fdm, ne\u017e prejdeme k diskusii o rozdieloch, stru\u010dne o tom, v \u010dom s\u00fa tieto technol\u00f3gie podobn\u00e9. Tak\u017ee obidve technol\u00f3gie:<\/p>\n<ul>\n<li>maj\u00fa mechanizmus, ktor\u00fd umo\u017e\u0148uje dynamicky hodnoti\u0165 stav ka\u017ed\u00e9ho nain\u0161talovan\u00e9ho tunela na z\u00e1klade ur\u010dit\u00fdch metr\u00edk \u2013 minim\u00e1lne oneskorenie, vari\u00e1cia oneskorenia a strata paketov (%).<\/li>\n<li>pou\u017e\u00edvaj\u00fa ur\u010dit\u00fa sadu n\u00e1strojov na vytv\u00e1ranie, \u0161\u00edrenie a aplik\u00e1ciu pravidiel (polit\u00edk) na spr\u00e1vu prev\u00e1dzky s oh\u013eadom na v\u00fdsledky merania stavu k\u013e\u00fa\u010dov\u00fdch metr\u00edk tunelov.<\/li>\n<li>klasifikuj\u00fa prev\u00e1dzku aplik\u00e1ci\u00ed na \u00farovniach L3-L4 (DSCP) modelu OSI alebo pod\u013ea L7 signat\u00far aplik\u00e1ci\u00ed na z\u00e1klade zabudovan\u00fdch mechanizmov DPI v smerova\u010di.<\/li>\n<li>umo\u017e\u0148uj\u00fa pre v\u00fdznamn\u00e9 aplik\u00e1cie stanovi\u0165 akceptovate\u013en\u00e9 prahov\u00e9 hodnoty metr\u00edk, predvolen\u00e9 pravidl\u00e1 prenosu prev\u00e1dzky a pravidl\u00e1 pre preusporiadanie prev\u00e1dzky pri prekro\u010den\u00ed prahov\u00fdch hodn\u00f4t.<\/li>\n<li>pri enkapsul\u00e1cii prev\u00e1dzky v GRE\/IPSec pou\u017e\u00edvaj\u00fa u\u017e etablovan\u00fd v odvetv\u00ed mechanizmus prenosu vn\u00fatornej zna\u010dky DSCP do vonkaj\u0161ieho GRE\/IPSec hlavi\u010dky paketu, \u010do umo\u017e\u0148uje synchronizova\u0165 politiky QoS organiz\u00e1cie a poskytovate\u013ea slu\u017eieb (pri existuj\u00facom SLA).<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/df997d02f9a2832a22d6f71e67b2b962.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Ako sa l\u00ed\u0161ia mechanizmy hodnotenia priechodn\u00fdch metr\u00edk SD-WAN a DMVPN\/PfR?<\/h3>\n<p>\n<b>DMVPN\/PfR <\/b><\/p>\n<ul>\n<li>Pre hodnotenie \u0161tandardn\u00fdch metr\u00edk stavu tunela sa pou\u017e\u00edvaj\u00fa akt\u00edvne aj pas\u00edvne softv\u00e9rov\u00e9 senzory (Probes). Akt\u00edvne \u2013 na z\u00e1klade u\u017e\u00edvate\u013eskej prev\u00e1dzky, pas\u00edvne napodob\u0148uj\u00fa tak\u00fato prev\u00e1dzku (pri jej absencii). <\/li>\n<li>Jemn\u00e9 nastavenie \u010dasova\u010dov a podmienok zistenia degrad\u00e1cie ch\u00fdba \u2013 algoritmus je fixn\u00fd.<\/li>\n<li>Dodato\u010dne je mo\u017en\u00e9 mera\u0165 pou\u017e\u00edvan\u00fa \u0161\u00edrku p\u00e1sma v odch\u00e1dzaj\u00facom smere. \u010co prid\u00e1va DMVPN\/PfR dodato\u010dn\u00fa flexibilitu pri spr\u00e1ve prev\u00e1dzky.<\/li>\n<li>Pri tom niektor\u00e9 mechanizmy PfR pri prekro\u010den\u00ed metr\u00edk z\u00e1visia na sp\u00e4tnej signalingovej v\u00e4zbe v podobe \u0161peci\u00e1lnych spr\u00e1v TCA (Threshold Crossing Alert), ktor\u00e9 musia poch\u00e1dza\u0165 od prij\u00edmate\u013ea prev\u00e1dzky smerom k zdroju, \u010do predpoklad\u00e1, \u017ee stavy meran\u00fdch kan\u00e1lov musia by\u0165 aspo\u0148 dostato\u010dn\u00e9 na prenos tak\u00fdchto spr\u00e1v TCA. \u010co je vo v\u00e4\u010d\u0161ine pr\u00edpadov probl\u00e9m, ale jasne nem\u00f4\u017ee