Skip to content

Aruba EdgeConnect Enterprise

Last updated View as MarkdownAgent setup

Cloudflare partners with Aruba's EdgeConnect SD-WAN solution to provide users with an integrated solution. The EdgeConnect appliances manage subnets associated with branch offices or retail locations. Anycast tunnels are set up between the EdgeConnect appliances and Cloudflare to securely route traffic.

This tutorial describes how to configure the EdgeConnect device for both east-west (branch to branch) and north-south (Internet-bound) use cases.

Prerequisites

Before setting up a connection between EdgeConnect and Cloudflare, you must have:

  • A contract that includes Cloudflare WAN (formerly Magic WAN) and Secure Web Gateway.
  • Received two Cloudflare endpoints (anycast IP addresses), available in Leased IPs ↗.
  • Determined a private static /31 IP pair to use with each tunnel. The /31 pairs should be from a different private subnet, separate from the private subnets used behind each EdgeConnect appliance.
  • The EdgeConnect devices used in this tutorial and on v9.0.

Example scenario

GRE tunnel configuration

For the purpose of this tutorial, the integration will refer to a scenario with two branch offices, each with distinct subnets.

There are 2 branch offices each with distinct subnets.

  • The east branch office has a 10.3.0.0/16 network with an EdgeConnect terminating the anycast GRE tunnel.
  • The west branch office has a 10.30.0.0/16 network with an EdgeConnect terminating the anycast GRE tunnel.
Table of branch subnet information

Note: Labels in this image may reflect a previous product name.

The following example shows the east_branch deployment on the Orchestrator.

GCP East deployment configuration

The Deployment screenshot displays several different IP addresses and interfaces. From left to right:

  • Next Hop 10.3.0.1 - This example uses Google Cloud. This IP defines the default gateway IP for the subnet and is built into GCP.
  • IP/Mask (LAN) 10.3.0.2/24 - This defines the LAN0 interface IP of the EdgeConnect appliance.
  • IP/Mask (WAN) 10.2.0.2/24 - This defines the WAN0 interface IP of the EdgeConnect appliance.
  • Next Hop 10.2.0.1 - This example uses Google Cloud. This IP defines the default gateway IP for the subnet and is built into GCP.

IPsec tunnel configuration

For the purpose of this tutorial, the integration will refer to a scenario with two branch offices, each with distinct subnets.

The central branch office has a 10.22.0.0/24 network with an EdgeConnect terminating the anycast IPsec tunnel.

The west branch office has a 10.77.0.0/24 network with an EdgeConnect terminating the anycast IPsec tunnel.

IPsec tunnel values for east and west branches