Talari APN Configuration Editor User's Guide · 2017-03-22 · 2 Talari APN Configuration Editor...

EXHIBIT 1016

Adaptive Private NetworkingCon�guration Editor User’s GuideAPNware Release 2.5

FATPIPE-001374Viptela, Inc. - Exhibit 1016

Page 1

2

Talari APN Configuration Editor User’s Guide

About Talari™ Networks

Talari Networks is redefining WAN reliability and performance quality. By aggregating multiple broadband links and continuously adapting to the quality of the network, Talari enables true enterprise-class quality and reliability at consumer prices. Talari’s patented technology delivers 30-100 times gain in bandwidth per dollar, 40-90 percent on-going WAN cost reductions and greater visibility and reliability than MPLS or any other private network. Talari has received numerous industry awards and accolades including being named a Gartner Cool Vendor, Best of Interop — Performance Optimization and Techworld Awards — 2012 Networking Application Product of the Year. For more information, visit www.talari.com.

Talari Networks, Inc. reserves the right to make changes to its products or to discontinue any product or service without notice.

Talari is a trademark of Talari Networks, Inc. All other trademarks mentioned in this document or website are the property of their respective owners.

© Talari Networks, Inc., 2013

Talari Networks, Inc.

550 S.Winchester Blvd., Suite 500San Jose, CA 95128 USA

+1 408 689 0400 +1 408 864 2124 [email protected] | www.talari.com


Page 2

3


Table of ContentsIntroduction ........................................................................................ 5

Reference Documents ..................................................................... 5Hardware and Software Requirements ........................................... 5Request for Comments ................................................................... 5

Getting Started ................................................................................... 6Installing Java .................................................................................. 6Accessing the Program ................................................................... 6Talari Configuration Files ................................................................ 6Navigation ....................................................................................... 7

Menu Bar .........................................................................................................................9Toolbar .......................................................................................................................... 11

Sites ....................................................................................................12New NCN or Client Site ................................................................. 12Clone Site Configuration Wizard ................................................... 12

Appliances .........................................................................................18Interface Groups ........................................................................... 19Virtual IP Addresses ...................................................................... 20Routes ........................................................................................... 20

Conduits .............................................................................................22Classes ................................................................................................26Rules ...................................................................................................28

Selection Criteria .......................................................................... 28Conduit Rule Properties ................................................................ 29

Network Services .............................................................................35Adding Internet Service ................................................................ 35

Internet Rules.............................................................................................................. 35

Adding Intranet Service ................................................................ 37Intranet Rules .............................................................................................................. 38


Page 3

4


WAN Links ..........................................................................................40High Availability ...............................................................................51Default Sets .......................................................................................53

Conduit Default Set ....................................................................... 53Conduit Default Set Classes................................................................................... 54Conduit Default Set Rules ...................................................................................... 56

Conduit Rule Properties ................................................................ 57Internet Default Set ...................................................................... 63

Internet Default Set Rules ...................................................................................... 63

Intranet Default Set ...................................................................... 65Intranet Default Set Rules ...................................................................................... 66

Sample Configuration File ..............................................................68Glossary .............................................................................................72Index ...................................................................................................74


Page 4

Introduction - 5


IntroductionThe Talari Adaptive Private Networking Configuration Editor User’s Guide is intended to provide you with the basic steps of creating an Adaptive Private Networking configuration file through the use of the Talari Configuration Editor Tool. The reader of this document is expected to be familiar with the physical setup and operation of networking equipment.

Reference DocumentsFor detailed information about installing, configuring, and maintaining your Talari system, please consult the appropriate guide:

• APN Configuration Reference• APN Appliance Hardware Guides• APN Appliance Quick Start Guide• APN Appliance Operation Guide

Hardware and Software RequirementsTalari Mercury appliances have the following hardware and software requirements:

Hardware: The Talari T510, T730, T750 ,T3000 and T5000 Mercury appliances require a standard 19 inch (480mm) two or four post rack for mounting.

Software: The Talari APNA Web Console is supported in latest versions of the following web browser applications.

• Microsoft IE7 – IE9• Mozilla Firefox • Google Chrome• Apple Safari

Supported browsers must have cookies enabled.

Supported browsers must have Javascript installed and enabled.

Sun JRE 6 Update 10 or newer is required for using the APN Configuration Editor Utility.

Display: A minimum screen resolution of 1024 x 960 or greater is recommended.

Request for CommentsWe value the opinions and experiences of our readers. To offer feedback or corrections for this guide, please contact Talari Networks: http://www.talari.com/support.


Page 5

http://www.talari.com/support










Getting Started - 6


Getting Started

Installing JavaSun JRE 6 Update 10 or newer is required for using the APN Configuration Editor Utility. Please refer to the SUN Java SE Download web site for instructions on downloading and installing JRE 6 software. The link is: http://www.java.com.

Accessing the ProgramTo access the APN Configuration Editor, select Launch APN Config Editor from the Manage Network drop-down menu of your NCN Talari Web Console. The Configuration Editor may also be launched within the Network Management -> Change Management -> Change Preparation screen, if needed.

Depending on the type of browser you use, this may also save a Java Network Launch Protocol (JNLP) icon, (shown below) to your desktop. Double clicking on the icon will result in a prompt to accept the download and open the configuration editor. This download process will only need to be done the first time the Configuration Editor is needed.

Talari Configuration FilesBeginning with APN software (APNware) release 1.4, partially completed or invalid configuration files may be saved for future use. While these partial configurations are considered invalid by Talari appliances, the ability to save them as partial files allows for troubleshooting or future editing. When an attempt is made to save an invalid configuration, the appliance will produce an error message and automatically save the file as a partial configuration. In addition, you may save your invalid or partial configuration file by selecting File -> Save As from the pull-down menu and save the configuration


Page 6

http://www.java.com/en/download/manual.jsp

http://www.java.com/en/download/manual.jsp

Getting Started - 7


file with a “.ptl” file extension. It should be noted that, unlike a valid configuration file, a partial configuration file is not viewable in common text editors. Note that partial file loading will not work between different Talari APNware versions. For example, a partial file created with version 2.3 may not work properly with version 2.5.

Note: You may need to clear the Java cache in order to use the Talari APN Config Editor. Instructions may be found at: www.java.com/en/download/help/plugin_cache.xml.

NavigationThe Talari APN Configuration Editor is designed using a tree menu architecture, with Objects listed on the left of the frame linking to Children Objects on the right. There are both a Menu bar and Toolbar for use in navigating the Configuration Editor.

Objects

Menu Bar

Toolbar

Navigation Tree

Objects and their corresponding Children Objects are listed below.

OBJECTS Child Objects(added, edited, or deleted on the panel or toolbar)

Configuration Sites, Default Sets (Conduit, Internet, Intranet)

Site HA Appliance

Appliance Interface Group, Virtual IP Addresses, Routes, Conduits, Network Services, WAN Links


Page 7

Getting Started - 8


Conduit Rules, Classes, Paths

Internet Service Rules

Intranet Service Rules

WAN Link Services (conduit usages, and net service usages), Service Groups

Default Sets Rules, Classes (Conduit Default Sets)

A summary of allowed and allocated resources is also provided in the Configuration panel to assist the administrator in tracking APN sites, conduits and paths. A sample is shown below.


Page 8

Getting Started - 9


Menu BarA summary of actions available via the menu bar is shown below.

File

New Select to create a new configuration file.

Open Select to import an existing configuration file. A dialog window will open to allow for locating the configuration file to be loaded into the Configuration Editor. The imported file will undergo a validation check.

Save Select this option to save changes to the existing configuration file.

Save As Select this option to save the current configuration file with a new name or location. Partial or invalid configuration files may be saved with a “.ptl” file extension.

Import from APN Transfers configuration data from the NCN to the APN Configuration Editor.