by\u0165 zaru\u010den\u00e9. <\/li>\n<\/ul>\n<p>\n<b>SD-WAN <\/b><\/p>\n<ul>\n<li>Na prenosn\u00fa hodnotenie \u0161tandardn\u00fdch metr\u00edk stavu tunela sa pou\u017e\u00edva protokol BFD v echo-re\u017eime. Pri tom nie je potrebn\u00e1 \u017eiadna \u0161peci\u00e1lna sp\u00e4tn\u00e1 v\u00e4zba vo forme TCA alebo podobn\u00fdch spr\u00e1v \u2013 udr\u017eiava sa izolovanos\u0165 dom\u00e9n zlyhania. Rovnako nie je potrebn\u00e1 pr\u00edtomnos\u0165 pou\u017e\u00edvate\u013esk\u00e9ho prenosu na hodnotenie stavu tunela.<\/li>\n<li>Existuje mo\u017enos\u0165 jemn\u00e9ho nastavenia \u010dasova\u010dov BFD na regul\u00e1ciu r\u00fdchlosti sp\u00fa\u0161\u0165ania a citlivosti algoritmu na degrad\u00e1cie komunika\u010dn\u00e9ho kan\u00e1la od nieko\u013ek\u00fdch sek\u00fand po min\u00faty.\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/cd7fe1fa4f23a9d0695874bc5c6fa985.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>V \u010dase p\u00edsania \u010dl\u00e1nku je v ka\u017edom z tunelov predpokladan\u00e1 iba jedna BFD rel\u00e1cia. Potenci\u00e1lne to vytv\u00e1ra men\u0161iu granularitu pri anal\u00fdze stavu tunela. V skuto\u010dnosti to m\u00f4\u017ee predstavova\u0165 obmedzenie iba v pr\u00edpade pou\u017eitia WAN pripojenia na b\u00e1ze MPLS L2\/L3 VPN so schv\u00e1len\u00fdm QoS SLA \u2013 ak ozna\u010dovanie DSCP BFD prenosu (po enkapsul\u00e1cii v IPSec\/GRE) bude zodpoveda\u0165 vysoko prioritnej fronte v sieti poskytovate\u013ea, m\u00f4\u017ee to ovplyvni\u0165 presnos\u0165 a r\u00fdchlos\u0165 zistenia degrad\u00e1cie pre n\u00edzko prioritn\u00fd prenos. Pri tom existuje mo\u017enos\u0165 zmeny predvolen\u00e9ho ozna\u010dovania BFD na zn\u00ed\u017eenie rizika vzniku tak\u00fdchto situ\u00e1ci\u00ed. V nasleduj\u00facich verzi\u00e1ch softv\u00e9ru Cisco SD-WAN sa o\u010dak\u00e1va objavenie presnej\u0161ieho nastavenia BFD, ako aj mo\u017enos\u0165 spustenia viacer\u00fdch BFD rel\u00e1ci\u00ed v r\u00e1mci jedn\u00e9ho tunela s individu\u00e1lnymi hodnotami DSCP (pre r\u00f4zne aplik\u00e1cie).<\/li>\n<li>BFD navy\u0161e umo\u017e\u0148uje pos\u00fadi\u0165 maxim\u00e1lnu ve\u013ekos\u0165 paketu, ktor\u00fd je mo\u017en\u00e9 pren\u00e1\u0161a\u0165 cez dan\u00fd tunel bez fragment\u00e1cie. To umo\u017e\u0148uje SD-WAN dynamicky nastavova\u0165 tak\u00e9 parametre ako MTU a TCP MSS Adjust, aby sa maxim\u00e1lne efekt\u00edvne vyu\u017eila dostupn\u00e1 \u0161\u00edrka p\u00e1sma na ka\u017edom kan\u00e1li.<\/li>\n<li>V SD-WAN je tie\u017e k dispoz\u00edcii mo\u017enos\u0165 synchroniz\u00e1cie QoS s poskytovate\u013emi slu\u017eieb nielen na z\u00e1klade L3 DSCP pol\u00ed, ale aj na z\u00e1klade L2 CoS hodn\u00f4t, ktor\u00e9 m\u00f4\u017eu automaticky vznikn\u00fa\u0165 v pobo\u010dkovej sieti \u0161pecializovan\u00fdmi zariadeniami \u2013 napr\u00edklad IP telef\u00f3nmi.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Ako sa l\u00ed\u0161ia mo\u017enosti, sp\u00f4soby ur\u010dovania a aplik\u00e1cie polit\u00edk AppQ?