VMware Hands-on Labs - HOL-2040-01-NET

Lab Overview - HOL-2040-01-NET - Getting Started with VeloCloud by VMware

Lab Guidance

Note: It may take more than 90 minutes to complete this lab. You should expect to only finish 2-3 of the modules during your time.  The modules are independent of each other so you can start at the beginning of any module and proceed from there. You can use the Table of Contents to access any module of your choosing.

The Table of Contents can be accessed in the upper right-hand corner of the Lab Manual.

Explore VMware SD-WAN by VeloCloud including the key components and architecture. Review options for troubleshooting and diagnostics.                                    

Lab Module List:

 Lab Captains: 


This lab manual can be downloaded from the Hands-on Labs Document site found here:


This lab may be available in other languages.  To set your language preference and have a localized manual deployed with your lab, you may utilize this document to help guide you through the process:



Location of the Main Console


  1. The area in the RED box contains the Main Console.  The Lab Manual is on the tab to the Right of the Main Console.
  2. A particular lab may have additional consoles found on separate tabs in the upper left. You will be directed to open another specific console if needed.
  3. Your lab starts with 90 minutes on the timer.  The lab can not be saved.  All your work must be done during the lab session.  But you can click the EXTEND to increase your time.  If you are at a VMware event, you can extend your lab time twice, for up to 30 minutes.  Each click gives you an additional 15 minutes.  Outside of VMware events, you can extend your lab time up to 9 hours and 30 minutes. Each click gives you an additional hour.



Alternate Methods of Keyboard Data Entry

During this module, you will input text into the Main Console. Besides directly typing it in, there are two very helpful methods of entering data which make it easier to enter complex data.



Click and Drag Lab Manual Content Into Console Active Window

You can also click and drag text and Command Line Interface (CLI) commands directly from the Lab Manual into the active window in the Main Console.  



Accessing the Online International Keyboard


You can also use the Online International Keyboard found in the Main Console.

  1. Click on the Keyboard Icon found on the Windows Quick Launch Task Bar.



Click once in active console window


In this example, you will use the Online Keyboard to enter the "@" sign used in email addresses. The "@" sign is Shift-2 on US keyboard layouts.

  1. Click once in the active console window.
  2. Click on the Shift key.



Click on the @ key


  1. Click on the "@ key".

Notice the @ sign entered in the active console window.



Activation Prompt or Watermark


When you first start your lab, you may notice a watermark on the desktop indicating that Windows is not activated.  

One of the major benefits of virtualization is that virtual machines can be moved and run on any platform.  The Hands-on Labs utilizes this benefit and we are able to run the labs out of multiple datacenters.  However, these datacenters may not have identical processors, which triggers a Microsoft activation check through the Internet.

Rest assured, VMware and the Hands-on Labs are in full compliance with Microsoft licensing requirements.  The lab that you are using is a self-contained pod and does not have full access to the Internet, which is required for Windows to verify the activation.  Without full access to the Internet, this automated process fails and you see this watermark.

This cosmetic issue has no effect on your lab.  



Look at the lower right portion of the screen


Please check to see that your lab is finished all the startup routines and is ready for you to start. If you see anything other than "Ready", please wait a few minutes.  If after 5 minutes your lab has not changed to "Ready", please ask for assistance.


Module 1 - Overview and Foundation of VMware SD-WAN by VeloCloud (15 minutes)


In this module, we will talk about VMware Software-Defined WAN and describe what it is as well as it's associated features. We will dive into the architecture, components, and core features. 

This module covers:

Overview of SD-WAN

SD-WAN offers compelling advantages for distributed organizations with critical branch operations, including the benefits of business agility, improved application performance, and lower cost of bandwidth. In this module, we will try to highlight those advantages and how enterprises can benefit from them.


Defining Software-Defined WAN

SD‐WAN uses software and cloud‐based technologies to simplify delivery of WAN services to branch offices. Software‐based virtualization enables network abstraction that results in simplification of network operations. SD‐WAN enables IT and business managers to deploy Internet‐based connectivity (with its benefits of ubiquity, high bandwidth and low cost) easily, quickly and with quality, reliability and security.

