•SD-WAN and WAN optimization - In this configuration, WAN optimization runs as a service on top of SD-WAN. The SteelCentral Controller for SteelHead (SCC) or the SteelHead Management Console handles management and configuration of the WAN optimization features. Also, SteelHead CLI-based management is supported for WAN optimization settings. You connect to the Management Console via the primary port, which also uses DHCP to acquire its IP address. For details about configuring WAN optimization features, see the SteelCentral Controller for SteelHead User Guide and the SteelHead User Guide.

•SD-WAN only - In this configuration, WAN optimization isn’t required. SCM handles the management and configuration of SD-WAN features. SCM connectivity requires one of the WAN ports that are used as uplink ports. Only the SD-WAN service can be enabled or disabled via SCM. The SD-WAN service upgrades are managed via SCM. SCM pushes the new software version according to the schedule that you set up. For details about configuring SD-WAN features, see the SteelConnect Manager User Guide and the SteelHead SD User Guide.

•Routing virtual machine (RVM) - The RVM is the control plane for all the underlay routing. All configuration from SCM (protocol, interface route maps, and policies) form the Routing Information Base (RIB) and the Forwarding Information Base (FIB), which is sent to the RVM. After the final FIB is formed, it is sent to the service core in the service virtual machine (SVM). SteelHead SD provides a clear separation between the data plane and the control plane.

•Virtual SteelHead (VSH) - The VSH manages WAN optimization services. WAN optimization is service chained into the data path and requires subscription-based licensing. Only one in-path interface is defined on SCM. This single in-path interface represents the VSH that is service chained into the SVM. It doesn’t matter what zone you put the VSH in; any packets coming into any zone are sent to the VSH. Because the VSH is separated from the routing plane, it provides WAN optimization functionality for VLANs.

•Controller virtual machine (CVM) - The CVM controls and orchestrates the entire system. It’s basically the control plane for SD-WAN and routing functions. It obtains all the configuration information from the SVM and RVM. The CVM manages appliance start up, licenses, initial configuration, and interface addressing. For details on CVM recovery from failures, see the SteelConnect Manager User Guide.

•OSPF/ABR enterprise-class routing - Open Shortest Path First (OSPF) is one of the most popular dynamic routing protocols used as an interior gateway protocol (IGP) in enterprise environments. SteelHead SD 2.0 and the SteelConnect SDI-2030 gateway support single and multi-area OSPF capabilities. Area border router (ABR) is also supported for route distribution and advertisements across a multiarea OSPF network. These advanced OSPF capabilities enable quick and seamless integration with OSPF on the LAN side of enterprise networks.

•eBGP and iBGP support - SteelHead SD 2.0 supports External Border Gateway Protocol (eBGP) and Internal Border Gateway Protocol (eBGP). eBGP is typically used in MPLS environments as an exterior gateway protocol (EGP) dynamic routing protocol. With eBGP support on SteelHead SD appliances and the SteelConnect SDI-2030 gateway, the system is able to learn and advertise routes onto the MPLS underlay network. This feature enables easy integration into the service provider’s MPLS networks without the need for complex and tedious static route configurations. SteelHead SD 2.0 also supports iBGP for interior routing within the branch office or the data center.

•ASBR support - Autonomous system boundary router (ASBR) support enables distribution of routes between different autonomous systems (AS). With full ASBR support, SteelHead SD 2.0 can distribute routes between OSPF on the LAN-side and BGP on WAN-side of your network. As part of this capability, SteelHead SD 2.0 supports route filtering and policy maps that enable you to control which routes can or cannot be distributed. The eBGP and ASBR features enable you to replace customer edge (CE) routers in branch offices.

•Topology discovery for LAN subnets - This feature enables distribution of routes from the LAN side of the network into the overlay network. Thus the SD-WAN fabric is aware of all dynamically learned routes on the LAN side of the remote sites. The topology discovery for the LAN subnets feature renders an intelligent overlay fabric for your network, avoiding tedious route configurations.

•LAN-side VLAN 802.1q support - Multiple VLANs are very common in Layer 2 (L2) network environments on the LAN side. With this feature, multiple VLANs are supported on the same LAN port (that is, trunk-port functionality). VLANs are used for segmenting networks at L2 and provide basic security for network traffic by limiting broadcast domains and network flooding.

•1:1 active-active mode HA - With 1:1 active-active HA you can deploy a pair of SteelHead SD appliances or SteelConnect SDI-2030 gateways with failover protection against LAN failures, appliance software and hardware failures, and WAN uplink failures. A key feature in active-active mode is both WAN uplinks are active, which improves overall HA failover performance. Enterprise networks have stringent network reliability requirements and 1:1 HA is a mandatory requirement for ensuring 24/7 business continuity.

