In this scenario:

• Routers (both branch and gateway) will use system default routing table to establish VPN tunnels. Configure WAN failover between links, if there's redundancy.

• Assign SD-WAN (hence VPN tunnel) and router LAN interfaces (both HQ and Branch) into a dedicated VRF (eg. VRF-4, follow the VPN instance ID).

• Run BGP instance in the service VRF and advertise default route 0.0.0.0/0 to branch routers, and each branch router advertises its local LAN networks.

• Route all LAN traffic using the BGP default route through VPN tunnel to HQ, within the service VRF.

You may optionally configure route leaking between SD-WAN VRF and router default VRF, only if you want branch traffic to breakout from CMG/HSG gateway to Internet.

Configuration on Gateway

NOTE:

• Add route-map (and prefix-list) for the VPN instance to filter 0.0.0.0/0 to the branch routers only, so that they don't need to receive other branch routes unnecessarily.

• If you need the SD-WAN VRF to communicate with other networks directly, just assign the connected interface to the same VRF. For example, if you have another firewall to filter the traffic, just assign the interface (connected to the firewall) to the same VRF, and add a default route to the firewall within the SD-WAN VRF.

• Route leaking is only necessary if you want SD-WAN VRF traffic to breakout from local CMG/HSG gateway (via gateway default routing table). 

Below are the relevant Configuration Steps on Orchestrator

Step 1: Assign LAN interface to the service VRF

Step 2: Configure default route for the service VRF

Step 3: Configure prefix-list and route-map

Step 4: Enable VRF for BGP Instance and apply route-map

Step 5: Assign branch device to the VPN instance

Apply Config

CLI Configuration Sample

Below are the relevant gateway CLI configs (generated by mfusion). You should use mfusion orchestrator to provision SD-WAN configurations. Most of the settings are done on gateway, at the SD-WAN VPN instance. CLI samples are for references and expert mode only.

!

interface eth1 vrf 4

 description "Interface connection to firewall"

 ip address 10.10.10.2/30

!

ip route 0.0.0.0/0 nexthop 10.65.31.1 remark "system default route to Internet"

ip route 0.0.0.0/0 nexthop 10.10.10.1 vrf 4 remark "VRF-4 default route to firewall"

!

router bgp 65051 vrf 4

 bgp timer 5 15

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-peer

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-remote 65051

 neighbor 0168_RansNet_SSL3OPENVPN_4 next-hop-self

 neighbor 0168_RansNet_SSL3OPENVPN_4 route-map HQ2Branch out

 neighbor 0168_RansNet_SSL3OPENVPN_4 route-reflector-client

 neighbor 0168_RansNet_SSL3OPENVPN_4 soft-reconfiguration

 neighbor 0168_RansNet_SSL3OPENVPN_4 weight 0

 neighbor range 10.4.168.0/22 as-peer 0168_RansNet_SSL3OPENVPN_4

 network 0.0.0.0/0

!

ip prefix-list HQ2Branch permit 0.0.0.0/0

!

route-map HQ2Branch permit 10

 match ip address prefix-list HQ2Branch

!

firewall-input 500 permit all tcp dport 179 src 10.0.0.0/8

!

firewall-access 500 permit outbound eth0 remark "Permit out to Internet"

firewall-access 501 permit outbound tap+ remark "Permit SD-WAN traffic"

firewall-access 502 permit inbound tap+ remark "Permit SD-WAN traffic"

!

firewall-snat 500 overload outbound eth0

!

security sslvpn-server 4 vrf 4

 server address sdwan.ransnet.com 1604

 server tap-mode

 encryption AES-256-CBC

 server client-to-client

 tunnel-pool 10.4.168.0/22

 client 00-60-e0-a3-59-f7

 start

Configuration on Branch Routers

On the branch router, we just need to assign assign LAN interface (where internal devices reside) to the SD-WAN service VRF. Relevant Configuration Steps:

Step 1: Assign LAN interface to the service VRF

Apply Config

CLI Configuration Sample

!

interface eth1 vrf 4

 description "Default connection to LAN"

 enable

 ip address 192.168.8.1/22

 dhcp-server

  lease-time 86400 86400

  router 192.168.8.1

  dns 8.8.8.8 8.8.4.4

  range 192.168.8.10 192.168.11.254

  enable

!