Export to APN Transfers the configuration data from the APN Configuration Editor to the NCN.

Exit Select to exit the Configuration Editor.

Tools

Audit Configuration

Select to have current loaded configuration validated by the Configuration Editor.

Gather Diagnostics

This presents a File dialog box where the user can enter a filename to save diagnostic data in a .zip file, so it can then be sent off to Talari Networks Support team for further investigation.

Examples of Audit results are shown below. Audits are also automatically performed when opening or saving a configuration file.


Page 9

Getting Started - 10


Help

User’s Guide Clicking this option opens a pop-up window with a pdf version of the Configuration Editor User’s Guide.

About Click to view Talari Networks APN Configuration Editor versioning and contact information.


Page 10

Getting Started - 11


ToolbarA summary of actions available via the toolbar is shown below.

Icon Function

Import configuration from NCN appliance.

Export configuration to NCN appliance.

Open a configuration file.

Save a configuration file.

Save an imported configuration file locally.

Add a new NCN or Client site.

Clone an existing Client site.

Delete a site.

Add a default Conduit, Internet or Intranet set. Appears when parent object is selected.

Delete a default Conduit, Internet or Intranet set. Appears when parent object is selected.

Add an Internet or Intranet network service. Appears when parent object is selected.

Delete an Internet or Intranet network service. Appears when parent object is selected.

Create a conduit between this site and a remote site. Appears when parent object is selected.

Delete a conduit between this site and a remote site. Appears when parent object is selected.

Add a WAN link to an appliance. Appears when parent object is selected.

Delete a WAN link from an appliance. Appears when parent object is selected.

Add an HA appliance to the selected appliance. Appears when parent object is selected.Delete an HA appliance from the selected appliance. Appears when parent object is selected.


Page 11

Sites - 12


Sites

New NCN or Client SiteAdd NCN or Client Site

Model Select the model of the APN appliance. This is used to verify that ports are used correctly in interface groups.

Mode Select a mode (client, primary_ncn, secondary_ncn) for the new appliance.

Site Name Type a unique site name comprised of less than 32 characters, each of which is an alphanumeric, dash, or underscore. The first character of the site name must be a letter.

Appliance Name Type a unique appliance name comprised of less than 32 characters, each of which is an alphanumeric, dash, or underscore. The first character of the appliance name must be a letter.

Secure Key Type a unique 8-16 digit hexadecimal number.

Clone Site Configuration WizardTo make it easier to add a new client site to a configuration, Talari APN Configuration Editor now allows the user to clone a pre-existing site’s configuration as a new site.

To clone an existing site using the Talari APN Configuration Editor, select the site that you would like to clone, and click the Clone Site button. This will bring up a dialog screen containing the cloned site information that must be changed before being allowed to save the new site information. See Figure 1 below.


Page 12

Sites - 13


Figure 1

The Site Cloning ProcessA new cloned site must contain its own valid site configuration. In other words, the existing information from the site being cloned (presented on the screen in red) must be changed before the new site can be created. As you make the needed changes, the text will change from red to black. Any particular portion of the site being cloned that is uneeded in the new cloned site may be excluded by clicking on that line item and then clicking the Exclude button, and graying out the uneeded information. Please see Figure 2 below.


Page 13

Sites - 14


Provide site and appliance names for cloned site

Provide a new secure key

Provide new VLAN Virtual IPaddresses and pre�xes,or exclude a particular VLANfrom the cloned site

Provide new WAN linknames, Virtual IP andGateway addresses forthe new cloned site,or exclude particularWAN links

Provide new local route and gateway addresses,or exclude a particular localroute from the cloned site

Figure 2

Once you have edited the screen making sure that all fields are valid and unique from their original values, the OK button will be enabled (Figure 3). Clicking the OK button will allow an audit of the new site to make sure the information will be valid for your configuration. If any errors are found, you will receive an error message pointing out that needs to be corrected.


Page 14

Sites - 15


Figure 3. New site ready for audit.

If the audit succeeds, you will be presented with a screen detailing the next steps that need to be performed in making your new site functional in your network (see Figure 4).


Page 15

Sites - 16


Figure 4. Next steps in the site cloning process message.

Next Steps in the Site Cloning ProcessSample Next Steps for the newly created client site called “ClonedSite:”

1. Please review the configuration of your new Site ‘ClonedSite’ to ensure all information is correct. The following parameters may need to be modified:

• WAN Link Rates and other WAN Link settings• Interface Groups, including VLANs• Conduit Service configuration, including Rules and Classes• Internet/Intranet Service configuration, including Rules• Routes• High Availability, if desired (no HA settings have been copied from the original site)

2. Provision the Conduit Service for your new Site. Navigate to the desired WAN Link(s) at each of the following Sites and enable the new Conduit Service on the Service Properties tab, then use the Provisioning tab to allocate bandwidth as necessary:

• Fargo

3. Add paths for all Conduits connecting to your new Site. Some helpful tips to make this process simpler:

• When setting the Service Properties for a Conduit Service, enabling Auto-gen Paths will automatically create paths to any other remote WAN Link used by the Conduit that also has


Page 16

Sites - 17


path auto-generation enabled. This option is only available for public Internet WAN Links.• If not utilizing path auto-generation or the necessary paths are between to private Intranet

WAN Links, navigate to the Paths tab of the Conduit to add paths manually. If a path is added with the Reverse Also option enabled, a second path with the same configuration will be created in the reverse direction.


Page 17

Appliances - 18


AppliancesTo configure an APNA, highlight the desired appliance and provide new, or modify existing appliance information.

Appliance

NameType a unique appliance name comprised of less than 32 characters, each of which is an alphanumeric, dash, or underscore. The first character of the appliance name must be a letter.

Secure Key Type a unique 8-16 digit hexadecimal number.

Model Select the model of the APN appliance. This is used to verify that ports are used correctly in interface groups.

Mode Select a mode (client, primary NCN, secondary NCN) for the new appliance.

Default Local Route Cost

The default route cost used for routes added on this APNA. Cost must be between 1 and 15. Lower cost routes will be preferred over higher cost routes.

Enable WAN to WAN Forwarding

If set, this indicates that this site will be used as a proxy for Mutli-Hop APN traffic.

Route CostThe route cost advertised for Multi-Hop routes that travel through this appliance. This cost must be between 1 and 15. Lower cost routes will be preferred over higher cost routes.


Page 18

Appliances - 19


Interface Groups

Adding New or Editing an Existing Interface Group

Secure Zone Determines whether the interface group is on a trusted segment (such as behind a firewall) or untrusted segment (such as WAN AUX).

Bypass Mode If the ports in the interface group form a bypass pair, setting this to “fail_to_wire” will cause the interfaces to go into bypass mode when the Talari service is not running. The default setting is “fail_to_block.”

Ethernet Interfaces

Check the box of corresponding Ethernet devices in this interface group.

Bridge Pairs

Device One The name of the first device to be used in this bridge_pair. Must correspond to an Ethernet interface used within this interface group.

Device Two The name of the second device to be used in this bridge_pair. Must correspond to an Ethernet interface used within this interface group.

Virtual Interfaces


Page 19

Appliances - 20


Name The name to be used when referencing this virtual interface through the configuration and user interfaces.

VLAN ID The VLAN ID to be used for identifying and marking traffic to and from this VLAN.

Virtual IP Addresses

Adding New or Editing an Existing Virtual IP Address

Virtual Interface The name of the virtual interface that this IP address is associated with.

IP Address A valid local IP used for arping on the subnet designated by the given prefix. Can also be used as a gateway. Netmask must be included.

RoutesAdding New or Editing an Existing Routes


Page 20

Appliances - 21


Network Address This subnet will be used in the forwarding information database. Packets destined to this subnet will be directed to the given service.

