action.skip

Connecting MVEs Integrated with Palo Alto Networks Prisma SD-WAN

This topic describes how to connect a Megaport Virtual Edge (MVE) integrated with Palo Alto Networks Prisma SD-WAN to another MVE.

This deployment uses the Megaport private software defined network (SDN) to reduce reliance on the internet and connect enterprise branch locations.

Branch to branch

With two MVEs configured, you can create a private VXC to connect them on the Megaport network without the need for any physical infrastructure. A VXC is essentially a private point-to-point Ethernet connection between an A-End MVE and a B-End MVE.

Note

The internet-facing interface on an MVE can reach the internet-facing interface on another MVE over the public internet. That is, you can exchange traffic from MVE to MVE in different metros over the internet. The basic connection model consists of an MVE at one metro connecting via a Megaport Internet connection to an MVE at another metro. Connectivity consists of a customer/SD-WAN partner-managed connection, not Megaport managed. For more information, see Megaport Internet Overview.

Before you begin

Provision two MVEs in different locations. If you haven’t already created MVEs, see Creating an MVE Integrated with Palo Alto Prisma SD-WAN.

Creating a VXC between two MVEs

A private VXC deployment between two MVEs integrated with Palo Alto Networks starts in the Megaport Portal. To complete the configuration, you will use Palo Alto Networks Strata Cloud Manager.

To create a VXC

  1. In the Megaport Portal, go to the Services page and click +Connection next to the originating A-End MVE.

  2. Select Private VXC.

    Private VXC

  3. Select the destination B-End MVE and location.
    Use the Country filter to narrow the selection.

  4. Click Next.

  5. Specify the connection details:

    • Connection Name – The name of your VXC to be shown in the Megaport Portal. Specify a name for the VXC that is easily identifiable, for example, LA MVE 2 to Dallas MVE 4. You can change the name later, if you like.

    • Service Level Reference (optional) – Specify a unique identifying number for the VXC to be used for billing purposes, such as a cost center number or a unique customer ID. The service level reference number appears for each service under the Product section of the invoice. You can also edit this field for an existing service.

    • Rate Limit – The speed of your connection in Mbps. The maximum speed is displayed. Although the rate limit for a VXC can be up to 10 Gbps, the compute capacity of the A-End or B-End MVE can influence the circuit throughput. Consult Palo Alto Networks’ documentation for more information.

    • VXC State – Select Enabled or Shut Down to define the initial state of the connection. For more information, see Shutting Down a VXC for Failover Testing.

      Note

      If you select Shut Down, traffic will not flow through this service and it will behave as if it was down on the Megaport network. Billing for this service will remain active and you will still be charged for this connection.

    • vNIC selection – Depending on the definition of the MVEs you are using, you might have to specify A-End and B-End vNICs.

      • A-End vNIC – Specify a vNIC by using the pre-populated default, or select from the drop-down list.

      • B-End vNIC – Specify a vNIC by using the pre-populated default, or select from the drop-down list.

        For more information on vNIC selection when connecting MVEs with different services, see Types of vNIC Connections.

    • Preferred A-End VLAN – Specify the 802.1q VLAN tag for this connection for the A-End.
      Each VXC is delivered as a separate VLAN on the MVE. The VLAN ID must be unique on this MVE and can range from 2 to 4093. If you specify a VLAN ID that is already in use, the system displays the next available VLAN number. The VLAN ID must be unique to proceed with the order. If you don’t specify a value, Megaport will assign one. For a Palo Alto Networks MVE, it will also be used to configure the VLAN tag in Palo Alto Networks PAN-OS.

    • Preferred B-End VLAN – Specify the 802.1q VLAN tag for this connection that you will receive through the B-End VLAN. For a Palo Alto Networks MVE, it will also be used to configure the VLAN tag in Palo Alto Networks PAN-OS.

    • Minimum Term – Select No Minimum Term, 12 Months, 24 Months, or 36 Months. Longer terms result in a lower monthly rate. 12 Months is selected by default.
      Take note of the information on the screen to avoid early termination fees (ETF). For more information, see VXC Pricing and Contract Terms and VXC, Megaport Internet, and IX Billing.

  6. Click Next to view the Summary page.

  7. Confirm the configuration and click Add VXC.

  8. Click Order to proceed through the checkout process.

Once the VXC is deployed, you can view it in the Megaport Portal Services page. The Services page displays the VXC under the A-End MVE and the B-End MVE. Note that the service identifier number is the same for the VXC at both ends of the connection.

The next step is to configure the A-End and B-End MVEs on the Palo Alto Prisma SD-WAN side. For more information on specific network design and configuration options before configuring interfaces for the MVEs, see the Palo Alto Prisma SD-WAN documentation.