router bgp 65051 vrf 4

 bgp timer 5 15

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-peer

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-remote 65051

 neighbor 0168_RansNet_SSL3OPENVPN_4 next-hop-self

 neighbor 0168_RansNet_SSL3OPENVPN_4 soft-reconfiguration

 neighbor 0168_RansNet_SSL3OPENVPN_4 weight 0

 neighbor 10.4.168.1 as-peer 0168_RansNet_SSL3OPENVPN_4

 network 192.168.8.1/22

!

firewall-input 500 permit all tcp dport 179 src 10.0.0.0/8

!

firewall-access 500 permit outbound eth0 remark "Permit out to Internet"

firewall-access 501 permit outbound tap+ remark "Permit SD-WAN traffic"

firewall-access 502 permit inbound tap+ remark "Permit SD-WAN traffic"

!

firewall-snat 500 overload outbound eth0

!

security sslvpn-client 4 vrf 4

 start

!

(Optional) Configure Route Leaking

If you want service VRF traffic to breakout from the gateway (eg. using CMG default route to Internet), it requires route "leak" between service VRF and default VRF on the gateway router, to allow gateway to route traffic between different VRFs.

• VRFs are isolated by design — they don’t automatically share routes with the default table. 

• For Internet breakout, return traffic must find its way from the default routing table back into the VRF.

• Without leaking, return traffic would arrive at the gateway but never know how to return into the VRF.

NOTE: 

• You only need to configure route leaking on the gateway router.

• Configure firewall/SNAT to permit inbound/outbound traffic.

• You can use the same method to leak out directly from branch router, for some rare cases only (NOTE: If you generally allow local breakout for branch routers, you don't even need to run "VRF over SD-WAN", just the traditional method will do - advertise HQ/DC routes and everything else route through local default routes).

There are two options to configure route leaking:

1. Configure static route for each remote network, for smaller SD-WAN deployment

2. Dynamically import (use MP-BGP), for large SD-WAN deployment

Option 1: static route leaking

Static route leaking configuration is simple when you have a few remote locations. But it gets tedious when the remote sites grow as each site requires one static route.

NOTE: 

• Static route leaking requires static nexthop for each remote network.

• The nexthop is the remote branch router's tunnel IP, so we will need to set static tunnel IP for each branch router.

CLI Configuration Sample

Below are the relevant gateway CLI configs for reference only (other general configs are omitted). 

!

hostname Gateway

!

interface eth0

 description "Default connection to WAN"

 enable

 ip address 10.65.31.134/24

!

interface lo

 enable

 ip address 2.1.2.1/32

!

interface tap4 vrf 4

 enable

!

ip host portal.ransnet.com 10.65.30.18

!

ip route 0.0.0.0/0 nexthop 10.65.31.1 remark "system default route"

ip route 0.0.0.0/0 nexthop 10.65.31.1 vrf 4 nexthop-vrf default remark "VRF-4 default route via system"

ip route 10.4.168.0/22 nexthop tap4 nexthop-vrf 4 remark "return to VRF-4 VPN network"

ip route 192.168.8.0/22 nexthop 10.4.168.10 nexthop-vrf 4 remark "return to branch_LAN in VRF-4"

!

router bgp 65051 vrf 4

 bgp timer 5 15

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-peer

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-remote 65051

 neighbor 0168_RansNet_SSL3OPENVPN_4 next-hop-self

 neighbor 0168_RansNet_SSL3OPENVPN_4 route-map HQ2Branch out

 neighbor 0168_RansNet_SSL3OPENVPN_4 route-reflector-client

 neighbor 0168_RansNet_SSL3OPENVPN_4 soft-reconfiguration

 neighbor 0168_RansNet_SSL3OPENVPN_4 weight 0

 neighbor range 10.4.168.0/22 as-peer 0168_RansNet_SSL3OPENVPN_4

 network 0.0.0.0/0

!

ip prefix-list HQ2Branch permit 0.0.0.0/0

!

route-map HQ2Branch permit 10

 match ip address prefix-list HQ2Branch

!

firewall-input 500 permit all tcp dport 179 src 10.0.0.0/8

!

firewall-access 500 permit outbound eth0 remark "Permit out to Internet"

firewall-access 501 permit inbound tap+ remark "Permit SD-WAN traffic"

