In this scenario:

• Routers (both branch and gateway) will use system default routing table to establish VPN tunnels. Configure WAN failover between links, if there's redundancy.

• Assign SD-WAN (hence VPN tunnel) and router LAN interfaces (both HQ and Branch) into a dedicated VRF (eg. VRF-4, follow the VPN instance ID).

• Run BGP instance in the service VRF and advertise default route 0.0.0.0/0 to branch routers, and each branch router advertises its local LAN networks.

• Route all LAN traffic using the BGP default route through VPN tunnel to HQ, within the service VRF.

You may optionally configure route leaking between SD-WAN VRF and router default VRF, only if you want branch traffic to breakout from CMG/HSG gateway to Internet.

Configuration on Gateway

NOTE:

• Add route-map (and prefix-list) for the VPN instance to filter 0.0.0.0/0 to the branch routers only, so that they don't need to receive other branch routes unnecessarily.

• If you need the SD-WAN VRF to communicate with other networks directly, just assign the connected interface to the same VRF. For example, if you have another firewall to filter the traffic, just assign the interface (connected to the firewall) to the same VRF, and add a default route to the firewall within the SD-WAN VRF.

• Route leaking is only necessary if you want SD-WAN VRF traffic to breakout from local CMG/HSG gateway (via gateway default routing table). 

Below are the relevant Configuration Steps on Orchestrator

Step 1: Assign LAN interface to the service VRF

Step 2: Configure default route for the service VRF

Step 3: Configure prefix-list and route-map

Step 4: Enable VRF for BGP Instance and apply route-map

Step 5: Assign branch device to the VPN instance

Apply Config

CLI Configuration Sample

Below are the relevant gateway CLI configs (generated by mfusion). You should use mfusion orchestrator to provision SD-WAN configurations. Most of the settings are done on gateway, at the SD-WAN VPN instance. CLI samples are for references and expert mode only.

Configuration on Branch Routers

On the branch router, we just need to assign assign LAN interface (where internal devices reside) to the SD-WAN service VRF. Relevant Configuration Steps:

Step 1: Assign LAN interface to the service VRF

Apply Config

CLI Configuration Sample

(Optional) Configure Route Leaking

If you want service VRF traffic to breakout from the gateway (eg. using CMG default route to Internet), it requires route "leak" between service VRF and default VRF on the gateway router, to allow gateway to route traffic between different VRFs.

• VRFs are isolated by design — they don’t automatically share routes with the default table. 

• For Internet breakout, return traffic must find its way from the default routing table back into the VRF.

• Without leaking, return traffic would arrive at the gateway but never know how to return into the VRF.

NOTE: 

• You only need to configure route leaking on the gateway router.

• Configure firewall/SNAT to permit inbound/outbound traffic.

• You can use the same method to leak out directly from branch router, for some rare cases only (NOTE: If you generally allow local breakout for branch routers, you don't even need to run "VRF over SD-WAN", just the traditional method will do - advertise HQ/DC routes and everything else route through local default routes).

There are two options to configure route leaking:

1. Configure static route for each remote network, for smaller SD-WAN deployment

2. Dynamically import (use MP-BGP), for large SD-WAN deployment

Option 1: static route leaking

Static route leaking configuration is simple when you have a few remote locations. But it gets tedious when the remote sites grow as each site requires one static route.

NOTE: 

• Static route leaking requires static nexthop for each remote network.

• Use VRF ID (not interface name) as the nexthop

Below is an example to leak local/connected routes (eg. to allow reachability between interfaces in different VRF on the same router), eg. to allow interface vlan1 (10.1.99.1/24, in VRF-1) to ping vlan2 (10.2.99.1/24, in VRF-2).

CLI Configuration Sample

Below are the relevant gateway CLI configs for reference only (other general configs are omitted). 

Option 2: Use dynamic route import (MP-BGP)

Static route leaking can be very hard to manage when you have hundreds or thousands of remote networks. So the simpler approach is to use MP-BGP to dynamically import routes between VRFs - run BGP instance in each VRF and import the routes from the target VRF.

NOTE: BGP route-leaking only export & import routes learnt from BGP, eg. gateway leaks routes learnt from branch routers for remote networks.

Typically route-leaking is done on the gateway router. Below is a complete config on the gateway/CMG router. In this sample case,  we just want service VRF-4 to have Internet breakout through default VRF.

• Configure static route leak in VRF-4 (via gateway in default VRF), for Internet access.

• Configure BGP in default VRF to dynamically import routes from VRF-4, so that default VRF knows the return paths.

• Optionally configure a route-map for the VRF route import, to only allow the authorized routes to leak into default VRF routing table (in below config, the routes 10.11.11.0/24 and 10.12.12.0/24 are not imported/leaked into default VRF because of the route-map filter).

• With dynamic route import, you don't need to set static tunnel IP for each remote branch routers.

Despite it's quite simple to config this feature, the impact can be significant if wrongly configured. So we only allow this config through CLI only. In below sample config CLI, we import routes from VRF-4 into default routing table (there's no VRF ID configured for the BGP instance so it means default routing table).

CLI Configuration Sample

Below are the relevant gateway CLI configs for reference only (other general configs are omitted).