Getting Started With Alkira And Terraform (Part 3)

Check out Part 1 and Part 2 where we put together a scalable foundation and connect cloud networks from AWS, Azure, and GCP. For Part 3, we will bring on-premises back into the spotlight and connect some sites over Cisco SD-WAN and IPSEC.

On-premises remains a strong focus for many enterprises through 2021 going into 2022. Some workloads, as noted by Amazon CEO Andy Jassy, may never move to the cloud. While this may seem like a shocker, if continuing to run specific workloads on-premises makes sense from a cost or compliance standpoint, why should they move?

Scenario

#

Let’s expand on our network design layout from Part 2 and add some requirements for our on-premises networks. For this example, my SD-WAN fabric consists of two data centers + HQ in the East region which, will have connectivity extended to my East CXP. Three smaller sites will get connected directly via IPSEC.

• Sites with <= 10 users will connect into Alkira’s CXP over IPSEC
• All other sites are on Cisco’s SD-WAN fabric and get extended into the CXP

In the enterprise space, connectivity can be handled in numerous ways. For instance, many enterprises may want or already have AWS Direct Connect, specifically for its bandwidth and performance. Alkira makes it simple to leverage existing options to connect data centers and sites to Cloud Exchange Points meeting enterprise networking where it lives today and providing a path forward to elastic networks of the future.

Resources

#

Connecting On-Premises

#

A great deal of focus has been placed on the cloud over the past five years. However, for large enterprises, migrating and modernizing applications using the public cloud isn’t as simple as a project, program, or throwing lots of cash down to get it done in a year exercise. Playing the long-game is critical, and on-premises shouldn’t be ignored.

Terraform Cloud

#

Like Part 1 and Part 2, I used Terraform Cloud for provisioning. I’m going to forgo explanation in this post to minimize repetition. To get a better understanding of how I organized things, check this out.

IPSEC Connectors

#

IPSEC can be set up with static or dynamic routing via route based VPN mode. Connecting sites to Alkira consists of defining the connector along with each endpoint that should be associated with it.

ipsec_connector.tf

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

resource "alkira_connector_ipsec" "connector" {

  // Connector values
  name        = var.name
  cxp         = var.region
  group       = var.group
  size        = var.size
  segment_id  = var.segment_id
  vpn_mode    = var.vpn_mode

  // Endpoint values
  endpoint {
    name                 = "Union Ave - ipsec"
    customer_gateway_ip  = var.union_gw_ip
  }

  endpoint {
    name                 = "Summer St - ipsec"
    customer_gateway_ip  = var.summer_gw_ip
  }

  endpoint {
    name                 = "Newport Ave - ipsec"
    customer_gateway_ip  = var.newport_gw_ip
  }

  routing_options {
    type                 = var.routing_type
    customer_gateway_asn = var.cust_gw_asn
  }

}

SD-WAN Connectors

#

Extending the Cisco SD-WAN fabric into Alkira consists of defining the connector, endpoints, and the bootstrap file from Cisco vManage. The SD-WAN fabric will then be extended into one or more Cloud Exchange Points, enabling regional hand-offs between the two.

cisco_sdwan_connector.tf

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

resource "alkira_credential_cisco_sdwan" "credential" {
  name            = var.credential
  username        = var.username
  password        = var.password
}

resource "alkira_connector_cisco_sdwan" "connector" {

  // Connector values
  name    = var.name
  cxp     = var.region
  group   = var.group
  size    = var.size
  version = var.version

  // Endpoint values
  vedge {
    hostname        = "hub"
    cloud_init_file = var.cloud_init
    credential_id   = alkira_credential_cisco_sdwan.credential.id
  }

  vrf_segment_mapping {
    segment_id = data.alkira_segment.corporate.id
    vrf_id     = data.alkira_segment.corporate.id
  }

}

I used Cisco SD-WAN for this post. Today, all three node types (CSR, vEdge, and CAT8000v) are supported. Alkira continually adds new partner integrations, like Aruba EdgeConnect so keep a lookout for new product announcements

Conclusion

#

In Part 1, we built a scalable foundation, and in Part 2, we connected networks to that foundation from AWS, Azure, and GCP. This post brought data centers and remote offices into the picture over IPSEC and SD-WAN.

Now that we have all of these networks connected, what about policy and service insertion? To be helpful to enterprises adopting cloud, limiting communication to and across clouds and on-premises is a given. Also, selectively steering specific traffic through VM-Series Firewalls should be a trivial task. In Part 4, we will define policies in code and use Alkira’s design canvas to validate.