Cost The route cost for this route. This cost must be between 1 and 15. Lower cost routes will be preferred over higher cost routes.

Service Select the service for this route.

Next Hop Site Name

If the route service is conduit, this is the remote site of the conduit to which packets will be directed.

Gateway IP Address

If the route service is not conduit, this is the IP address of the gateway to which packets will be directed. If the service is Internet or Intranet, the Gateway IP Address may not be set.

Enable Eligibility Based on Gateway

Enabling this option will cause a route to only be valid if the gateway specified in this route is reachable. Eligible for use in local routes only.

Intranet Name The name used to reference this Intranet Service instance.

Enable Eligibility Based on Path

Used for Intranet Services, enable the Intranet route failover feature. When used, route eligibility will be based on the state of an associated path.

Path Select Path upon which Eligibility is based.


Page 21

Conduits - 22


ConduitsAdding or Editing a Conduit

Remote Site Name

The remote site to which the conduit will connect to the current site.

Reverse Also Check if this conduit should be automatically created in the reverse direction. If not, it must be explicitly defined at both sites.

Properties

Tracking IP Address (and Addresses)

The virtual IP address that will be correlated with the state of this conduit, allowing it be tracked via ping.

Default Set Name of the set of conduit defaults that will be used to populate rules and classes.

Fallback Intranet If the site has multiple Intranet services, the user must decide which of these Intranet services should be used as the fallback service for this conduit.


Page 22

Conduits - 23


Reverse Also Check if this conduit should be automatically created in the reverse direction. If not, must be explicitly defined at both sites.

Paths (Basic)

From Site/Link Select the site for the source site and WAN link of the path.

To Site/Link Use this to select the destination site and WAN link of the path.

Reverse Also Indicates that a path between the same WAN links, but in the opposite direction, will be added by the Configuration compiler.

IP Tagging Permits the user to set DSCP tags in the IP header for path traffic. The user may configure the down stream router to use these fields to ensure unique paths through the network.

Paths (Advanced)

Enable Encryption

Indicates whether packets sent along this path should be encrypted.


Page 23

Conduits - 24


Bad Loss Sensitive

If unchecked, high loss will not cause the path to go BAD.

Instability Sensitive

If unchecked, instability will not cause the path to go BAD.

Tracking IP Address (and Addresses)

The virtual IP address that will be correlated with the state of this path, allowing it to be tracked via ping utility.

Reverse Tracking IP

The virtual IP address that will be correlated with the auto configured reverse path, allowing it to be tracked via Ping utility.

Defaults

Override Rule From Default Set

If checked, Rule Defaults from this Conduit Default Set will not be used, and custom Rule Defaults may be entered.

Packet Duplication Hold Time

Used to allow a lost packet on a fast path to be replaced by its replacement on its duplicate path that is slower, without causing reorder issues. Duplicate must be in order as well, as this will hold prior out-of-order packets up to this time. If the time expires, the waiting packet will be sent, and the delayed packet will be discarded.

Non-TCP Packet Resequencing

Hold Time Sets the default amount of time (in milliseconds) for UDP packets to be held in the conduit awaiting the re-sequencing of in-order flows.

Discard Late Packets

If checked, any packets received after the Hold Time has expired will be discarded. If unchecked, the packets will be sent.

TCP Packet Resequencing


Page 24

Conduits - 25


Hold Time Sets the default amount of time (in milliseconds) for TCP packets to be held in the conduit awaiting the re-sequencing of in-order flows.


If checked, any packets received after the Hold Time has expired will be discarded. If unchecked, the packets will be sent.

TCP Class The default class for TCP-based rules in which a class id or class name was not set.

UDP Class The default class for UDP-based rules in which a class id or class name was not set.

Other Class The default class for non TCP and non UDP based rules in which a class id or class name was not set.

Enable TCP Termination

Check to enable TCP Termination as a default Conduit feature on TCP-based rules.

Note: When transferring files using FTP or SCP with TCP termination enabled, the reported rate of transfer is the rate between local client machine and local APNA. Since TCP termination buffers numerous TCP packets and acknowledges incoming packets locally, the transfer rate can be much higher than the user’s WAN link bandwidth. The transfer is reported complete only when all the packets are sent to the destination and acknowledgement is received. Therefore, their may be some delay between seeing a message that the files are 100% sent and the transfer actually being complete.


Page 25

Classes - 26


ClassesConduit Class

Class Name A text name that can be used to reference this class.

Class Type Select a class type to configure (Realtime, Interactive, or Bulk).

Realtime

Kbits per SecondInitial Rate

Defines the maximum initial rate in kbps that this class may consume while the time taken is less than the Initial Period setting.

Kbits per SecondSustained Rate

Defines the rate this class may consume of the conduit bandwidth in kbps if queue depth is greater than the Initial Period setting.

PercentageInitial Rate

Defines the maximum initial rate as a percentage of the conduit total bandwidth that this class may consume while the queue depth is less than the Initial Period setting.

PercentageSustained Rate

Defines the rate this class will use of the conduit bandwidth as a percent share of the entire conduit.

Initial Period Defines the queue depth (in milliseconds) at which switch is made between initial rate and sustained rate.

Interactive

Initial Share (Percent)

Defines the maximum initial rate in as a percentage of the conduit total bandwidth that this class may consume while the queue depth is less than the Initial Period setting.


Page 26

Classes - 27


Sustained Share (Percent)

This setting defines the rate this class will use of the conduit bandwidth as a percent share of the entire conduit.

Initial period (ms) Defines the queue depth at which switch is made between the Initial Rate and the Sustained Rate.

Bulk

Bulk Share Percentage

Percentage of the all the bulk classes’ share of the conduit bandwidth that this class will use.


Page 27

Rules - 28


Rules

Selection CriteriaGeneral

Precedence Select precedence used to determine the order in which rules are applied.

IP Address

Source IP Address Provide source IP address with which to match source packet addresses.

Use for Destination

Use the Source IP address for the Destination as well.

Destination IP Address

Provide destination IP address with which to match destination packet addresses.

DSCP

DSCP Select an explicit DSCP tag as set in IP protocol fields in IP protocol header.

Rebind Flow When DSCP Changes

If checked, flows which are otherwise identical in terms of match criteria will be treated as separate if their DSCP fields differ.


Page 28

Rules - 29


Protocol

Protocol String Select a protocol that the flow must match.

Protocol Number Provide the IP protocol number that a flow must match.

Port

Source Port Source port number that a flow must match.

Use for Destination

If checked, the Source port will be used for the Destination port as well.

Destination Port Destination port number that a flow must match.

Conduit Rule PropertiesWAN General

Mode Defines transmit mode. Select from the four available methods of transferring packets: load_balance_paths, which balance across multiple paths, duplicating across the two most unique paths (duplicate_paths), sending on a single persistent_path, and override_service.

Retransmit Lost Packets

This parameter specifies that flows matching this rule will be sent using reliable service to the remote appliance and, as such, that any packets lost will be retransmitted.

Override Service The destination service that flows of this type should go to.


Page 29

Rules - 30


Traffic Optimization

TCP TerminationEnable TCP Termination

Check to enable TCP Termination feature on TCP-based rules. Please see the APN Configuration Reference for more information on TCP Termination.

Min Resource Allows the user to specify the minimum resource allocation percentage for TCP Termination traffic on this rule. Please see the APN Configuration Reference for more information.

Enable Packet Aggregation

Check to aggregate conduit user data packets that match this rule.

Enable GRE Header Compression

Check to perform GRE header compression.

Enable IP, TCP, UDP Header Compression

Check to perform IP, TCP, or UDP header compression. This feature will be available in a future release.

Application Name A name given to a rule that will allow rule statistics to be summed in groups when they are displayed.