SD-WAN Benefits

SD‐WAN provides a wide range of benefits for distributed organizations, including:

  1. Business agility. Rapid deployment of WAN services (such as bandwidth and firewall) to distributed branch operations without the need to send IT personnel on‐site. Bandwidth can be easily added (with additional circuits) or reduced as business requirements evolve.
  2. Internet economics. Internet connectivity (including cable, DSL and ethernet) is widely available, quick to deploy, and a fraction of the cost of equivalent MPLS circuits. SD‐WAN provides the benefits of reliable, secure WAN service at Internet price points.
  3. Optimized cloud architecture. SD‐WAN eliminates the backhaul penalties of traditional MPLS networks and leverages the Internet to provide secure, high‐ performance connections from the branch to cloud. With SD‐WAN, remote users will see significant improvements in their experience when using the cloud/SaaS‐based applications.

SD‐WAN Considerations

If you’re an IT or business manager, consider the following criteria when evaluating SD‐WAN deployments:

  1. Ease of adoption and management. A key benefit of SD‐WAN is that it makes deploying WAN services at the branch fast and simple. SD‐WAN solutions must be straightforward to deploy, and they leverage centralized provisioning to eliminate the need for trained personnel to visit remote sites.
  2. Ability to migrate to hybrid WAN. The majority of distributed organizations already have MPLS deployed to the branch offices. Organizations should be able to seamlessly deploy SD‐WAN solutions (Internet circuits) without changing the existing MPLS network. Those organizations can over time, migrate traffic growth toward cost‐effective Internet bandwidth.
  3. Automation – traffic steering. SD‐WAN gives organizations the ability to prioritize traffic. The key is providing managers with easy‐to‐use tools for setting priorities and with features that automatically changes traffic flows according to current network conditions.



SD-WAN Features

In a nutshell, SD‐WAN

More information on the above topics will be discussed later in the coming modules. You can also refer to the whitepapers and reports section on the VeloCloud website.



What SD-WAN is not

SD‐WAN is a comprehensive solution comprised of many components. It does not include traditional WAN optimization.


VMware SD-WAN by VeloCloud Key components and Architecture

In this lesson, we will introduce the SD WAN Solution in more detail. We will discuss the value, components and architecture of the solution of adopting VMware SD-WAN by VeloCloud solution:

VMware SD-WAN by VeloCloud is the only SD-WAN solution supporting data plane services in the cloud, in addition to on-premise deployments; enabling policy-based access to cloud and data center applications. SD-WAN leverages the economics of the cloud to offer a SaaS like subscription price model to ease adoption and pay as you grow.


VMware SD-WAN solution is a logical overlay network:

The first benefit is SIMPLIFYING the management of WAN's (Wide Area Networking) especially as IT wants the flexibility to use multiple circuits all while simplifying configuration and ongoing management. This starts with deployment also known as  zero-touch branch deployments.

The second unique benefit of our approach is to assure the performance of critical applications.

Finally, we support the migration of apps to the cloud.


Architecture Overview

VMware SD-WAN is a comprehensive platform for Enterprises and Service Providers.



Enterprise Deployment


In an Enterprise deployment model with branch edges creating overlay tunnels to gateway and hub devices. Simplified and secure VPN tunnels are established from branch to gateway and from branch to hub devices. Also supported are dynamic branch to branch links.



Service Provider Deployment


VMware SD-WAN supports tight integration with Service Provider network topologies. Gateways are usually found in Service Provider MPLS networks supporting multi tenancy.



Component Overview


The VMware SD-WAN solution has three main components:

Edge (VCE) - highlight location flexibility (cloud, dc, branch), form factor flexibility 

Orchestrator (VCO) - Virtual, Multi-tenant, highlight simplicity and no CLI, enables fast ramp of IT teams, less need for skilled resources, monitoring and troubleshooting are key, API Integration (eg AT&T leverages APIs)

Gateway (VCG) - Virtual, Multi-tenant with functions on data plane and control plane, VCG has global presence with partnerships with major service providers. Supports both cloud and on-premise model.



Core Features

There are seven core features that are central to the VMware SD-WAN platform.



Core Feature #1: Zero-Touch Deployment

VMware SD-WAN Edge appliances automatically authenticate, connect, and receive configuration instructions once they are connected to the Internet in a zero-touch deployment. Deliver highly available deployment with VMware SD-WAN Edge redundancy protocol. Integrate with the existing network with support for OSPF routing protocol and benefit from dynamic learning and automation.