<\/h3>\n<p><\/p>\n<h4>Politiky DMVPN\/PfR:<\/h4>\n<p><\/p>\n<ul>\n<li>S\u00fa definovan\u00e9 na smerova\u010di(-och) centr\u00e1lnych pobo\u010diek (CP) cez pr\u00edkazov\u00fd riadok CLI alebo CLI \u0161abl\u00f3ny konfigur\u00e1cie. Tvorba CLI \u0161abl\u00f3n si vy\u017eaduje pr\u00edpravu a znalosti syntaxe polit\u00edk.\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/5869bd7ff365cb4c810580d4b68392d1.jpg\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>S\u00fa glob\u00e1lne definovan\u00e9 <b>bez mo\u017enosti individu\u00e1lneho prisp\u00f4sobenia\/zmeny pod\u013ea po\u017eiadaviek jednotliv\u00fdch segmentov siete.<\/b><\/li>\n<li>Interakt\u00edvne vytv\u00e1ranie polit\u00edk v grafickom rozhran\u00ed nie je predpokladan\u00e9.<\/li>\n<li>Sledovanie zmien, dedi\u010dnos\u0165, vytv\u00e1ranie viacer\u00fdch verzi\u00ed polit\u00edk pre r\u00fdchle prep\u00ednanie nie je predpokladan\u00e9.<\/li>\n<li>Automaticky sa \u0161\u00edria na smerova\u010de vzdialen\u00fdch pobo\u010diek. Pri tom vyu\u017e\u00edvaj\u00fa tie ist\u00e9 komunika\u010dn\u00e9 kan\u00e1ly ako na prenos pou\u017e\u00edvate\u013esk\u00fdch \u00fadajov. Pri absencii komunika\u010dn\u00e9ho kan\u00e1la medzi centr\u00e1lnou a vzdialenou pobo\u010dkou nie je mo\u017en\u00e9 \u0161\u00edrenie\/zmenu polit\u00edk.<\/li>\n<li>Pou\u017e\u00edvaj\u00fa sa na ka\u017edom smerova\u010di a v pr\u00edpade potreby modifikuj\u00fa v\u00fdsledok \u0161tandardn\u00fdch protokolov smerovania s vy\u0161\u0161ou prioritou. <\/li>\n<li>Pre pr\u00edpady, ke\u010f v\u0161etky WAN kan\u00e1ly pobo\u010dky za\u017e\u00edvaj\u00fa v\u00fdrazn\u00e9 straty prev\u00e1dzky, <b>kompenza\u010dn\u00e9 mechanizmy nie s\u00fa predpokladan\u00e9.<\/b>.<\/li>\n<\/ul>\n<p><\/p>\n<h4>Politiky SD-WAN:<\/h4>\n<p><\/p>\n<ul>\n<li>S\u00fa definovan\u00e9 v grafickom rozhran\u00ed vManage pomocou interakt\u00edvneho sprievodcu \u0161abl\u00f3nami.<\/li>\n<li>Podporuj\u00fa vytv\u00e1ranie viacer\u00fdch polit\u00edk, kop\u00edrovanie, dedi\u010dnos\u0165, prep\u00ednanie medzi politikami v re\u00e1lnom \u010dase.<\/li>\n<li>Podporuj\u00fa individu\u00e1lne nastavenie politiky pre r\u00f4zne segmenty (pobo\u010dky) siete.<\/li>\n<li>\u0160\u00edria sa pomocou ak\u00e9hoko\u013evek dostupn\u00e9ho sign\u00e1lneho kan\u00e1la medzi ovl\u00e1da\u010dom a smerova\u010dom a\/alebo vSmart \u2013 nez\u00e1visia priamo od d\u00e1tovej v\u00e4zby medzi smerova\u010dmi. Samozrejme je potrebn\u00e1 IP konektivita medzi samotn\u00fdm smerova\u010dom a ovl\u00e1da\u010dmi.\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/9ed48b430fd39ec69af4c9d16efa3d32.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/li>\n<li>Pre pr\u00edpady, ke\u010f v\u0161etky dostupn\u00e9 kan\u00e1ly pobo\u010dky za\u017e\u00edvaj\u00fa v\u00fdrazn\u00e9 straty \u00fadajov prekra\u010duj\u00face prijate\u013en\u00e9 prahov\u00e9 hodnoty pre kritick\u00e9 aplik\u00e1cie, m\u00f4\u017ee by\u0165 pou\u017eit\u00fdch nieko\u013eko dodato\u010dn\u00fdch mechanizmov na zv\u00fd\u0161enie spo\u013eahlivosti prenosu:\n<ul>\n<li><b>FEC (Forward Error Correction)<\/b> \u2013 pou\u017e\u00edva \u0161peci\u00e1lny algoritmus nadbyto\u010dn\u00e9ho k\u00f3dovania. Pri prenose kritickej prev\u00e1dzky cez kan\u00e1ly s vysok\u00fdm percentom str\u00e1t m\u00f4\u017ee by\u0165 FEC automaticky aktivovan\u00fd a umo\u017e\u0148uje obnovi\u0165 straten\u00fa \u010das\u0165 \u00fadajov. Pri tom sa len nepatrne zvy\u0161uje vyu\u017e\u00edvan\u00e1 \u0161\u00edrka p\u00e1sma, ale spo\u013eahlivos\u0165 sa v\u00fdrazne zvy\u0161uje.