•Troubleshooting and visibility: Health Check, Insights, Syslog, and SNMP - Health Check is the existing device and network health monitoring tool in SCM. Insights is a flow-based monitoring tool that provides insight into end-to-end deployments with visibility into users, applications, sites, uplinks, and networks. SteelHead SD appliances and SteelConnect SDI-2030 gateways can be monitored using Health Check and are integrated into the Insights reporting tool. They also provide SNMP-based management for easy integration into external operations support systems (OSS) and network management systems (NMS). Syslog support provides advanced logging capabilities to external servers for advanced troubleshooting and visibility.

•Advanced deployment support: split data center, direct alternate path for mesh environments - These deployments were introduced in the SteelConnect 2.10 release. With SteelHead SD 2.0/SteelConnect 2.11, these features are available on SteelHead SD 570-SD, 770-SD, 3070-SD appliances and the SteelConnect SDI-2030 gateway. Collectively these advanced deployment features increase ease of operational integration and network management.

•Zscaler security support - The Zscaler cloud security solution is supported on SteelHead SD 570-SD, 770-SD, and 3070-SD appliances and the SteelConnect SDI-2030 gateway located at the branch. SteelHead SD appliances and SteelConnect SDI-2030 gateways also provide Zscaler support for HA deployments.

•An email with the license token and SteelConnect serial number. You redeem the token in SCM where all hardware nodes and license keys are added to your organization. Each token is redeemable only once.

•An email that contains the URL for connecting to SCM and the default login and password: admin and pppp. This email is requested by the sales team and sent by the Riverbed Cloud Operations team.

•Previous versions of SteelHead SD supported an active-passive HA scheme. Because SteelHead SD 2.0 supports active-active HA, you can’t upgrade your SteelHead SD 1.0 HA seamlessly to SteelHead SD 2.0 HA. You must first manually unpair your master and backup appliances in SCM, upgrade to SteelConnect 2.11, and reconfigure HA in SCM. For details, see the SteelHead SD User Guide.

•You must back up your SteelHead WAN optimization configuration prior to upgrading to SteelHead SD 2.0. Secure vault contents (that is, certificates and keys) are not saved during the upgrade process; you must reinstall any SSL or proxy certificates. You can use the backup and restore functions on the SCC or the SteelHead Management Console to save and reapply the SteelHead configuration settings.

•To upgrade to SteelHead SD 2.0, you must have internet connectivity for the SteelHead and the SteelConnect virtual gateway. With internet connectivity, both SteelHead perpetual and SteelConnect virtual gateway subscription licenses will be applied as part of the SteelHead SD 2.0 upgrade process.

•SteelHead SD 2.0 supports a single in-path interface for WAN optimization. SteelHead SD is a Layer 3 (L3) gateway, and multiple LAN ports are mapped to a single in-path interface—multiple in-path interfaces are unnecessary on SteelHead SD appliances. To simplify in-path configuration and for ease-of-use, after upgrading to SteelHead SD 2.0 you will see only a single in-path interface in the SteelHead Management Console or the SCC. If you have multiple in-path interfaces configured for WAN optimization, you must make in-path configuration changes to account for this change.

•The SteelConnect gateway bypass feature supported on SteelHead SD 1.0 is no longer supported on SteelHead SD 2.0. If at any point the status of the virtual SteelHead instance shows a failure condition, for example a reboot or a crash, the system stops sending traffic that was destined for the virtual SteelHead. Instead, it bypasses the SteelHead thereby ensuring the traffic is not black-holed. You can compare this behavior with a physical SteelHead entering bypass mode.

•You might need to recable SteelHead SD appliances in HA deployments when you upgrade to SteelHead SD 2.0. The AUX port is mandatory for back-to-back connectivity for SteelHead SD 2.0 HA deployments.

•It is a standard electronic environment where the ambient temperature doesn’t exceed 104ºF
(40ºC) and the relative humidity doesn’t exceed 80% (noncondensing).

•Ethernet connections are available within the standard Ethernet limit.

•There is space on a standard four-post 19-inch Telco-type rack. For details about installing the SteelHead in a rack, see the Rack Installation Guide or the printed instructions that were shipped with the system. (If your rack requires special mounting screws, contact your rack manufacturer.)

•A clean power source is available, dedicated to computer devices and other electronic equipment.

•Any interim firewalls must be configured to allow traffic on ports 80 and 443 so that the software installation and SCM operations aren’t blocked. (Also any additional firewall configurations must allow traffic to and from the SteelHead appliance that is being upgraded.)

•We highly recommend that your network provides a DHCP service so the appliance can establish a connection automatically.