Core Feature #2: Dynamic Path Selection

VMware SD-WAN Dynamic Multipath OptimizationTM provides deep application recognition, automatic link monitoring, auto-detection of provider and auto-configuration of link characteristics, routing and QOS settings



On-demand, Per-packet link steering is performed automatically based on the measured performance metric, intelligent application learning, business priority of the application, and link cost. Delivers sub-second blackout and brownout protection to improve application availability. Remediates link degradation through forward error correction, activating jitter buffering and synthetic packet production.



Core Feature #4: Cloud VPN

One-click site-to-site cloud VPN is a VPNC-compliant IPSec VPN to connect VMware SD-WAN and non-VMware SD-WAN sites while delivering real-time status and health of VPN sites. Establish dynamic edge-to-edge communication for all types of branches based on service level objectives and application performance. Deliver secure connectivity across all branches with PKI scalable key management. New branches join the VPN network automatically with access to all resources in other branches, enterprise datacenters, and 3rd party datacenters, like Amazon AWS.



Core Feature #5: Multi-Tenancy

All the VMware SD-WAN by VeloCloud components, Orchestrator and the Gateways, are multi-tenant in nature. This allows for complete separation in operations, and separation in lines of business for an organization leveraging SD-WAN



Core Feature #6: Segmentation

Segmentation is essential for isolating different types of traffic while maintaining specific business policies, such as segmenting PCI traffic from corporate traffic and guest Internet traffic. Customers can enable the creation of separate and unique topologies and rules for each segment, and the segments are carried forward the entire network seamlessly.



Core Feature #7: Virtual Network Function

Support virtual network function services to run on VMware SD-WAN Edge hardware, VMware SD-WAN Gateway, in the cloud of the service provider, or at the specific enterprise regional hub with service chaining support.



This concludes our first chapter on the Overview of SD-WAN. In this module, you learned about SD-WAN and the business benefits it can help provide your company. In the next modules, we will focus more on VMware SD-WAN by VeloCloud.


You've finished Module 1!

Congratulations on completing  Module 1!

If you are looking for additional information on VMware SD-WAN by VeloCloud, try one of these:

Proceed to any module below which interests you most.



How to End Lab


To end your lab click on the END button.  


Module 2 - Branch Edge Device Activation and Configuration (30 minutes)


Zero Touch Provisioning

Zero Touch Provisioning is a feature that allows us to easily deploy and scale across hundreds of sites. This feature simplifies the entire process of edge activation.

Zero-touch provisioning of a VMware SD-WAN Edge is accomplished via the VeloCloud Orchestrator. With the Orchestrator, sites can be brought online in matter of few minutes in a true zero touch fashion. VMware SD-WAN Edges automatically authenticate, connect, and receive configuration instructions from the Orchestrator.

The Orchestrator supports both push and pull activation options for secure on-boarding. With these options, technical personnel do not have to be sent to remote customer sites for installation and activation.

This Module contains the following lessons:

Zero Touch Provisioning

In this module we will be working on two main tasks:

  1. Activation for a new Branch site.
  2. Configuring LAN side of the Edge Device.


Activation for a new Branch site


Before starting the lab, let us understand the VMware SD-WAN Zero Touch Provisioning feature

The current lab focuses on the Pull Activation process. In this Pull Activation model, the Edge device is shipped to the customer site with a factory-default image. Prior to activation, the Edge contains no configuration or credentials to connect to the enterprise network.

Two simple steps for the Activation of Edge device: (A) Provisioning & (B) Activation

Provisioning: On the Orchestrator, the Enterprise administrator (operator) creates a new Edge in the customer account. At this time, an activation key is generated which can be emailed to the person installing the device.

Activation: The person (remote admin) installing the device will receive both an activation email as well as instructions to complete the installation. Part of these instructions is to connect power and Internet links to the device. The installer next connects to a temporary wireless network the Edge emits or connects to one of the wired LAN ports and opens the activation email and clicks on the activation link. At this time, the Edge will phone home to the Orchestrator and bind itself to the correct enterprise and profile context. At this point the Edge downloads all relevant policies, updates and settings and makes these effective.

By the end of the lab, the Virtual Edge device status from the Orchestrator will show as Activated. All the WAN link information will get auto-populated with the activation process.

In this lab exercise, Virtual edge is used for activation.