Track Performance

Check to track performance of a rule over time. Data will be recorded in a session DB including loss, latency, jitter and bandwidth used.

WAN Ingress


Page 30







Rules - 31


GeneralClass Select the class number that is to service traffic flows matching this rule.

Large Packet Size

Packets destined for this class which are larger than or equal to this size will follow large packet drop policy. Packets smaller than this size will follow the small packet drop policy. If the size is set to 0, all packets will be treated as small packets.

Drop Limit Defines the maximum amount of estimated time that packets smaller than “class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler . If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets smaller than “class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Large PacketsDrop Limit Defines the maximum amount of estimated time that packets larger

than or equal to “class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packets will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets larger than or equal to “class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Duplicate Packets

Duplicate Disable Limit

Designates the amount of time a duplicate packet may wait in the queue before being discarded, which prevents duplicate packets from consuming bandwidth when bandwidth is limited.

Duplicate Disable Depth

Defines the queue depth of the class scheduler at which point duplicate packets will begin being discarded.

ReassignReassign Class The class number to which flows will be reassigned if the reassign size is

exceeded.

Reassign Size After a flow is established, if a packet that exceeds this size is detected on WAN ingress, the flow will be moved to the class indicated by the reassign class ID or name.

Drop Limit Defines the maximum amount of estimated time that packets smaller than “reassign_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packets will be discarded and statistics will be counted. Not valid for Bulk classes.


Page 31

Rules - 32


Drop Depth Defines the maximum queue depth of the class scheduler for packets smaller than “reassign_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Large Packet Size



than or equal to “reassign_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted.

Drop Depth Defines the maximum queue depth of the class scheduler for packets larger than or equal to “reassign_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Duplicate Packets

Duplicate Disable Limit

Defines the amount of time a duplicate packet can remain in the queue before being discarded. This prevents duplicate packets from consuming limited bandwidth.

Duplicate Disable Depth

Defines the queue depth of the class scheduler at which point duplicate packets will begin being discarded.

TCP Standalone ACK

TCP Standalone ACK Class

The class that will be used for standalone TCP ACKs. This has no effect on packets that are piggyback ACKs with payload.

Large Packet Size

Packets destined for this class which are larger than or equal to this size will follow TCP ACK Large Packet Drop Policy. Packets smaller than this size will follow the small packet drop policy. If the size is set to 0, all packets will be treated as small packets.

Drop Limit Defines the maximum amount of estimated time that packets smaller than “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packets will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets smaller than “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Large Packets


Page 32

Rules - 33


Drop Limit Defines the maximum amount of estimated time that packets larger than or equal to “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted.

Drop Depth Defines the maximum queue depth of the class scheduler for packets larger than or equal to “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

WAN Egress

Enable Packet Resequencing

Defines that traffic flows that match this rule should be tagged for sequence order, and the packets should be reordered (if necessary) at the WAN Egress appliance.

Hold Time Defines the maximum delay that a packet may be held awaiting re-sequencing. When the timer expires, the packet will be sent to the LAN without further waiting for the pre-requisite sequence numbers

Discard Late Resequence Packets

After a packet’s sequence timer has expired for a dependent packet, and the packets were permitted to the LAN, if a late packet does arrives at WAN egress, this property defines what is to be done with it.

DSCP Tag Defines a DSCP tag that will be applied to packets that match this rule on WAN egress, before they are sent to the LAN.

Deep Packet Inspection

Enable Passive FTP Detection

If checked, this parameter will make processing decision based on user data.


Page 33

Rules - 34


Initialize Properties Using Protocol


Click to initialize the rule properties using rule defaults and Talari recommended settings for this protocol.


Page 34

Network Services - 35


Network Services

Adding Internet ServiceAdd Network Service

Type Select Internet or Intranet service.

Name Enter a name for the new service.

Primary Reclaim Check to enable Primary Reclaim.

Default Set Name of the network service defaults that will be used to populate rules.

Internet Rules



Page 35



IP Address

Source Provide source IP address with which to match source packet addresses.

Use for Destination

Select to use the same IP address for both Source and Destination.

Destination Provide destination IP address with which to match destination packet addresses.

DSCP

DSCP Defines an explicit DSCP tag as it is set in IP protocol fields in the IP header.


When checked, flows which are otherwise identical in terms of match criteria will be treated as separate if their DSCP fields differ.

Protocol

String Select a protocol that the flow must match.

Number Provide the IP protocol number that a flow must match.

PortSource When set, if source port matches this number, the packet will match the

rule.

Use for Destination


Destination When set, if destination port matches this number, the packet will match the rule.

Edit Properties

Mode Select from the available methods of transferring and receiving packets:1. Override Service - Enables the redirection of flows matching this rule

to the selected service rather than through APN.2. WAN Link - If WAN link is selected and Internet Load Balancing (ILB) is

used, flow will use the specified WAN link and not one chosen by ILB.


Page 36



WAN Link If WAN link is selected and Internet Load Balancing (ILB) is used, flow will use the specified WAN link and not one chosen by ILB.

Type The destination service that flows of this type should go to. Used with Override Service.



If checked, this parameter will make processing decisions based upon user data.

Adding Intranet ServiceAdd Network Service

Type Select Intranet service.

Name Enter a name for the new service.

Primary Reclaim Check to enable Primary Reclaim.

Default Set Name of the network service defaults that will be used to populate rules.


Page 37



Intranet Rules


IP Address


Use for Destination



DSCP




Protocol



PortSource Provide an IP subnet, including subnet mask. When set, if source

matches this number, the packet will match the rule.

Use for Destination

Select to use the same IP ports for both Source and Destination.



Page 38



Edit Properties






Page 39

WAN Links 40


WAN LinksAdd WAN Link

WAN Link Name Provide a name for this WAN link. The flow will use this specified WAN link and not one automatically chosen by load balancing.

Automatically Enable Usages for all Conduits

Enables all conduits to use new WAN link.

General

Access InterfacesName Provide a name for this Access Interface.

VLAN Select the virtual interface that this WAN link will use to communicate.


Page 40

WAN Links 41


IP Address Provide the IP address for the talari endpoint to the WAN.

Gateway Provide the IP address for the gateway router.

Conduit Mode Determines the priority for conduit traffic on this WAN link.

Proxy ARP Enables or disables Proxy ARP for the Access Interface. If other links share the same gateway IP address as this link, both links must have the same setting for this parameter.

PropertiesAccess Type Indicates if the WAN link is connected to a private IP network or to the

public Internet.

Enable Public IP Learning

Indicates whether the Talari should automatically detect the public IP address.

Public IP Address

Provide the IP address of the Network Address Translator or proxy server.

Tracking IP Address

Provide the virtual IP that will be correlated with the state of this WAN link, allowing it be tracked via ping utility.

AdvancedProvider ID Designates that this WAN link belongs to the same service provider as

any other WAN link with the same Provider ID.

Provider Link Frame Cost

Bytes of header and trailers that are added in addition to every packet for the WAN link, when transmitted. MTU should count these.

MTU Size Largest raw packet size.

Congestion Threshold

The number of microseconds of congestion that must be detected on a WAN link before it goes into congestion avoidance mode.

Cell NetworkEnable Cell Network

Check if WAN link is on a cell network.

Cell Size Size of a cell, including cell header overhead

Cell Header Size

Size of any cell overhead.

EligibilityRealtime • WAN Ingress: If unchecked, WAN Ingress paths at the local site with

the specified WAN link as their local WAN link will not be used for Realtime traffic, unless no other path is up.

• WAN Egress: If unchecked, WAN Egress paths at other sites with the specified WAN link as their remote WAN link will not be used for Realtime traffic, unless no other path is up.


Page 41

WAN Links 42


Interactive • WAN Ingress: If unchecked, WAN Ingress paths at the local site with the specified WAN link as their local WAN link will not be used for Interactive traffic, unless no other path is up.

