SteelHead SD Overview
This chapter provides an overview of the SteelHead SD architecture, interface behavior, feature changes and compatibility, and hardware and software requirements. It includes these sections:
•Introducing SteelHead SD
•SteelHead SD software architecture
•Transforming your SteelHead network
•SteelHead features unchanged after upgrading to SteelHead SD
•SteelHead features changed after upgrading to SteelHead SD
•Interface behavior before and after upgrading
•SteelHead SD and SteelConnect feature compatibility by model
•Hardware and software requirements
•NIC support
•Before you begin
This guide describes how to perform an in-field upgrade on a SteelHead CX570, CX770, or CX3070 appliance to a SteelHead SD 570-SD, 770-SD, or 3070-SD appliance. It doesn’t provide detailed information about configuring and managing SD-WAN or WAN optimization features. For details, see the SteelConnect Manager User Guide, SteelHead SD User Guide, and SteelHead User Guide.
Introducing SteelHead SD
SteelHead SD combines SD-WAN and cloud networking capabilities (powered by SteelConnect) with Riverbed WAN optimization (powered by RiOS) into a single appliance. SteelHead SD seamlessly integrates advanced SD-WAN functionality with industry-leading WAN optimization, security, and visibility services all in one streamlined appliance. SteelHead SD WAN optimization reduces bandwidth utilization and accelerates application delivery and performance, while providing SteelConnect integration in the SteelOS environment.
SteelHead SD provides you with the ability to quickly provision branch sites and deploy applications remotely. At the same time, applications are optimized to ensure performance and reduce latency with zero touch provisioning.
Typically, SteelHead SD appliances and the SteelConnect SDI-2030 gateway are located in the branch office in conjunction with SteelConnect SDI-5030 gateways at the data center. The SteelConnect SDI-2030 gateway can also be deployed inline as a 1-Gbps data center gateway with active-active HA. The SteelConnect SDI-2030 gateway can also serve as a very large branch office box with high throughput requirements. The SteelConnect SDI-2030 gateway doesn’t support WAN optimization capabilities.
SteelHead SD 2.0 advanced routing and high availability (HA) features are supported on the SteelHead SD 570-SD, 770-SD, and 3070-SD appliances and the SteelConnect SDI-2030 gateway located at the branch. For details, see the SteelHead SD User Guide and the SteelConnect Manager User Guide.
SteelHead SD deployment
SteelHead SD supports these configurations:
•SD-WAN and WAN optimization - In this configuration, WAN optimization runs as a service on top of SD-WAN. The SteelCentral Controller for SteelHead (SCC) or the SteelHead Management Console handles management and configuration of the WAN optimization features. Also, SteelHead CLI-based management is supported for WAN optimization settings. You connect to the Management Console via the primary port, which also uses DHCP to acquire its IP address. For details on configuring WAN optimization features, see the SteelCentral Controller for SteelHead User Guide and the SteelHead User Guide.
•SD-WAN only - In this configuration, WAN optimization isn’t required. SCM handles the management and configuration of SD-WAN features. SCM connectivity requires one of the WAN ports that are used as uplink ports. Only the SD-WAN service can be enabled or disabled via SCM. The SD-WAN service upgrades are managed via SCM. SCM pushes the new software version according to the schedule that you set up. For details on configuring SD-WAN features, see the SteelConnect Manager User Guide and the SteelHead SD User Guide.
SteelHead SD software architecture
SteelHead SD is based on the SteelOS infrastructure. It separates the control and data planes with internal virtual machine (VM) chaining, which provides management-plane autorecovery.
SteelHead SD software architecture
SteelHead SD provides a flexible service platform, consisting of:
•Routing virtual machine (RVM) - The RVM is the control plane for all the underlay routing. All configuration from SCM (protocol, interface route maps, and policies) form the Routing Information Base (RIB) and the Forwarding Information Base (FIB) which is sent to the RVM. After the final FIB is formed, it is sent to the service core in the service virtual machine (SVM). SteelHead SD provides a clear separation between the data plane and the control plane.