\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/9b2deecf42b334b682c293ca92a52562.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/li>\n<li><b>Duplicitn\u00e9 pr\u00fady \u00fadajov<\/b> \u2013 navy\u0161e k FEC politika m\u00f4\u017ee predpoklada\u0165 automatick\u00e9 duplikovanie prev\u00e1dzky vybran\u00fdch aplik\u00e1ci\u00ed v pr\u00edpade e\u0161te z\u00e1va\u017enej\u0161ieho \u00farovne str\u00e1t, ktor\u00e9 sa nedaj\u00fa kompenzova\u0165 pomocou FEC. V tomto pr\u00edpade bud\u00fa vybran\u00e9 d\u00e1ta pren\u00e1\u0161an\u00e9 po v\u0161etk\u00fdch tuneloch smerom k pobo\u010dke-prij\u00edmate\u013eovi s n\u00e1slednou de-duplicitou (odstr\u00e1nen\u00edm nadbyto\u010dn\u00fdch k\u00f3pi\u00ed paketov). Mechanizmus v\u00fdrazne zvy\u0161uje vyu\u017eitie kan\u00e1lov, ale taktie\u017e v\u00fdznamne zvy\u0161uje spo\u013eahlivos\u0165 prenosu.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><\/p>\n<h3>Mo\u017enosti Cisco SD-WAN, bez priamych anal\u00f3gov v DMVPN\/PfR<\/h3>\n<p>\nArchitekt\u00fara rie\u0161enia Cisco SD-WAN v niektor\u00fdch pr\u00edpadoch umo\u017e\u0148uje z\u00edska\u0165 mo\u017enosti, ktor\u00fdch realiz\u00e1cia v r\u00e1mci DMVPN\/PfR je bu\u010f mimoriadne obtia\u017ena, alebo neefekt\u00edvna z d\u00f4vodu potrebn\u00fdch pracovn\u00fdch n\u00e1kladov, alebo dokonca \u00faplne nemo\u017en\u00e1. Pozrime sa na najzauj\u00edmavej\u0161ie z nich:<\/p>\n<h4>Traffic-Engineering (TE)<\/h4>\n<p>\nTE zah\u0155\u0148a mechanizmy, ktor\u00e9 umo\u017e\u0148uj\u00fa odkloni\u0165 prev\u00e1dzku od \u0161tandardnej cesty, vytvorenej protokolmi smerovania. TE sa \u010dasto pou\u017e\u00edva na zabezpe\u010denie vysokej dostupnosti sie\u0165ov\u00fdch slu\u017eieb, v\u010faka schopnosti r\u00fdchlo a\/alebo vopred preklopi\u0165 d\u00f4le\u017eit\u00fa prev\u00e1dzku na alternat\u00edvnu (neprekr\u00fdvaj\u00facu sa) cestu prenosu, s cie\u013eom zabezpe\u010di\u0165 lep\u0161iu kvalitu slu\u017eby alebo r\u00fdchlos\u0165 jej obnovy v pr\u00edpade poruchy na hlavnej ceste. <\/p>\n<p>Zlo\u017eitost implement\u00e1cie TE spo\u010d\u00edva v potrebe vopred spo\u010d\u00edta\u0165 a rezervova\u0165 (overi\u0165) alternat\u00edvnu cestu. V MPLS sie\u0165ach telekomunika\u010dn\u00fdch oper\u00e1torov sa tento probl\u00e9m rie\u0161i pomocou technol\u00f3gi\u00ed ako MPLS Traffic-Engineering s roz\u0161\u00edreniami IGP protokolov a RSVP protokolu. V poslednej dobe z\u00edskava na popularite aj technol\u00f3gia Segment Routing, ktor\u00e1 je viac optimalizovan\u00e1 pre centralizovan\u00e9 nastavenie a orchestr\u00e1ciu. V klasick\u00fdch WAN sie\u0165ach tieto technol\u00f3gie obvykle nie s\u00fa zast\u00fapen\u00e9 alebo s\u00fa obmedzen\u00e9 na pou\u017e\u00edvanie mechanizmov hop-by-hop, ako je Policy-Based Routing (PBR), ktor\u00e9 dok\u00e1\u017eu