• WAN Egress: If unchecked, WAN Egress paths at other sites with the specified WAN link as their remote WAN link will not be used for Interactive traffic, unless no other path is up.

Bulk • WAN Ingress: If unchecked, WAN Ingress paths at the local site with the specified WAN link as their local WAN link will not be used for Bulk traffic, unless no other path is up.

• WAN Egress: If unchecked, WAN Egress paths at other sites with the specified WAN link as their remote WAN link will not be used for Bulk traffic, unless no other path is up.

Service Properties

Conduit ServicesOn Enables or disables Services for this WAN link.

Name Name of the Service.

Group The Provisioning Group to which this Service belongs. To manage Groups, see the Provisioning tab.

Tunnel Header Size

Size of the VPN tunnel header.

Active MTU Detect

If checked, the APNA will perform probes on all WAN Ingress paths for this service to detect the current MTU.

UDP Port # This will be used as the source UDP port for all WAN Ingress packets sent from this link. The APNA will also only accept WAN Egress packets at this link with the Destination Port set to this port number.


Page 42

WAN Links 43


UDP Hole Punching

If checked, the NCN will assist UDP connectivity between compatible NAT-protected client sites by communicating the source port of received packets to each client.

UDP Port Switching

Enable If checked, the WAN link will alternate it’s UDP port at the specified Interval for paths on this Conduit.

Alt Port # The alternate UDP port the Conduit will use when UDP port switching is enabled.

Interval The interval at which the Conduit Service will alternate between UDP Port # and Alt Port #.

Auto-gen Paths If selected, directs the compiler to automatically generate paths between this WAN link and all other public WAN links that have autopath enabled.

Internet/Intranet Services

On Enables or disables Services for this WAN link.

Name Name of the Service.

Group The Provisioning Group to which this Service belongs. To manage Groups, see the Provisioning tab.

Mode The Service’s mode for traffic redundancy or load balancing.

Tunnel Header Size

Size of the VPN tunnel header.

WAN Ingress Max Delay

The amount of time to buffer WAN Ingress packets when the Service’s provisioned bandwidth is exceeded.

WAN Egress Grooming

Select to attempt to prevent WAN Egress traffic from exceeding the Service’s provisioned bandwidth by randomly discarding packets.

Access Interface Failover

Enables Interface failover to the secondary Access Interface when the primary is unreachable.

WAN Ingress Tagging

Select a DSCP tag to apply to WAN Ingress packets on the Service.

WAN Egress Tagging

Select a DSCP tag to apply to WAN Egress packets on the Service.

WAN Egress Matching

Assigns WAN Internet Egress packets matching the specified DSCP tag to the Service.


Page 43

WAN Links 44


Provisioning

WAN Link RatesWAN Ingress

Physical Rate The raw bit rate for WAN Ingress traffic.

Permitted Rate The available rate for WAN Ingress traffic.

WAN EgressPhysical Rate The raw bit rate for WAN Egress traffic.

Permitted Rate The available rate for WAN Egress traffic.

Provisioning Groups

Name The Provisioning Group name and assigned graph color.

# of Services The number of Services belonging to this particular Group.

WAN IngressFair Shares The number of Fair Shares the Service should take from the WAN link’s

eligible Ingress bandwidth, out of the sum of all Groups. This pool is independant from shares of the Services within the Group.

Fair The Fair rate available to the Services within the Group, based on its Fair Shares out of all Groups. Includes the Min rates of all Services within the Group.

WAN Egress


Page 44

WAN Links 45


Fair Shares The number of Fair Shares the Service should take from the WAN link’s eligible Egress bandwidth, out of the sum of all Groups. This pool is independant from shares of the Services within the Group.

Fair The Fair rate available to the Services within the Group, based on its Fair Shares out of all Groups. Includes the Min rates of all Services within the Group.

ServicesName The Service name and assigned graph color.

Group The Provisioning Group to which this Service belongs.

WAN IngressMin The minimum bandwidth reserved exclusively for this Service.

Max The maximum bandwidth this Service is allowed to utilize.

Shares of Group

The number of Fair Shares this Service should take from its Groups eligible bandwidth, out of the sum of all Shares in the Group.

Fair The Fair rate of the Service, based on its Shares of all the Services in the Group. Includes the Min rate and does not exceed the Max rate.

WAN EgressMin The minimum bandwidth reserved exclusively for this Service.

Max The maximum bandwidth this Service is allowed to utilize.

Shares of Group

The number of Fair Shares this Service should take from its Groups eligible bandwidth, out of the sum of all Shares in the Group.

Fair The Fair rate of the Service, based on its Shares of all the Services in the Group. Includes the Min rate and does not exceed the Max rate.

An Overview of ProvisioningProvisioning allows for the automatic bidirectional (Ingress/Egress) distribution of bandwidth for a WAN link among the various services associated with that WAN link. Using the APN Configuration Editor, the user can enter the values in the text fields and directly into the cells of the table like a spreadsheet. The Provisioning page is shown below in Figure 5. There are three steps to Provisioning that provide for this bandwidth distribution in a simple and effective way:

1. WAN Link Rates (Setting the WAN link physical and permitted rates)2. Provisioning Groups (Create and edit groups of shares of bandwidth)3. Services (View and edit services for groups or individual site WAN links)

We recently introduced the concept of Fair Shares to the provisioning process. Shares are used to distribute the permitted bandwidth between the provisioning groups. The bandwidth calculated is based on the shares allocated for a particular group, divided by the total shares for all groups. A separate pool of shares is used for both WAN Ingress and WAN Egress traffic.


Page 45

WAN Links 46


Figure 5

WAN Link RatesThis area allows the user to set both the WAN link Physical Rate (the raw bit rate for the incoming/outgoing traffic), and the WAN link Permitted Rate (the available rate for incoming/outgoing traffic). Please see Figure 6 below.


Page 46

WAN Links 47


Figure 6

Provisioning GroupsA Provisioning Group contains a collection of WAN Link bandwidth usages for any given WAN Link. This allows the user to allocate and distribute the shares of bandwidth among a smaller set of services at a high level before drilling down to the individual services for fine-tuning. They also provide a boundary for the automatic redistribution of bandwidth within the child Services of the Provisioning Group.

In the Provisioning Groups table, shares are used to distribute the WAN Ingress/Egress eligible bandwidth, which is the Permitted Rate minus the total Min reserved bandwidth of all Services on the WAN Link. All Services are initially assigned to a “Default” Group that is allocated all of the eligible bandwidth. The user can create additional Groups and allocate bandwidth to its members by giving that Group a number of Fair Shares. The resulting total bandwidth for all Services in the Group is then shown in the Fair (kbps) column. Please see Figure 7 for a view of the Provisioning Groups section.


Page 47

WAN Links 48


Figure 7To create a Provisioning Group:

• Click the Add button• Provide a Group name• Provide the number of WAN Ingress and WAN Egress Fair Shares required for the new group• Reassign Services to the new Group using the Group column in the Services table

Provisioning Groups are available to simplify the provisioning process and are not required if they are not needed.

The Concept of Using SharesWhen provisioning bandwidth for APNs with a large number of sites, using percentages does not allow for enough granularity as the site count increases.

Talari has instituted the use of shares for each of the Services or Groups of Services within the WAN Link. The total number of shares is up to the user, allowing any amount of granularity or precision when allocating bandwidth among the different Services. There are two distinct pools of these shares: WAN Ingress and WAN Egress.

Note that all Services receive their Min Reserved Bandwidth before Fair distribution, which could result in Groups with equal Fair Shares having disparate Fair Rates. Fair Rates can also be affected by Service Maximums, if defined.


