Deployment Modes
A SD-WAN appliance acts as a virtual gateway. It is neither a TCP endpoint nor a router. Like any gateway, its job is to buffer incoming packets and put them onto the outgoing link at the right speed. This packet forwarding can be done in different ways, such as inline mode, virtual inline mode, and WCCP mode. Although these methods are called modes, you do not have to disable one forwarding mode to enable another. If your deployment supports more than one mode, the mode that the appliance uses is determined automatically by the Ethernet and IP format of each packet.
Because the appliance supports different forwarding modes and different kinds of non-forwarded connections, it needs a way of distinguishing one kind of traffic from another. It does so by examining the destination IP address and destination Ethernet address (MAC address), as shown in table below. For example, in inline mode, the appliance is acting as a bridge. Unlike other traffic, bridged packets are addressed to a system beyond the appliance, not to the appliance itself. The address fields contain neither the appliance’s IP address nor the appliance’s Ethernet MAC address.
In addition to pure forwarding modes, the appliance has to account for additional types of connections, including management connections to the GUI and the heartbeat signal that passes between members of a high-availability pair. For completeness, these additional traffic modes are also listed in table below.
Table 1. How Ethernet and IP Addresses Determine the Mode
| Destination IP Address | Destination Ethernet Address | Mode |
|---|---|---|
| Not appliance | Not appliance | Inline or Pass-through |
| Not appliance | Appliance | Virtual Inline or L2 WCCP |
| Appliance | Appliance | Direct (UI access) |
| Appliance (VIP) | Appliance | High-Availability. Proxy mode |
| Appliance (WCCP GRE Packet) | Appliance | WCCP GRE Mode |
| Appliance (Signaling IP) | Appliance | Signaling Connection (SD-WAN plugin Signaling Connection (SD-WAN plugin, Secure Peer) or Redirector Mode Connection (SD-WAN plugin) |
All modes can be active simultaneously. The mode used for a given packet is determined by the Ethernet and IP headers.
The forwarding modes are:
- Inline mode, in which the appliance transparently accelerates traffic flowing between its two Ethernet ports. In this mode, the appliance appears (to the rest of the network) to be an Ethernet bridge. Inline mode is recommended, because it requires the least configuration.
- WCCP mode, which uses the WCCP v. 2.0 protocol to communicate with the router. This mode is easy to configure on most routers. WCCP has two variants: WCCP-GRE and WCCP-L2. WCCP-GRE encapsulates the WCCP traffic within generic routing encapsulation (GRE) tunnels. WCCP-L2 uses un-encapsulated network Layer 2 (Ethernet) transport.
- Virtual inline mode, in which a router sends WAN traffic to the appliance and the appliance returns it to the router. In this mode, the appliance appears to be a router, but it uses no routing tables. It sends the return traffic to the real router. Virtual inline mode is recommended when inline mode and high-speed WCCP operation are not practical.
- Group mode, which allows two appliances to operate together to accelerate a pair of widely separated WAN links.
- High availability mode, which allows to appliances to operate as an active/standby high availability pair. If the primary appliance fails, the secondary appliance takes over.
Additional traffic types are listed here for completeness:
- Pass-through traffic refers to any traffic that the appliance does not attempt to accelerate. It is a traffic category, not a forwarding mode.
- Direct access, where the appliance acts as an ordinary server or client. The GUI and CLI are examples of direct access, using the HTTP, HTTPS, SSH, or SFTP protocols. Direct access traffic can also include the NTP and SNMP protocols.
- Appliance-to-appliance communication, which can include signaling connections (used in secure peering and by the SD-WAN plugin), VRRP heartbeats (used in high-availability mode), and encrypted GRE tunnels (used by group mode).
- Deprecated modes. Proxy mode and redirector mode are legacy forwarding modes that should not be used in new installations.
SD-WAN 4100/5100 appliances have two recommended deployment modes: WCCP and inline. These modes are commonly used without high availability (high availability), and less commonly with high availability.
Currently, Citrix recommends WCCP mode, with a single router and without high availability, for most deployments. Use inline mode when WCCP is not available.
Although not all of the following modes are recommended currently, they are all supported:
- WCCP mode with a single router
- WCCP mode with a single router and high availability
- Cascade of two or more appliances in WCCP mode along with a NetScaler MPX Appliance
- Cascade of two or more appliances in WCCP mode along with a NetScaler MPX Appliance in high availability
- Inline mode
- Inline mode in high availability
- Virtual inline mode
- Virtual inline mode in high availability
Note
While modes other than WCCP and inline are supported, they are incompletely documented and are not recommended for typical installations. Please contact your Citrix representative when considering one of these modes.