odkloni\u0165 prev\u00e1dzku, no realizuj\u00fa to na ka\u017edom smerova\u010di osobitne \u2013 bez oh\u013eadu na celkov\u00fd stav siete alebo v\u00fdsledok PBR na predch\u00e1dzaj\u00facich alebo nasleduj\u00facich krokoch. V\u00fdsledok aplik\u00e1cie t\u00fdchto variantov TE nie je ute\u0161uj\u00faci \u2013 MPLS TE sa z d\u00f4vodu zlo\u017eitosti nastavenia a prev\u00e1dzky pou\u017e\u00edvaj\u00fa zvy\u010dajne len v najkritickej\u0161ej \u010dasti siete (jadre), zatia\u013e \u010do PBR sa pou\u017e\u00edva na jednotliv\u00fdch smerova\u010doch bez mo\u017enosti vytvori\u0165 ak\u00fasi jednotn\u00fa PBR politiku v celej sieti. To ist\u00e9 plat\u00ed aj pre siete zalo\u017een\u00e9 na DMVPN.<\/p>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/85e0bc4dc068f4e5db4fec330c7ed78d.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSD-WAN v tomto oh\u013eade pon\u00faka ove\u013ea elegantnej\u0161ie rie\u0161enie, ktor\u00e9 nie je len \u013eahko nastavite\u013en\u00e9, ale aj ove\u013ea lep\u0161ie \u0161k\u00e1lovate\u013en\u00e9. To je v\u00fdsledkom architekt\u00far control-plane a policy-plane. Implement\u00e1cia policy-plane v SD-WAN umo\u017e\u0148uje centralizovane ur\u010di\u0165 politiku TE \u2013 ak\u00e1 prev\u00e1dzka je d\u00f4le\u017eit\u00e1? pre ktor\u00e9 VPN? cez ktor\u00e9 uzly\/tunely je potrebn\u00e9 alebo naopak zak\u00e1zan\u00e9 vytvori\u0165 alternat\u00edvnu trasu? Na druhej strane centraliz\u00e1cia riadenia control-plane na b\u00e1ze vSmart kontrolerov umo\u017e\u0148uje modifikova\u0165 v\u00fdsledky smerovania bez nutnosti meni\u0165 nastavenia jednotliv\u00fdch zariaden\u00ed \u2013 smerova\u010de u\u017e vidia len v\u00fdsledok tej logiky, ktor\u00e1 bola vytvoren\u00e1 v rozhran\u00ed vManage a pren\u00e1\u0161an\u00e1 na aplik\u00e1ciu na vSmart.<\/p>\n<h4>Service-chaining <\/h4>\n<p>\nTvorba servisn\u00fdch re\u0165azcov je e\u0161te n\u00e1ro\u010dnej\u0161ia \u00faloha v klasickom smerovan\u00ed ako u\u017e pop\u00edsan\u00fd mechanizmus Traffic Engineering. V tomto pr\u00edpade je potrebn\u00e9 nielen vytvori\u0165 \u0161peci\u00e1lnu trasu pre konkr\u00e9tnu sie\u0165ov\u00fa aplik\u00e1ciu, ale aj zabezpe\u010di\u0165 mo\u017enos\u0165 nasmerovania trafficu z siete na ur\u010dit\u00fdch (alebo na v\u0161etk\u00fdch) uzloch SD-WAN siete pre spracovanie \u0161peci\u00e1lnou aplik\u00e1ciou alebo servisom (MSE, Vyv\u00e1\u017eenie, K\u00f3dovanie, In\u0161pekcia trafficu at\u010f.). Je pritom potrebn\u00e9 ma\u0165 mo\u017enos\u0165 kontrolova\u0165 stav t\u00fdchto extern\u00fdch serv\u00edsov, aby sa predi\u0161lo situ\u00e1ci\u00e1m black-holing, a tie\u017e s\u00fa potrebn\u00e9 mechanizmy, ktor\u00e9 umo\u017e\u0148uj\u00fa umiestni\u0165 tak\u00e9to uniformn\u00e9 extern\u00e9 servisy do r\u00f4znych geo-lok\u00e1ci\u00ed s mo\u017enos\u0165ou siete automaticky vybra\u0165 najoptim\u00e1lnej\u0161\u00ed servisn\u00fd uzol pre spracovanie trafficu konkr\u00e9tneho filiala. V pr\u00edpade Cisco SD-WAN je to dos\u0165 jednoducho dosiahnute\u013en\u00e9 vytvoren\u00edm pr\u00edslu\u0161nej centralizovanej politiky, ktor\u00e1 \"zlepuje\" v\u0161etky aspekty cie\u013eov\u00e9ho servisn\u00e9ho re\u0165azca do jedn\u00e9ho celku a automaticky men\u00ed logiku data-plane a control-plane len tam a vtedy, kde je to potrebn\u00e9.