Netforge.ai Docs
Open the app →
Docs/Guide/Templates/Enterprise WAN Designs

Enterprise WAN Designs

Dual-transport SD-WAN with centralized Internet breakout — Silver Peak spokes, Cisco cores, Palo Alto firewalls.

Relevant for:Pre-Sales / DesignProfessional ServicesEnterprise / NetOps

The Enterprise WAN family puts a whole hybrid WAN on the canvas: three frozen reference designs on the Templates page (the violet Enterprise WAN cards). The 30-office overview (70 devices) gives every office two Silver Peak EdgeConnect spokes, each riding both transports — wan0 on the MPLS underlay, wan1 on the Internet underlay — while two data centers host the EC-XL hubs, a Cisco C9500 core, and a Palo Alto firewall that centralizes Internet breakout for the whole company. The DC design zooms one data center in (hub pair, PA-3260 HA pair, dual core with HSRP aligned to the STP root, server access block) and the branch design zooms one office in (two spokes, collapsed-L3 Cisco core with dual default routes, access switches with seeded user ports). To build a WAN of your own shape — your site mix, vendors, and addressing — use the Blueprint wizard on the canvas instead: it generates a multi-site network with one tab per site.

Where to find itTemplates page→Featured cards tagged “Enterprise WAN”→Open as a project
Where to find itCanvas→Blueprint→Sites & tiers → WAN architecture → vendor kits → addressing → credentials → Generate
Why
Two transports per spoke means a brownout on either carrier degrades a path, not an office — the overlay steers per-application traffic (RealTime vs bulk) across whichever underlay is currently healthy, and losing a whole spoke still leaves its twin with both transports. Centralizing Internet breakout at the DC firewalls ("Internet for Internet traffic") keeps the branch edge thin: one NAT boundary, one security policy, one place to log and inspect web egress, instead of thirty firewalls to keep in sync.

Addressing & summary plan#

DC1 / DC210.40.0.0/16 and 10.44.0.0/16 — summarized as 10.40.0.0/13 (corp-dcs).
Office n (1–30)10.(64+n).0.0/16 → 10.65–10.94 — summarized as 10.64.0.0/11 (corp-offices).
MPLS underlay172.31.0.0/16: office n edge e gets the /30 at 172.31.n.(4(e−1)); carrier PE holds .1/.5.
Internet underlay100.64.0.0/16 (CGN space, as broadband hand-offs really look): same /30 scheme, DIA gateway on .1/.5.
DC breakout rangesDC1 203.0.113.0/28, DC2 198.51.100.0/28 — the firewall untrust leg and PAT pool.
Per siteManagement x.199.0/24, transit /30s x.250.0/24, loopbacks x.255.0/24.
AS 65020Enterprise ASN on the hubs — flips bgp_to_overlay in the EdgeConnect bootstrap.

Dual-transport spoke bootstrap#

Spokes generate an EdgeConnect appliance bootstrap, not CLI. Both WAN interfaces carry their underlay in the label; the spoke has no routing section by design — the SD-WAN overlay owns pathing, and the business-intent overlays steer traffic classes across the two transports.

"wan_interfaces": [
  {
    "name": "wan0",
    "label": "MPLS underlay — carrier PE 172.31.1.1",
    "admin": "up",
    "priority": 1
  },
  {
    "name": "wan1",
    "label": "Internet underlay — DIA gw 100.64.1.1 (web egress via DC breakout)",
    "admin": "up",
    "priority": 2
  }
],
"business_intent_overlays": [
  { "name": "RealTime", "topology": "hub-and-spoke" },
  { "name": "CriticalApps", "topology": "mesh" },
  { "name": "BulkApps", "topology": "hub-and-spoke" }
]

Hub route redistribution#

Each DC hub advertises its data-center prefix into the overlay (static route toward the core, BGP redistribution enabled under AS 65020), so every office learns both DCs through the fabric:

"route_redistribution": {
  "ospf_to_overlay": true,
  "bgp_to_overlay": true,
  "static_routes": [
    { "prefix": "10.40.0.0", "mask": "255.255.0.0", "next_hop": "10.40.250.2" }
  ]
}

DC core — HSRP + breakout routing#

The cores run HSRP with the VIP on .1 and priority 110/90 matching the STP root, and their routing states the whole traffic pattern in three lines: default to the firewall (Internet), offices via the local hub (overlay), the other DC via the hub too.

interface Vlan10
 description VLAN 10
 ip address 10.40.10.2 255.255.255.0
 standby version 2
 standby 10 ip 10.40.10.1
 standby 10 priority 110
 standby 10 preempt
 no shutdown
!
router ospf 1
 router-id 10.40.255.21
 passive-interface default
 network 10.40.0.0 0.0.255.255 area 0
!
ip route 0.0.0.0 0.0.0.0 10.40.250.9
ip route 10.64.0.0 255.224.0.0 10.40.250.1
ip route 10.44.0.0 255.255.0.0 10.40.250.1

PAN-OS centralized breakout#

The firewall pair carries the breakout intent end to end: PAN-form static routes (destination as prefix/length) plus zones, interface IPs, outbound PAT and the security rulebase as a raw-config block:

set network virtual-router default routing-table ip static-route "DEFAULT" destination 0.0.0.0/0 nexthop ip-address 203.0.113.1
set network virtual-router default routing-table ip static-route "corp-offices" destination 10.64.0.0/11 nexthop ip-address 10.40.250.10
set zone untrust network layer3 ethernet1/1
set zone trust network layer3 ethernet1/2
set network interface ethernet ethernet1/1 layer3 ip 203.0.113.2/28
set network interface ethernet ethernet1/2 layer3 ip 10.40.250.9/30
set rulebase nat rules Outbound-PAT from trust to untrust source [ 10.40.0.0/13 10.64.0.0/11 ] to-interface ethernet1/1 source-translation dynamic-ip-and-port interface-address interface ethernet1/1
set rulebase security rules Allow-Web-Out from trust to untrust application [ web-browsing ssl dns ] action allow
set rulebase security rules Block-Mgmt-Egress from trust to untrust source 10.40.199.0/24 action deny
set rulebase security rules Default-Deny from trust to untrust action deny
Note
The spoke bootstrap intentionally renders no static routes — underlay /30s live on the WAN interface labels and the routed switchports, and the overlay handles reachability. These reference designs ship the PAN-OS zones/NAT/policy as a raw-config block on the firewall nodes (review it in the Advanced tab before deploying) — though zones, NAT, and security rules can now also be modeled natively in the Firewall Studio and rendered per vendor. In the DC design the standby firewall carries the same policy with its own untrust IP (.3) and an HA link on ethernet1/8.