Page 48

WAN Links 49


ServicesThe services definition for a WAN link are determined in this section (see Figure 8 below). For conduit services, the user would define the fair shares allocated to a client site. By default, all sites are placed in the “Default” group with the fair shares divided evenly. Services for individual site WAN links are shown and may be edited here.

• Display desired particular Provisioning Group or all groups by using the pull-down menu• Add individual services to a Provisioning Group by selecting the service name and choosing

the desired Group• Set the desired WAN Ingress and Egress minimum and maximum rates, and Group shares for

the service by double-clicking the cell to change the rate or number of shares• To set an unlimited maximum rate, enter “0” or “no limit” into the cell• Click the Apply button to save the settings

Figure 8


Page 49

WAN Links 50


Shares of GroupOn this table, the shares are used in the same way as above, but in this case, it is a new pool of shares within each group used. These shares are used to divide up the bandwidth among the members of a group based on the ratio of the current service divided by the total number of shares for the group in which it is a member.

The Minimum rate acts as a base bandwidth allocation for each service, and the amount of bandwidth available for fair allocation is based on the total permitted for the group minus the sum of the minimums for each service in the group.


Page 50

High Availability - 51


High AvailabilityAdd HA Appliance

Name The name of this HA appliance.

HA Appliance

HA Appliance Name

Name given to HA appliance.

Failover Time How long the standby HA appliance should wait to take over active state after losing contact with active appliance.

Shared MAC The base MAC address for the HA appliances to use.

Primary Appliance

Name of the appliance to be used as the primary appliance if primary reclaim in enabled, otherwise just the name of either appliance.

Primary Reclaim Check if the primary HA appliance should forcefully take back the active role from the secondary.

Enable Serial HA Enables an alternate HA configuration where an appliance directly follows another in a Fail-to-Wire pair.


Page 51

High Availability - 52


Notes:1. When deploying high-availability appliances in a fully-inline topology, Spanning Tree Protoscol (STP) is used to prevent network loops. As a result, when one of the appliances in a pair goes down, STP will block communication between them for up to 40 seconds. Because of this communication loss, the primary appliance will ALWAYS reclaim in this scenario regardless of the configuration setting.

2. When using HA appliances in one-arm mode, if the only link on the primary appliance goes down, both primary and secondary appliances will become active. When the port on the primary box comes up again, the primary appliance will stay active and the secondary appliance switches to standby - no matter what the primary reclaim setting is.

HA Interface Group

Virtual Interface Select Virtual Interface to associate with this HA service.

Primary Control IP Address

Unique virtual IP address the primary HA appliance will use to communicate with its peer.

Secondary Control IP Address

Unique virtual IP address the secondary HA appliance will use to communicate with its peer.

External Tracking IP Addresses

Tracking IP Address

The virtual IP that will be correlated with the state of this device. This IP references an external device that responds to ARP requests, and is reachable from the virtual interface specified in the containing scope.

Device Select the Ethernet interface device to associate with this tracking IP address.


Page 52

Default Sets - 53


Default Sets

Conduit Default SetConduit Default Set

Name Provide a name for this Conduit Default set.

Rule DefaultsPacket Duplication Hold Time

Used to allow a lost packet on a fast path to be replaced by its replacement on its duplicate path that is slower, without causing reorder issues. Duplicate must be in order as well, as this will hold prior out-of-order packets up to this time. If the time expires, the waiting packet will be sent, and the delayed packet will be discarded.drop

Packet Resequencing


Page 53

Hold Time Sets the default for the conduit of the maximum wait time for UDP packets to be held awaiting for resequencing of in-order flows.


If the sequence timer has expired, this parameter sets the default behavior for the conduit. If checked, then any packets received after the sequence has expired will be discarded. If unchecked, the packets will be sent.

TCPHold Time Sets the default for the conduit of the maximum wait time for UDP

packets to be held awaiting for resequencing of in-order flows.


If the sequence timer has expired, this parameter sets the default behavior for the conduit. If checked, then any packets received after the sequence has expired will be discarded. If unchecked, the packets will be sent.

TCP Class The default class ID for TCP-based rules in which class ID or class name was not set.

UDP Class The default class ID for UDP-based rules in which class ID or class name was not set.

Other Class The default class for non-TCP and non-UDP rules in which class ID or class name was not set.

Enable TCP Termination

Use for enabling or disabling TCP Termination feature on TCP-based rules.

Conduit Default Set ClassesConduit Classes

Class Name Name used to reference this class.

Class Type:

Bulk

Default Sets - 54



Page 54

Bulk Share Percentage

Percentage of the all the bulk classes’ share of the conduit bandwidth that this class will use.

Interactive

Initial Share Defines the maximum initial rate in as a percentage of the conduit total bandwidth that this class may consume while the queue depth is less than the Initial Period setting.

Sustained Share

This setting defines the rate this class will use of the conduit bandwidth as a percent share of the entire conduit.

Initial Period Defines the queue depth at which switch is made between initial share and sustained share.

Realtime

Kbits per Second

Initial Rate Defines the maximum initial rate in kbps that this class may consume while the queue depth is less than the Initial Period setting.

Sustained Rate Defines the rate this class may consume of the conduit bandwidth in kbps if queue depth is greater than the Initial Period setting.

Percentage

Initial Rate Defines the maximum initial rate as a percentage of the conduit total bandwidth that this class may consume while the queue depth is less than the Initial Period setting.

Default Sets - 55



Page 55

Sustained Rate Defines the rate this class will use of the conduit bandwidth as a percent share of the entire conduit.

Initial Period Defines the queue depth at which switch is made between initial rate and sustained rate.

Conduit Default Set RulesConduit Rules


IP Address

Source IP Address

Provide source IP address with which to match source packet addresses.

Use for Destination

Use the Source IP address for the Destination as well.

Destination IP Address

Provide destination IP address with which to match destination packet addresses.

DSCP

DSCP Select an explicit DSCP tag as set in IP protocol fields in IP protocol header.


If checked, flows which are otherwise identical in terms of match criteria will be treated as separate if their DSCP fields differ.

Default Sets - 56



Page 56

Protocol

Protocol Number

Provide the IP protocol number that a flow must match.

Protocol String Select a protocol that the flow must match.

Port

Source Port Source port number that a flow must match.

Destination Port

Destination port number that a flow must match.

Use for Destination

The Source port matches the Destination port.

Conduit Rule PropertiesWAN General

Default Sets - 57



Page 57

Mode Select from the three available methods of transferring packets: Load balancing across multiple paths, duplicating across the two most unique paths, and sending on a single persistent path. You may also select to use an Override Service, which enables the redirection of flows matching this rule to the selected service rather than through APN.

Retransmit Lost Packets

This parameter specifies that flows matching this rule will be sent using reliable service to the remote appliance and, as such, that any packets lost will be retransmitted.


Traffic Optimization

TCP TerminationEnable TCP Termination

Check to enable TCP Termination feature on TCP-based rules. Please see the APN Configuration Reference for more information on TCP Termination.

Min Resource Allows the user to specify the minimum resource allocation percentage for TCP Termination traffic on this rule. Please see the APN Configuration Reference for more information.

Enable GRE Header Compression

Check to perform GRE header compression.

Enable IP, TCP, UDP Header Compression

Check to perform IP, TCP, or UDP header compression. This feature will be available in a future release.

Enable Packet Aggregation

Check to aggregate conduit user data packets that match this rule.


Track Performance

Check to track performance of a rule over time. Data will be recorded in a session DB including loss, latency, jitter and bandwidth used.

Default Sets - 58



Page 58







WAN Ingress

GeneralClass Select the class number that is to service traffic flows matching this rule.

