1 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA LABS604 - Essentials for quickly deploying and configuring NetScaler SD-WAN ​Delivery Network Group ​Technical Marketing Engineer MAY 22, 2019

2 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Agenda Basic Introduction to SD-WAN –Module 1: SD-WAN Installation and Configuration –Module 2: SD-WAN Provisioning and Change Management Advanced features to SD-WAN –Module 3: Getting to know the SD-WAN lab environment –Module 4: Features introduced in SD-WAN –Module 5: Features introduced in SD-WAN Welcome

3 ​“The Underlay Network” ​Existing Customer Topology ​Module 1

4 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Existing Customer Network / “The Underlay Network” Branch BBranch A Secondary Data Center Primary Data Center Branch C … Branch N Firewall MPLS Internet

5 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Understand the Existing Network What are you looking to solve? Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router MPLS Queues? VPN in place? Available Static Public IP? iPerf bandwidth measurement? Speedtest bandwidth measurement? Network challenges? –Congested MPLS –Application reliability –Serving high-definition applications (videos, photos, etc.) –Hardware operation and management Network specifics? –Model/Software routers, firewalls, etc –VPN –Accuracy of WAN links speeds –Firewall blocking UDP or limiting speed –Lab environment for PoC, availability of downtime if production PoC Standby?

6 ​“SD-WAN Overlay Network” ​Topology Design ​Module 1

7 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA NetScaler Product Portfolio NetScaler ADCNetScaler GatewayNetScaler SD-WAN Single link QoS Application optimization Application visibility WANOP Edition (WO) Multi Link aggregation WAN path resiliency Application optimization Path/Application visibility Hardware consolidation Enterprise Edition (EE) Multi Link aggregation WAN path resiliency WAN path visibility Hardware consolidation Standard Edition (SE)

8 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Picking the Right Solution List out Success Criteria Better utilize a single MPLS link Optimize business critical apps WAN and HDX insight Increase WAN link capacity Increase application availability Monitor uptime on WAN paths Hardware consolidation Optimize business critical apps WAN and HDX insight NetScaler SD-WAN Data Sheet us/documents/data-sheet/netscaler-sd-wan- datasheet.pdf Sizing & Pricing Guide for Partners: NetScaler SD-WAN ?id= SD-WAN - SESD-WAN - WOSD-WAN - EE

9 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN WANOP Edition Solve single link performance issues of application delivery and visibility Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN - WO Standby Suggested deployment: Inline across MPLS using bypass pair SD-WAN - WO Suggested deployment: Virtual Inline (PBR or WCCP) in High Availability pair NetScaler Insight Center

10 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN Standard Edition Solve WAN link capacity and application reliability Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN - SE Active Suggested deployment: Inline across all WAN Links using bypass pair SD-WAN - SE Suggested deployment: Virtual Inline (PBR) in High Availability pair NetScaler SD-WAN Center

11 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN Enterprise Edition Solve WAN link capacity, application reliability, network and application visibility Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN – EE Active Suggested deployment: Inline across all WAN Links using bypass pair SD-WAN - SE Suggested deployment: SE: Virtual Inline (PBR) in HA WO: Virtual Inline (WCCP) in HA NetScaler SD- WAN Center SD-WAN - WO NetScaler Insight Center

12 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN Overlay Product Selection Mix and match as needed Branch BBranch A Secondary Data Center Primary Data Center Branch C … Branch N Firewall SD-WAN – WOSD-WAN – SESD-WAN – EE SD-WAN – WO SD-WAN – SE WO SE MPLS Internet No problems & no needs  No SD-WAN

13 ​“SD-WAN Overlay Network” ​Configure SD-WAN Topology ​Module 1

14 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN Lab Configuration and Deployment NetScaler SD-WAN VPX Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN - SE Active Lab deployment: Inline Edge/Gateway Mode Lab deployment: Inline Transparent Mode NetScaler SD-WAN Center Mgmt. SD-WAN - SE 4G/LTE

15 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN Controller (Configuration Editor) Building the SD-WAN Overlay Configuration Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN - SE Active Lab deployment: Inline Edge/Gateway Mode Lab deployment: Inline Transparent Mode NetScaler SD-WAN Center Mgmt. SD-WAN - SE 4G/LTE

16 ​“SD-WAN Overlay Network” ​Provision SD-WAN Topology ​Module 2

17 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN Change Management Provisioning SD-WAN Overlay Configuration and Software Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN - SE Active Lab deployment: Inline Edge/Gateway Mode Lab deployment: Inline Transparent Mode NetScaler SD-WAN Center Mgmt. SD-WAN - SE 4G/LTE