<\/p>\n<p><img decoding=\"async\" alt=\"Odstrihne Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN?\" src=\"\/wp-content\/uploads\/2020\/08\/84bd6eba2de33a90baeb77697b844eec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSchopnos\u0165 vytvori\u0165 geo-distribuovan\u00fa ob \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 trafficu vybran\u00fdch druhov aplik\u00e1ci\u00ed v ur\u010ditom porad\u00ed na \u0161pecializovan\u00fdch (ale nemaj\u00facich s\u00favislos\u0165 so samotnou sie\u0165ou SD-WAN) zariadeniach \u2013 to je, h\u00e1dam, najzrete\u013enej\u0161ia uk\u00e1\u017eka v\u00fdhod Cisco SD-WAN oproti klasick\u00fdm technol\u00f3gi\u00e1m a dokonca aj niektor\u00fdm alternat\u00edvnym rie\u0161eniam SD-WAN in\u00fdch v\u00fdrobcov.<\/p>\n<h2>Ak\u00fd je v\u00fdsledok?<\/h2>\n<p>\nJe zrejm\u00e9, \u017ee aj DMVPN (spolu alebo bez Performance Routing) a Cisco SD-WAN <b>rie\u0161ia v kone\u010dnom d\u00f4sledku ve\u013emi podobn\u00e9 \u00falohy<\/b> vo vz\u0165ahu k distribuovanej WAN sieti organiz\u00e1cie. Pri tom v\u00fdznamn\u00e9 architektonick\u00e9 a funk\u010dn\u00e9 rozdiely technol\u00f3gie Cisco SD-WAN pos\u00favaj\u00fa proces rie\u0161enia t\u00fdchto \u00faloh <b>na in\u00fd kvalitat\u00edvny level<\/b>. Zhr\u0148me, m\u00f4\u017eeme poznamena\u0165 nasleduj\u00face v\u00fdznamn\u00e9 rozdiely medzi technol\u00f3giami SD-WAN a DMVPN\/PfR:<\/p>\n<ul>\n<li>DMVPN\/PfR vo v\u0161eobecnosti vyu\u017e\u00edvaj\u00fa osved\u010den\u00e9 technol\u00f3gie pre vytv\u00e1ranie prepojen\u00fdch VPN siet\u00ed a z poh\u013eadu d\u00e1tovej roviny s\u00fa podobn\u00e9 modernej\u0161ej technol\u00f3gii SD-WAN, pri\u010dom existuje nieko\u013eko obmedzen\u00ed v podobe povinnej statickej konfigur\u00e1cie smerova\u010dov a v\u00fdber topol\u00f3gi\u00ed je obmedzen\u00fd na Hub-n-Spoke. Na druhej strane m\u00e1 DMVPN\/PfR niektor\u00e9 funk\u010dn\u00e9 vlastnosti, ktor\u00e9 zatia\u013e nie s\u00fa k dispoz\u00edcii v r\u00e1mci SD-WAN (jde o per-application BFD).<\/li>\n<li>V r\u00e1mci control-plane technol\u00f3gie sa z\u00e1sadne l\u00ed\u0161ia. S oh\u013eadom na centralizovan\u00e9 spracovanie sign\u00e1lnych protokolov SD-WAN umo\u017e\u0148uje, okrem in\u00e9ho, v\u00fdrazne z\u00fa\u017ei\u0165 dom\u00e9ny zlyhania a \"oslobodi\u0165\" proces prenosu pou\u017e\u00edvate\u013esk\u00e9ho trafiku od sign\u00e1lneho interakcie \u2013 do\u010dasn\u00e1 nedostupnos\u0165 kontrol\u00e9rov neovplyv\u0148uje mo\u017enos\u0165 prenosu pou\u017e\u00edvate\u013esk\u00e9ho trafiku. Z\u00e1rove\u0148 do\u010dasn\u00e1 nedostupnos\u0165 ak\u00e9hoko\u013evek pobo\u010dky (vr\u00e1tane centr\u00e1lnej) nijako neovplyv\u0148uje mo\u017enos\u0165 ostatn\u00fdch pobo\u010diek navz\u00e1jom komunikova\u0165 a spolupracova\u0165 s kontrol\u00e9rmi.