Large Packet Size


Drop Limit Defines the maximum amount of estimated time that packets smaller than “class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler . If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets smaller than “class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Large PacketsDrop Limit Defines the maximum amount of estimated time that packets larger than

or equal to “class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets larger than or equal to “class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Duplicate Packets

Default Sets - 59



Page 59

Drop Limit Defines the amount of time a duplicate packet can remain in the queue before being discarded. This prevents duplicate packets from consuming limited bandwidth.

Drop Depth Defines the queue depth of the class scheduler at which point duplicate packets will begin being discarded.

ReassignReassign Class The class number to which flows will be reassigned if the reassign size is

exceeded.

Reassign Size After a flow is established, if a packet that exceeds this size is detected on WAN ingress, the flow will be moved to the class indicated by the reassign class ID or name.

Drop Limit Defines the maximum amount of estimated time that packets smaller than “reassign_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler . If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets smaller than “reassign_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Large Packet Size



than or equal to “reassign_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets larger than or equal to “reassign_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

Duplicate Packets

Drop Disable Limit

Designates the amount of time a packet may wait in the queue before duplication is not performed. This prevents duplicate packets from consuming limited bandwidth.

Drop Disable Depth

Defines the queue depth of the class scheduler at which point duplicate packets will not be generated.

TCP Standalone ACK

Default Sets - 60



Page 60

TCP Standalone ACK Class

The class that will be used for standalone TCP ACKs. This has no effect on packets that are piggyback ACKs with payload.

Large Packet Size

Packets destined for this class which are larger than or equal to this size will follow TCP ACK Large Packet Drop Policy. Packets smaller than this size will follow the small packet drop policy. If the size is set to 0, all packets will be treated as small packets.

Drop Limit Defines the maximum amount of estimated time that packets smaller than “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packets will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets smaller than “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.


than or equal to “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes” will have to wait in the class scheduler. If the estimated time exceeds this threshold, the packet will be discarded and statistics will be counted. Not valid for Bulk classes.

Drop Depth Defines the maximum queue depth of the class scheduler for packets larger than or equal to “tcp_standalone_ack_class_tail_drop_large_packet_size_bytes.” If the queue depth exceeds this threshold, packets will be discarded and statistics will be counted.

WAN Egress

Enable Packet Resequencing

Defines that traffic flows that match this rule should be tagged for sequence order, and the packets should be reordered (if necessary) at the WAN Egress appliance.

Hold Time Defines the maximum delay that a packet may be held awaiting re-sequencing. When the timer expires, the packet will be sent to the LAN without further waiting for the pre-requisite sequence numbers

Discard Late Resequence Packets

After a packet’s sequence timer has expired for a dependent packet, and the packets were permitted to the LAN, if a late packet does arrives at WAN egress, this property defines what is to be done with it.

Default Sets - 61



Page 61

DSCP Tag Defines a DSCP tag that will be applied to packets that match this rule on WAN egress, before they are sent to the LAN.

Deep Packet Inspection


If checked, this parameter will make processing decision based on user data.



Click to initialize the rule properties using rule defaults and Talari recommended settings for this protocol.

Default Sets - 62



Page 62

Internet Default SetInternet Default Set

Type Select type of service being added.

Name Enter the name for the service.

Primary Reclaim If checked, this will be the default set for Internet service.

Internet Default Set RulesInternet Default Set Rules


Default Sets - 63



Page 63

IP Address


Use for Destination

Select to use the same IP ports for both Source and Destination.


DSCP




Protocol




rule.

Use for Destination



Edit Properties

Rule Properties

Default Sets - 64



Page 64

Mode Select from the available methods of transferring and receiving packets:1. Override Service - Enables the redirection of flows matching this rule

to the selected service rather than through APN.2. WAN Link - If WAN link is selected and Internet Load Balancing (ILB) is

used, flow will use the specified WAN link and not one chosen by ILB.

WAN Link If WAN link is selected and Internet Load Balancing (ILB) is used, flow will use the specified WAN link and not one chosen by ILB.

Type The destination service that flows of this type should go to. Used with Override Service.




Intranet Default SetIntranet Default Set

Type Select type of service being added.

Name Enter the name for the service.

Primary Reclaim If checked, this will be the default set for Internet service.

Default Sets - 65



Page 65

Intranet Default Set Rules


IP Address


Use for Destination






Protocol




rule.

Use for Destination



Default Sets - 66



Page 66

Edit Properties

Override Service The destination Service to which flows of this type should go.




Default Sets - 67



Page 67

Sample Configuration File - 68


Sample Configuration File//****************************************//ncn - raleigh//****************************************

define site name=raleigh{ add appliance name=primary { set appliance_properties model=t3000 secure_key=0xcafe0004beef5533 appliance_mode=primary_ncn default_direct_route_cost=6;

add interface_group { set properties bypass_mode=fail_to_block;

add ethernet_interface device=1; add virtual_interface name=vlan1 vlan_id=100; add virtual_interface name=vlan2 vlan_id=200; add virtual_interface name=vlan3 vlan_id=native; }

add interface_group { set properties secure_zone=untrusted bypass_mode=fail_to_block;

add ethernet_interface device=4; add virtual_interface name=vlan4 vlan_id=native; }

add virtual_ip_addrn virtual_interface_name=vlan1 ip_addrn=192.168.50.6/24;



add route net=192.168.0.0/16 gw_ip_addr=192.168.50.5 cost=7 service=local;

add conduit_service remote_site_name=sjc { set rule_default discard_late_tcp_resequence_packets=false discard_late_non_tcp_resequence_packets=false; set interactive_class class_id=1 class_name=udp_class initial_share_pct=12 sustained_share_pct=12;


Page 68



set interactive_class class_id=2 class_name=class_2 initial_share_pct=12 sustained_share_pct=12;

set bulk_class class_id=3 class_name=class_3 bulk_share_pct=100;

add rule { set match_criteria protocol_str=udp;

set properties precedence=low;

set ingress_properties class_name=udp_class;

set wan_properties transmit_mode=duplicate_paths retransmit_lost_packets=true;

set egress_properties resequence_packets=true; } } add internet_service { }

add virtual_wan_link name=raleigh-t1 { add access_interface name=raleigh-t1-accessint0 virtual_interface_name=vlan1 virtual_ip_addr=192.168.50.66 gw_ip_addr=192.168.50.1; set properties primary_conduit_access_interface=raleigh-t1-accessint0 wan_ingress_physical_rate_kbps=1444 wan_egress_physical_rate_kbps=1444 wan_ingress_permitted_rate_kbps=1444 wan_egress_permitted_rate_kbps=1444 public_ip_addr=224.54.13.54; add conduit_usage remote_site_name=sjc wan_egress_rate_fair_share=800000 wan_ingress_rate_fair_share=800000 service_group_name=default wan_egress_minimum_reserved_bandwidth_kbps=200 wan_ingress_minimum_reserved_bandwidth_kbps=200; add net_usage service_type=internet wan_egress_rate_fair_share=200000 wan_ingress_rate_fair_share=200000 service_group_name=default; add service_group name=default wan_egress_rate_fair_share=1000000 wan_ingress_rate_fair_share=1000000; }


Page 69



} add ha_appliance name=secondary; add ha_service { set properties primary_appliance_name=primary secondary_appliance_name=secondary; add interface_group { set interface_properties virtual_interface_name=vlan1 primary_ip_addr=192.168.50.101 secondary_ip_addr=192.168.50.102; } }}

//****************************************//site - sjc//****************************************

define site name=sjc{ add appliance name=talari { set appliance_properties model=t730 secure_key=0xcafe7777cafe7777;

add interface_group { set properties bypass_mode=fail_to_wire;

add ethernet_interface device=1; add ethernet_interface device=2; add virtual_interface name=vlan1 vlan_id=100; add bridge_pair device_one=1 device_two=2; }


add conduit_service remote_site_name=raleigh { }

add virtual_wan_link name=sjc-cbl { add access_interface name=sjc-cbl-accessint0 virtual_interface_name=vlan1 virtual_ip_addr=192.168.61.6 gw_ip_addr=192.168.61.1; set properties primary_conduit_access_interface=sjc-cbl-accessint0 wan_ingress_physical_rate_kbps=4000 wan_egress_physical_rate_kbps=20000 wan_ingress_permitted_rate_kbps=4000 wan_egress_permitted_rate_kbps=20000 enable_public_ip_learning=true; add conduit_usage