  • Orchestrator is hosted and managed by VMware SD-WAN. End user will use the Orchestrator (VCO) for Provisioning the Branch Site
  • An un-activated Edge device (Virtual Edge) is used for Activation
  • Edge device has two WAN Internet links. DHCP based IP on WAN side
  • Client machine to access the local UI of the edge device

VeloCloud Orchestrator (VMware SD-WAN Orchestrator), also referred to as VCO in the lab





The following information will be used to configure the virtual edge in the lab.

  • Site name = Chicago branch Site
  • Profile = Branch OSPF profile
  • DHCP Based dual WAN links
  • LAN IP address=192.168.6.x/24
  • Chicago Branch site is with virtual edge device and a client machine (linux based)

With the successful activation, ISP name, IP address, interface and the bandwidth for each of the WAN links will be auto discovered. This is done by the Edge device running a WAN bandwidth test with the SD-WAN Gateway component.



Provisioning and Activating an new Branch site

In this exercise, End user will activate a Branch site. Branch site has a Virtual Edge with 2 internet links connected. Internet links have DHCP based WAN addresses. Once the edge device is activated successfully, all the WAN information is auto-discovered and pre-populated.

Read before you start

For this lab exercise, Activation process requires access to email client and server. As we dont have access to email, end user will access the Orchestrator from the client machine to access the Activation link. Client machine is connected to the LAN side of the edge device.



Configuring LAN side of the Edge device

This lab wil help you understand how to configure the edge device.

In this exercise, we will configure the LAN side for the edge device. Client machines which are part of the LAN subnet will use the Edge device to get Internet connectivity.

For this lab, you will configure the LAN subnet and also enable the Edge device to be the DHCP server for LAN subnet.

Configuration can also be performed on a unactivated edge device. When the edge device gets activated, Orchestrator will push the configuration to the edge device

With Edge device being the DHCP server for LAN subnet 192.168.6.x/24, Chicago Client machine will get the new IP address from Subnet 192.168.6.x

  • Site Name = Chicago Branch Site
  • Branch site in this case is Activated
  • Client machine name is Chicago Client machine. This machine is accessed using VNC UI
  • LAN side Subnet is 192.168.6.x/24



In this module we have successfully provisioned a new branch site using Zero Touch Provisioning and we have also configured the netwok access for the edge device and verified connectivity


You've finished Module 2!

Congratulations on completing  Module 2!

If you are looking for additional information on VMware SD-WAN by VeloCloud, try one of these:

Proceed to any module below which interests you most.



How to End Lab


To end your lab click on the END button.  


Module 3 - Cloud VPN (30 Minutes)


Cloud VPN

One-click site-to-site Cloud VPN is a VPN-compliant IPSec VPN to connect VMware SD-WAN and non-VMware SD-WAN sites while delivering real-time status and health of VPN sites. Establish dynamic edge-to-edge communication for all types of branches based on service level objectives and application performance. Deliver secure connectivity across all branches with PKI scalable key management. New branches join the VPN network automatically with access to all resources in other branches, enterprise datacenters, and 3rd party datacenters, like Amazon AWS.

This Module contains the following lessons:

(Optional) If you would like to proceed with all aspects of this module, please ensure that your Chicago Branch Edge is activated and configured with LAN-side interfaces, as you would have completed in Module 2. Otherwise, you will not be able to verify Overlay Connectivity to and from the Chicago Branch. However, this will not prevent from completing Module 3, if Module 2 wasn't done. 

The next version of the Lab will have this capability automated, so your Chicago Branch Edge will be activate if you decide to independently take this module. 

Cloud VPN Configuration

In this module, we will be working on three main activities:


Lab Resources

Cloud VPN Brief: One-click site-to-site cloud VPN is a VPNC-compliant IPSec VPN to connect VMware SD-WAN and non-VMware SD-WAN sites while delivering real-time status and health of VPN sites. Establish dynamic edge-to-edge communication for all types of branches based on service level objectives and application performance. Deliver secure connectivity across all branches with PKI scalable key management. New branches join the VPN network automatically with access to all resources in other branches, enterprise datacenters, and 3rd party datacenters, like Amazon AWS.



Summary of Tasks



Cloud VPN Configuration

When starting from Module 3, and if you skipped Module 2, you will need to open the web browser, and access the VCO. Please by-pass the security configuration and proceed to log into the Orchestrator using the following credentials:


Step 1:  Enable cloud VPN from Profile, Start with Branch OSPF Profile


Step 2: Next click on the Branch to VeloCloud Hub Option and click on Enable.