!

firewall-snat 500 overload outbound eth0

!

security sslvpn-server 4 vrf 4

 server address sdwan.ransnet.com 1604

 server tap-mode

 encryption AES-256-CBC

 server client-to-client

 tunnel-pool 10.4.168.0/22

 client 00-60-e0-a3-59-f7

  static 10.4.168.10

 start

Option 2: Use dynamic route import (MP-BGP)

Static route leaking can be very hard to manage when you have hundreds or thousands of remote networks. So the simpler approach is to use MP-BGP to dynamically import routes between VRFs - run BGP instance in each VRF and import the routes from the target VRF.

Below is a complete config on the gateway/CMG router. In this sample case,  we just want service VRF-4 to have Internet breakout through default VRF.

• Configure static route leak in VRF-4 (via gateway in default VRF), for Internet access.

• Configure BGP in default VRF to dynamically import routes from VRF-4, so that default VRF knows the return paths.

• Optionally configure a route-map for the VRF route import, to only allow the authorized routes to leak into default VRF routing table (in below config, the routes 10.11.11.0/24 and 10.12.12.0/24 are not imported/leaked into default VRF because of the route-map filter).

• With dynamic route import, you don't need to set static tunnel IP for each remote branch routers.

Despite it's quite simple to config this feature, the impact can be significant if wrongly configured. So we only allow this config through CLI only. In below sample config CLI, we import routes from VRF-4 into default routing table (there's no VRF ID configured for the BGP instance so it means default routing table).

CLI Configuration Sample

Below are the relevant gateway CLI configs for reference only (other general configs are omitted). 

!

hostname Gateway

!

interface eth0

 description "Default connection to WAN"

 enable

 ip address 10.65.31.134/24

!

interface lo

 enable

 ip address 2.1.2.1/32

!

interface vlan 0 11 vrf 4

 enable

 ip address 10.11.11.1/24

!

interface vlan 0 12 vrf 4

 enable

 ip address 10.12.12.1/24

!

ip route 0.0.0.0/0 nexthop 10.65.31.1 remark "default route to Internet"

ip route 0.0.0.0/0 nexthop 10.65.31.1 vrf 4 nexthop-vrf default "default route to Internet for VRF-4"

!

router bgp 65051

 import vrf 4

 import vrf route-map VRF4_TO_DEFAULT

!

router bgp 65051 vrf 4

 bgp timer 5 15

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-peer

 neighbor 0168_RansNet_SSL3OPENVPN_4 as-remote 65051

 neighbor 0168_RansNet_SSL3OPENVPN_4 next-hop-self

 neighbor 0168_RansNet_SSL3OPENVPN_4 route-map HQ2Branch out

 neighbor 0168_RansNet_SSL3OPENVPN_4 route-reflector-client

 neighbor 0168_RansNet_SSL3OPENVPN_4 soft-reconfiguration

 neighbor 0168_RansNet_SSL3OPENVPN_4 weight 0

 neighbor range 10.4.168.0/22 as-peer 0168_RansNet_SSL3OPENVPN_4

 network 0.0.0.0/0

 network 10.11.11.1/24

 network 10.12.12.1/24

!

ip prefix-list HQ2Branch permit 0.0.0.0/0

ip prefix-list VRF4_TO_DEFAULT permit 192.168.0.0/16 ge 16

!

route-map HQ2Branch permit 10

 match ip address prefix-list HQ2Branch

!

route-map VRF4_TO_DEFAULT permit 10

 match ip address prefix-list VRF4_TO_DEFAULT

!

firewall-input 100 permit all tcp dport 179,22 src 10.0.0.0/8

!

firewall-access 500 permit outbound eth0 remark "Permit out to Internet"

firewall-access 501 permit inbound tap+ remark "Permit SD-WAN traffic"

!

firewall-snat 500 overload outbound eth0 remark "PAT to Internet"

!

security sslvpn-server 4 vrf 4

 server address sdwan.ransnet.com 1604

 server tap-mode

 encryption AES-256-CBC

 server client-to-client

 tunnel-pool 10.4.168.0/22

 client 00-60-e0-a3-59-f7

 client b0-bb-8b-00-e7-a8

 start

Gateway#