Configure the Overlay Addressing Scheme

For supported software information, click here.

Versa Director acts as an orchestrator for all SD-WAN CPE devices. To perform its orchestration function, Versa Director implements an overlay addressing scheme, in which it assigns a unique management IP address to each device from a pre-allocated pool of address within an IP address prefix.

By default, Versa Director assigns the pre-allocated addresses from the private address space 10.0.0.0/8. You can configure Versa Director to allocate the management addresses from a different IP prefix. You must ensure that each CPE device has a unique management IP address and that there is no address overlap or duplication.

When you configure the overlay address prefix, Versa Director assigns the IP addresses sequentially from the pool of overlay addresses that you configure.

When you deploy SD-WAN Controller and branch devices, the Director node uses the NetBox IP address management (IPAM) service to allocate IP addresses from the configured overlay prefixes. IPAM allocates IP addresses for each provider organization and for all other tenants. IPAM manages all the device IP addresses and WAN interface address pools. The IP address for each device is allocated randomly from the IPAM pool, using the first available address. For a multitenant device, two IP addresses are allocated, which are for two tunnel interfaces. One IP address is used to establish a VXLAN tunnel over the internet or MPLS underlay, and the second IP address is used to establish an IPsec tunnel on top of the VXLAN tunnel. This multilayered approach allows the VOS device to perform traffic steering on a single IPsec tunnel between multiple VXLAN tunnels. No tenant ID or device ID is encoded in the IP addresses allocated to the device. The IP addresses allocated to overlay tunnels for each tenant are the same. For example, if Tenant1 has Tunnel-0/0:10.10.10.1 and Tunnel-0/1:10.10.10.2, then the IP addresses for Tenant2 are Tunnel0/2:10.10.10.1 and Tunnel0/3:10.10.10.2. Each tenant uses a separate VRF for interbranch communication and for the establishment of the BGP control plane. Communication between a brand and a Director node always happens only through the tenant that owns the device.

When you migrate an existing Controller node using IPAM, by default, all IP addresses, including tenant-specific IP addresses for which encodeTenant ID is enabled, are migrated to IPAM, and two new IP addresses are assigned to the newly deployed Controller node. However, if these addresses lay outside of the allocated overlay address prefixes, you must change the IP addresses allocated by the WAN interface address pool.