Select system communication roles for Master Engine interfaces

Select which Master Engine interfaces are used for particular roles in system communications.

For more details about the product and how to configure features, click Help or press F1.

Steps

  1. Right-click an Secure SD-WAN Engine, then select Edit <element type>.
  2. Browse to Interfaces > Interface Options.
  3. In the Interface Options pane:
    1. From the Primary control IP address drop-down list, select the primary control IP address that the Master Engine uses for communications with the Management Server.
      Note: We recommend that you do not use the IP address of an Aggregated Link interface as the primary or secondary control IP address of the Engine.
    2. (Optional, recommended) From the Backup control IP address drop-down list, select a backup control IP address that the Master Engine uses for communications with the Management Server if the primary control IP address fails.
    3. (Optional, Engine/VPN role only) If the Master Engine is behind a device that applies dynamic NAT to outbound connections or in some other way blocks incoming connections, select Node-Initiated contact to Management Server.
      When this option is selected, the engine opens a connection to the Management Server and maintains connectivity.
    4. (Master Engine Cluster Only) From the Primary heartbeat drop-down list, select the primary interface for communications between the nodes.
      We recommend using a physical interface, not a VLAN interface. We strongly recommend that you do not direct any other traffic through this interface. A dedicated network helps guarantee reliable and secure operation.
      CAUTION:
      Primary and backup heartbeat networks exchange confidential information. If dedicated networks are not possible, configure the cluster to encrypt the exchanged information.
    5. (Master Engine Cluster Only) From the Backup heartbeat drop-down list, select the backup heartbeat interface that is used if the primary heartbeat interface is unavailable.
      It is not mandatory to configure a backup heartbeat interface, but we strongly recommend it. If heartbeat traffic is not delivered, the cluster cannot operate and traffic is disturbed. We strongly recommend that you use a dedicated interface for the backup heartbeat as well.
    6. In the Default IP Address for Outgoing Traffic field, select the IP address that the nodes use if they have to initiate connections through an interface that has no Node Dedicated IP address.
  4. Click Save and Refresh.

Next steps

Bind licenses to Master Engine elements.

Engine Editor > Interfaces > Interface Options

Use this branch to define which IP addresses are used in particular roles in the Secure SD-WAN Engine's system communications.

Option Definition
Control Interface

(Not Virtual Engines)

  • Primary — Specifies the Primary Control IP address for Management Server contact.
  • Backup (Optional) — Specifies the Backup Control IP address that is used if the Primary Control IP address is not available.
Note: We recommend that you do not use the IP address of an Aggregated Link interface as the primary or secondary control IP address of the Engine.
Node-Initiated Contact to Management Server When selected, the Secure SD-WAN Engine opens a connection to the Management Server and maintains connectivity. This option is always used with a dynamic control IP address, so it is always selected if the control IP address is dynamic. If the connection is not open when you command the Secure SD-WAN Engine through the Management Client, the command is left pending until the Secure SD-WAN Engine opens the connection again.
Note: This option is not supported for IPS Clusters, Layer 2 Engine Clusters, or Virtual Secure SD-WAN Engines.
Heartbeat Interface

(Clusters and Master Engines only)

  • Primary — Specifies communications between the nodes. We recommend that you use a Physical Interface, not a VLAN Interface. We strongly recommend that you do not direct any other traffic through this interface. A dedicated network helps guarantee reliable and secure operation.
    CAUTION:
    Primary and Backup Heartbeat networks exchange confidential information. If dedicated networks are not possible, configure the cluster to encrypt the exchanged information.
  • Backup — Used if the Primary Heartbeat Interface is unavailable. It is not mandatory to configure a backup Heartbeat Interface, but we strongly recommend it. If heartbeat traffic is not delivered, the cluster cannot operate and traffic is interrupted. We strongly recommend that you use a dedicated interface for the backup heartbeat as well.

On Master Engines, you cannot use shared interfaces as a heartbeat interface.
IPv4 Identity for Authentication Requests or IPv6 Identity for Authentication Requests

The IPv4 address or IPv6 address of the selected interface is used when an Secure SD-WAN Engine contacts an external authentication server.

This option does not affect the routing of the connection with the authentication server. The IP address is used only as a parameter inside the authentication request payload to give a name to the request sender.

IPv4 Source for Authentication Requests or IPv6 Source for Authentication Requests By default, specifies the source IPv4 address or IPv6 address for authentication requests according to routing. If the authentication requests are sent to an external authentication server over VPN, select an interface with a Node Dedicated IP address that you want to use for the authentication requests.
Default IP Address for Outgoing Traffic Specifies the IP address that the Secure SD-WAN Engine uses to initiate connections (such as for system communications and ping) through an interface that has no Node Dedicated IP Address. In clusters, you must select an interface that has an IP address defined for all nodes.