Step 3: "Select VeloCloud Hub". In this case, DC1 SD-WAN Edge device is selected and enabled as Hub Device. All the edge devices part of this profile will build up overlay tunnel to hub site.


Step 4: Confirm Changes. Check the Event section for the configuration applied event. This should take around 30 seconds to push the configuration from orchestrator to Sites.



With the latest changes, Branch site will establish an overlay tunnel to Hub site.

Chicago Branch Site and LAX Branch site are part of Branch OSPF Profile.

Both the Sites will show tunnel established to the Hub site. For instance, Chicago Branch site with dual internet link, List Paths will show Hub DC1 and Gateway in the path.


Step 5: Enable Hub for Branch BGP Profile. Follow the similar steps as mentioned above for Branch OSPF Profile.

Under Branch BGP Profile, enable Cloud VPN, configure Hub by clicking "Select VeloCloud Hubs", then select DC1 edge device as the Hub.

Confirm that this configuration is being applied to the appropriate edges.



Step 6: With the Hub enabled for Hybrid Sites, All the hybrid site will now establish overlay on MPLS link. Link count will change from 1 to 2.

Click Monitor then click Edges to check the status.


Due to restrictions in the lab infrastructure, it's possible that Google Maps will not display correctly. This will not prevent you from completing the lab exercise.

If you have skipped Module 2, you will not see the Chicago Branch Site in the above screenshot.




We will use the following to verify correct configuration



Verification for Internet Only Site

For Internet only site, end to end overlay will get established from Branch site (LAX and Chicago site) to the Hub Site (DC1).

Verification Step 1:

  1. Log into the SD-WAN Orchestrator 
  2. Click Test & Troubleshoot 
  3. Click Remote Diagnostics and then select the LAX Site. 
  4. Scroll to List Paths and select DC1 Hub Site, and then click Run. 
  5. The LAX shows DC1 HUB as the new path.


Verification Step 2: 

  1. Log into the VNC Viewer to access the LAX Branch Desktop
  2. Open the terminal
  3. Use the Ping from LAX branch site client machine to Subnet behind DC site (




Verification from Hybrid Site

For Hybrid Sites, end-to-end overlay will be built from Branch sites to Hub sites on both Internet and MPL link.

Let us use Dallas Branch Site for verifying Static overlay tunnel from branch site to the DC site from both Internet and MPLS link.



In this section, we successfully enabled Cloud VPN to and specified a HUB in our Branch Profiles. This allowed us to have our Internet and Hybrid sites form VPN tunnels as required. We additionally leverage the VCO monitoring tools to verify correct operation.


You've finished Module 3!

Congratulations on completing  Module 3!

If you are looking for additional information on VMware SD-WAN by VeloCloud, try one of these:

Proceed to any module below which interests you most.



How to End Lab


To end your lab click on the END button.  


Module 4 - VMware SD-WAN by VeloCloud Features and Product Tour (iSIM, Optional) (15 minutes)


In this module, we will take product tour and check-out some of the most useful features of the VMware SD-WAN Orchestrator.

Hands-on Labs Interactive Simulation: Features and Product Tour

This part of the lab is presented as a Hands-on Labs Interactive Simulation. This will allow you to experience steps which are too time-consuming or resource intensive to do live in the lab environment. In this simulation, you can use the software interface as if you are interacting with a live environment.

  1. Click here to open the interactive simulation. It will open in a new browser window or tab.
  2. When finished, click the “Return to the lab” link to continue with this lab.

The lab continues to run in the background. If the lab goes into standby mode, you can resume it after completing the module.


In this module, we took a look at the SD-WAN Orchestrator and witnessed various capabilities and options. Within the VCO we are able to deploy Edges, and assign them to Profiles. We can enable Cloud VPN to allow site-to-site connectivity and, we were able to see various operational tools.


You've finished Module 4!

Congratulations on completing  Module 4!

If you are looking for additional information on VMware SD-WAN by VeloCloud, try one of these:

Proceed to any module below which interests you most.



How to End Lab


To end your lab click on the END button.  



Thank you for participating in the VMware Hands-on Labs. Be sure to visit http://hol.vmware.com/ to continue your lab experience online.

Lab SKU: HOL-2040-01-NET

Version: 20200825-170311