<\/li>\n<li>Architekt\u00fara formovania a aplikovania polit\u00edk spr\u00e1vy trafiku v pr\u00edpade SD-WAN je tie\u017e v\u00fdrazne lep\u0161ia ako v DMVPN\/PfR \u2013 geo-z\u00e1lohovanie je realizovan\u00e9 ove\u013ea lep\u0161ie, nie je viazan\u00e9 na Hub, existuje viac mo\u017enost\u00ed na podrobn\u00fa konfigur\u00e1ciu polit\u00edk, zoznam realizovan\u00fdch scen\u00e1rov spr\u00e1vy trafiku je tie\u017e ove\u013ea rozsiahlej\u0161\u00ed.<\/li>\n<li>Proces orchestr\u00e1cie rie\u0161enia sa tie\u017e v\u00fdrazne l\u00ed\u0161i. DMVPN predpoklad\u00e1 existenciu vopred zn\u00e1mych parametrov, ktor\u00e9 by mali by\u0165 nejak\u00fdm sp\u00f4sobom zahrnut\u00e9 do konfigur\u00e1cie, \u010do trochu obmedzuje flexibilitu rie\u0161enia a mo\u017enos\u0165 dynamick\u00fdch zmien. Na druhej strane SD-WAN vych\u00e1dza z paradigmy, \u017ee v po\u010diato\u010dnom okamihu pripojenia smerova\u010d \"nevie ni\u010d\" o svojich kontrol\u00e9roch, ale vie \"od koho sa p\u00fdta\u0165\" \u2013 to sta\u010d\u00ed nielen na automatick\u00e9 nadviazanie spojenia s kontrol\u00e9rmi, ale aj na automatick\u00e9 vytvorenie plne prepojenej d\u00e1tovej roviny topol\u00f3gie, ktor\u00fa potom mo\u017eno flexibilne nastavi\u0165\/zmeni\u0165 pomocou polit\u00edk.<\/li>\n<li>V oblasti centralizovan\u00e9ho riadenia, automatiz\u00e1cie a monitorovania SD-WAN o\u010dak\u00e1vane prekon\u00e1va mo\u017enosti DMVPN\/PfR, ktor\u00e9 vznikli z v\u00fdvoja klasick\u00fdch technol\u00f3gi\u00ed a v ove\u013ea v\u00e4\u010d\u0161ej miere sa spoliehaj\u00fa na pr\u00edkazov\u00fd riadok CLI a pou\u017eitie syst\u00e9mov NMS zalo\u017een\u00fdch na \u0161abl\u00f3nach. <\/li>\n<li>V SD-WAN v porovnan\u00ed s DMVPN vzr\u00e1stli po\u017eiadavky na bezpe\u010dnos\u0165 na \u00faplne nov\u00fa kvalitat\u00edvnu \u00farove\u0148. Hlavn\u00e9 princ\u00edpy s\u00fa \u2013 nulov\u00e1 d\u00f4vera, \u0161k\u00e1lovate\u013enos\u0165 a dvojfaktorov\u00e1 autentifik\u00e1cia.<\/li>\n<\/ul>\n<p>\nZ t\u00fdchto nezlo\u017eit\u00fdch z\u00e1verov by sa mohlo vytvori\u0165 chybn\u00fd dojem, \u017ee vytv\u00e1ranie siete na b\u00e1ze DMVPN\/PfR dnes u\u017e stratilo ak\u00fako\u013evek aktu\u00e1lnos\u0165. To ur\u010dite nie je celkom pravda. Napr\u00edklad v pr\u00edpadoch, ke\u010f sa v sieti pou\u017e\u00edva mno\u017estvo zastaran\u00e9ho vybavenia a nie je mo\u017enos\u0165 ho vymeni\u0165, DMVPN m\u00f4\u017ee umo\u017eni\u0165 spoji\u0165 \"star\u00e9\" a \"nov\u00e9\" zariadenia do jedn\u00e9ho geo-distribuovan\u00e9ho siete s mno\u017estvom vy\u0161\u0161ie uveden\u00fdch v\u00fdhod.<\/p>\n<p>Na druhej strane treba pam\u00e4ta\u0165, \u017ee v\u0161etky aktu\u00e1lne podnikov\u00e9 smerova\u010de Cisco zalo\u017een\u00e9 na IOS XE (ISR 1000, ISR 4000, ASR 1000, CSR 1000v) dnes podporuj\u00fa ak\u00fdko\u013evek prev\u00e1dzkov\u00fd re\u017eim \u2013 a klasick\u00fa smerovanie, aj DMVPN a SD-WAN - <b>v\u00fdber je determinovan\u00fd aktu\u00e1lnymi potrebami a pochopen\u00edm, \u017ee v ktorejko\u013evek chv\u00edli na tom istom zariaden\u00ed mo\u017eno za\u010da\u0165 presun smerom k pokro\u010dilej\u0161ej technol\u00f3gii.