Page 70



remote_site_name=raleigh wan_egress_rate_fair_share=200000 wan_ingress_rate_fair_share=200000 service_group_name=default wan_egress_minimum_reserved_bandwidth_kbps=100 wan_ingress_minimum_reserved_bandwidth_kbps=100; add service_group name=default wan_egress_rate_fair_share=1000000 wan_ingress_rate_fair_share=1000000; } }}


Page 71

Glossary - 72


GlossaryAdaptive Private Networking (APN)

As used in this guide, the process of using an Adaptive Private Network, or the name for the whole network that includes the Adaptive Private Networking Appliances, the Wide Area Network, the Conduits between peer APNAs, as well as other network application services. APN is configured from a single APNA, which is the Network Control Node (NCN).

Adaptive Private Networking Appliance (APNA)The general name for a specific Talari network appliance, also occasionally referred to as a Talari Appliance.

Client Node (Client)A Talari Client Node is an APN appliance that is located across the Talari network from the NCN. Although an NCN may potentially have multiple clients, each client has only one NCN.

Conduit ServiceThe Conduit service is a logical combination of one or more paths, and is the typical mode for enterprise site-to-site Intranet traffic, utilizing the full value of the Talari’s Adaptive Private Networking. In this mode, depending on configuration, the traffic is actively managed across multiple WAN links to create an end-to-end Conduit.

Ethernet InterfaceA physical or configurable interface of the APNA. For example, the T730 has nine user-defined Ethernet Gigabit interfaces, plus a predefined Management interface.

FlowA flow is a stateful instance (memory) used to track and treat application traffic from its source to its destination across APN. The properties of a particular flow are derived from the routes, rules, and service that the traffic flow matches.

Internet Network ServiceThe Internet Service is for traffic between an enterprise user and sites on the public Internet. Traffic of this type is not encapsulated. During times of congestion, Talari APN does actively manage bandwidth by rate-limiting Internet traffic relative to the Conduit and Intranet traffic as per the configuration established by the administrator.

Intranet Network ServiceThe Intranet Service is for any portion of enterprise Intranet traffic that has not been defined for transmission across an APN Conduit. As with Internet traffic, it remains unencapsulated, and APN manages bandwidth by rate-limiting this traffic relative to other service types during times of congestion. Note that under certain conditions, and if configured for Intranet Fallback on the Conduit, traffic between a pair of APNAs that ordinarily travels via a Conduit may instead be treated as Intranet in order to maintain network reliability.

Network Control Node (NCN)The NCN is the central APNA that acts as the master controller of APN, as well as the central point of administration for the client nodes. The NCN’s primary purpose is to establish and utilize a Conduit with one or more Talari Client Nodes across the network for enterprise site-to-site communications. A particular NCN can administer and have Conduits to multiple Client Nodes.

Network ServiceA logical set of operations performed on the traffic as it uses APN. The set of services supported are Bypass, Passthrough, Internet, Intranet, and Conduit.


Page 72

Glossary - 73


Passthrough Network ServiceTraffic directed to the Passthrough service includes broadcasts, ARPs and other non-IPv4 traffic, as well as traffic on the APNA’s local subnet, specifically configured subnets, or rules applied by the network administrator. The APNA does not delay, shape or modify this traffic. Because the Talari service does not hinder this traffic, the network administrator must be sure that Passthrough traffic does not consume substantial resources on the WAN links which the APNA is configured to use for other services. Example: Passthrough may be used if a host is located on the WAN side of the APNA, but access to the host does not impact the APNA’s specific WAN links. Think of the special management IP of the WAN link router as a typical example of a proper explicit use of Passthrough.

Redundant APN Control Protocol (RACP)The protocol developed by Talari to provide functionality for two high availability (HA) APNAs to communicate availability information.

RuleA Talari Networking Service equivalent of a typical router access control list or filter mask. A rule defines match criteria and properties for IP flows. Flows that match those criteria use the service with which the rule is associated.

Talari PathA Talari Path is a logical link between two WAN links.

Talari Conduit ClassA Class is a queued service point into a Talari Conduit. The Class to which traffic is assigned determines its share of the Conduit bandwidth, permitted queue depth, and its priority, relative to other traffic, for Talari Network resources.

TCP TerminationTCP termination provides the ability to split a single TCP connection into three separate TCP connections all managed and maintained by the APN. TCP termination is only used for Conduit traffic.

Traffic Service TypesTraffic Service Types apply while the system is in the Active state noted above.

Trust Relay Points (TRP)A Cisco Systems software function implemented in voice over IP networks that provides multiple voice capabilities, such as transversing trusted firewalls.

Trusted WAN InterfaceAppliance interface processing network traffic that is protected by a firewall, performing as if it were a traditional WAN port.

Untrusted WAN InterfaceAppliance interface processing network segment traffic that is not being protected by a firewall. Non-Conduit traffic from the WAN is unable to communicate to any network interface inside of the appliance. The segment is entirely isolated from the rest of the network with the exception of the APNs own 128-bit AES-encrypted paths.

WAN LinkThe general term for an enterprise’s connection to a WAN. These WAN links are typically connected to router ports. Some examples of WAN Links are T1, DSL, or Frame Relay.


Page 73

Index - 74


Index

A

Accessing the Program 6

C

Conduit Default Set 52

D

Default Sets 52

H

Hardware and Software Requirements 5High Availability 51

I

Installing Java 6Interface Groups 19Internet and Intranet Default Sets 63, 65Internet or Intranet Service 35, 37

M

Menu Bar 9

N

Navigation 7Network Service Rule 38Network Services 35New NCN or Client Site 12

O

Overview of Provisioning 45

P

Provisioning 44Provisioning Groups 47

R

Reference Documents 5Request for Comments 5Routes 20

S

Sample Configuration File 68Shares 48

T

Talari Configuration Files 6The Concept of Using Shares 48The Site Cloning Process 13Toolbar 11

V

Virtual IP Addresses 20


Page 74

Adaptive Private Networking Con�guration Editor User’s GuideAPNware Release 2.5

About Talari™ Networks

Talari Networks is rede�ning WAN reliability and performance quality. By aggregating multiple broadband links and continuously adapting to the quality of the network, Talari enables true enterprise-class quality and reliability at consumer prices. Talari’s patented technology delivers 30-100 times gain in bandwidth per dollar, 40-90 percent on-going WAN cost reductions and greater visibility and reliability than MPLS or any other private network. Talari has received numerous industry awards and accolades including being named a Gartner Cool Vendor, Best of Interop — Performance Optimization and Techworld Awards — 2012 Networking Application Product of the Year. For more information, visit www.talari.com.

Talari Networks, Inc.

550 S.Winchester Blvd., Suite 500San Jose, CA 95128 USA+1 408 689 0400 +1 408 864 2124 [email protected] | www.talari.com

Talari Networks, Inc. reserves the right to make changes to its products or to discontinue any product or service without notice. Talari is a trademark of Talari Networks, Inc. All other trademarks mentioned in this document or website are the property of their respective owners.© Talari Networks, Inc., 2013


Page 75

Talari APN Configuration Editor User's Guide · 2017-03-22 · 2 Talari APN Configuration Editor...

Documents

Transcript of Talari APN Configuration Editor User's Guide · 2017-03-22 · 2 Talari APN Configuration Editor...