18 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA SD-WAN Lab Virtual Path Good path state indicates successful configuration

19 ​“SD-WAN Overlay Network” ​Troubleshooting SD-WAN Environment ​Module 2

20 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Troubleshooting SD-WAN VIP Connectivity Ping Test 2 INET ping connectivity Remote VIP to DC VIP 1 MPLS ping connectivity Remote VIP to DC VIP 3 LTE ping connectivity Remote VIP to DC VIP

21 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Troubleshooting SD-WAN VIP Connectivity Trace Route 1 On Host B Trace Route to Host A 2 HOP #1 3 Host B HOP #2 HOP #3 Host A 4 Destination

22 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Network firewall configuration requirement 1 Src: Local VIP and 4980 Dst: MCN Static Public IP and port Firewall builds entry in NAT table 3 Firewall configured to port-forward :1 NAT: Static Public IP to MCN INET VIP Firewall builds entry in NAT table for dynamic public IP of branch 4 MCN dynamically learns off all remote sites (IP and port) then shares with SD-WAN network One Static Public IP address for each Data Center Internet WAN link Datacenter firewall needs port forwarding rule to allow 4980 UDP (pinhole) UDP Hole Punching option available for remote site ISP firewall (if supported)

23 ​SD-WAN Features ​Release ​Module 3

24 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Dynamic Routing on SD-WAN OSPF, iBGP, eBGP Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN - SE Router Replacement OSPF/BGP

25 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA MPLS VIP: MPLS VIP INET VIP: INET VIP G VIP: G VIP Dynamic Routing with SD-WAN Overlay Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router Virtualized Overlay Network Underlay Network MPLS 4G/LTE Internet SD-WAN - SE OSPF SD-WAN BR Route Table Dst: /16  SD-WAN DC Dst: /16  SD-WAN DC SD-WAN BR Route Table Dst: /24  SD-WAN BR

26 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA DHCP Server on SD-WAN SD-WAN - SE 4G/LTE Core Hosts Mgmt. Internet MPLS DHCP IP Lease Request DHCP IP Lease Offer

27 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Internet Traffic Backhaul with SD-WAN Firewall Internet MPLS Firewall Router Core Data Center Remote Core Router SD-WAN - SE Internet Service enabled at Data Center

28 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Direct Internet Breakout at Remote Branch Firewall Internet MPLS Router Core Data Center Remote Core Router SD-WAN - SE Internet Service enabled at Remote Branch Secure Web Gateway Firewall Replacement

29 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Routing Domains on SD-WAN Secondary Data Center Primary Data Center Firewall SalesManufacturingMarketingEngineering IT Firewall Support Firewall MPLS Internet Routing Domain

30 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Zero Touch Deployment for SD-WAN Branch B Primary Data Center New Site Firewall Internet MPLS Citrix Zero Touch Deployment Service SD-WAN Center Branch A 1 SD-WAN Admin builds config for new site. SD-WAN Admin authorizes ZTD deployment request 2 Installer connects new SD-WAN to internet, powers on, and uses serial number to activate 3 ZTD Service validates the two-factor authentication 4 Virtual Path establishment between SD- WANs

31 ​SD-WAN Features ​Release ​Module 4

32 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Metered Links on SD-WAN Internet MPLS Firewall Router SD-WAN - SE 4G/LTE Metered Link Link of Last Resort

33 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Underlay network MPLS Quality of Service and bandwidth % SD-WAN Configuration to match MPLS QoS Queues Configuration on SD-WAN Internet MPLS Router Firewall Router SD-WAN - SE Bulk 20% AF11 50% EF 30% 10Mbps MPLS Bulk – 2Mbps AF11 – 5Mbps EF – 3Mbps 100Mbps MPLS Bulk – 20Mbps AF11 – 50Mbps EF – 30Mbps INET 100%

34 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Trusted links – no encryption if behind Firewall or VPN Untrusted links – force encryption Datasheet specs with AES-128 bit AES-256 bit IPsec using Level 1 FIPS certified IPsec cryptographic binary IPsec Data Encryption on SD-WAN Internet MPLS Router VPN Router SD-WAN - SE Data Encryption

35 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA User controlled BAD state % loss Additional configurable parameters Path State Sensitivity Control Internet MPLS Router Firewall Router SD-WAN - SE BAD / DEAD Path State GOOD Path State

36 ​SD-WAN ​Closing Remarks

37 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA Upgrade Procedure

38 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA

39 © 2017 Citrix | Summit 2017 | Confidential – Content in this presentation is under NDA