<\/b><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/514616\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN. \u0417\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u0435 3 \u0433\u043e\u0434\u0430 SD-WAN \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u043f\u0440\u043e\u0448\u043b\u0430 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u043a\u0430\u043a \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e, \u0442\u0430\u043a \u0438 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0430. \u0422\u0430\u043a \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0438\u0441\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u044f\u0432\u0438\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 \u043d\u0430 \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 \u0441\u0435\u0440\u0438\u0439 Cisco ISR 1000, ISR 4000, ASR 1000 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":91349,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-91348","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0442\u043f\u0438\u043b\u0438\u0442 \u043b\u0438 Cisco SD-WAN \u0441\u0443\u043a, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u0438\u0434\u0438\u0442 DMVPN? | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-12T05:42:24+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-12T05:42:24+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Odstr\u00e1ni Cisco SD-WAN kon\u00e1r, na ktorom sed\u00ed DMVPN? | ProHoster","description":"Od augusta 2017, ke\u010f spolo\u010dnos\u0165 Cisco odk\u00fapila spolo\u010dnos\u0165 Viptela, sa hlavnou pon\u00fakanou technol\u00f3giou na organiz\u00e1ciu distribuovan\u00fdch podnikov\u00fdch siet\u00ed stalo Cisco SD-WAN.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0442\u043f\u0438\u043b\u0438\u0442 \u043b\u0438 Cisco SD-WAN \u0441\u0443\u043a, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u0438\u0434\u0438\u0442 DMVPN? | ProHoster","og:description":"\u0421 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2017 \u0433\u043e\u0434\u0430, \u043a\u043e\u0433\u0434\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cisco \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u043b\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044e Viptela, \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0441\u0442\u0430\u043b\u0430 Cisco SD-WAN.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/otpilit-li-cisco-sd-wan-suk-na-kotorom-sidit-dmvpn","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T05:42:24+00:00","article:modified_time":"2020-08-12T05:42:24+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91348","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:29:22","updated":"2026-02-08 20:40:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=91348"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91348\/revisions"}],"predecessor-version":[{"id":158011,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91348\/revisions\/158011"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/91349"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=91348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=91348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=91348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}