•Service virtual machine (SVM) - The SVM is the core data plane of the appliance that provides service chained network functions. These VMs include services such as QoS shaping, QoS marking, traffic filtering, path selection, encryption, application identification, and so forth. This architecture allows for extensible plug-and-play services that can be enabled, disabled, or reused in the packet flow chain, which in turn provides faster recovery and minimal disruption. For SteelHead SD, each packet goes through its own set of service functions (LAN ingress, LAN egress, WAN ingress, WAN egress).
•Virtual SteelHead (vSH) - The vSH manages WAN optimization services. WAN optimization is service chained into the data path and requires subscription-based licensing. Only one in-path interface is defined on SCM. This single in-path interface represents the vSH that is service chained into the SVM. It doesn’t matter what zone you put the vSH in; any packets coming into any zone are sent to the vSH. Because the vSH is separated from the routing plane, it provides WAN optimization functionality for VLANs.
•Controller virtual machine (CVM) - The CVM controls and orchestrates the entire system. It’s basically the control plane for SD-WAN and routing functions. It obtains all the configuration information from the SVM and RVM. The CVM manages appliance start up, licenses, initial configuration, and interface addressing.
SteelHead SD port mapping between the VMs and physical ports
The SVM and RVM connect to all ports on the SteelHead SD appliance except for the primary port. The primary port is connected directly to the vSH. The CVM is connected to the auxiliary (AUX) port and the WAN uplinks only. All the data and control packets are handled by the SVM and RVM.
The SteelHead SD AUX, LAN (LAN0_0, LAN0_1 or on the CX3070 LAN3_0, LAN3_1), and WAN (WAN0_0, WAN0_1 or on the CX3070 WAN3_0, WAN3_1) ports are connected to the SVM and RVM. Basically, there is a Layer 3 edge router on all of these ports.
The AUX and WAN ports are configured as uplinks on SCM. The AUX port can be used as an additional WAN uplink. The AUX port is also the dedicated port for SteelHead SD high-availability deployments.
Port mapping between VMs and physical ports
Transforming your SteelHead network
Although SteelHead and SteelHead SD share the same hardware, they run different software and serve very different purposes.
To illustrate these differences, examine this table.
 
SteelHead CX3070
SteelHead SD 3070-SD
Software
RiOS
SteelOS
Network device type
Layer 2
Layer 3
Purpose
WAN optimization
SD-WAN and, optionally, WAN optimization
Icon
An in-field upgrade of the SteelHead CX appliance is much more than a simple upgrade; it requires a transformation of the SteelHead appliance from a Layer 2 WAN optimization device to a Layer 3 edge router.
Before you begin the upgrade process, it is important to determine what kind of network topology you have and how it will change when you convert to SteelHead SD. The conversion process requires that you transform your network where the SteelHead SD appliance acts as an SD-WAN device using Layer 3 networking protocols and that also performs WAN optimization.
Transforming a SteelHead deployment
It is imperative that you plan your network architecture and deployment. You will have to rearchitect the network WAN, Layer 3 hops with the gateway, WAN uplinks, SD-WAN features, SCM cloud management, and high availability (HA).
We recommend that you contact Riverbed sales engineering before you begin the in-field upgrade process so that they can assist you with designing and deploying your SD-WAN network.
SteelHead features unchanged after upgrading to SteelHead SD
The majority of SteelHead features remain unchanged when you upgrade to SteelHead SD.
SteelHead feature
Feature after upgrading to SteelHead SD
Layer 7 optimization blades
All Layer 7 SteelHead optimization blades are supported. For example, HTTP, SSL, CIFS/SMB, MAPI, Oracle Forms, NFS, Lotus Notes, and storage replication (for example, SnapMirror) all operate normally and are unchanged.
The Citrix optimization blade is supported but the ability to support the optimization of Multi-Stream ICA within the blade is no longer possible because the QoS functionality is taken care of by the service virtual machine (SVM) in SteelHead SD.
You cannot optimize UDP traffic using the SteelHead IP blade as traffic is not redirected through the virtual SteelHead.
SteelHead SaaS and the new SaaS Accelerator
SteelHead SD 2.0 supports SteelHead SaaS and the SaaS Accelerator. The SaaS Accelerator is not available on SteelConnect 2.11 gateways.
Web proxy
SteelHead SD supports SteelHead Web proxy.
CIFS prepopulation
SteelHead SD supports SteelHead CIFS prepopulation.
Active Directory integration
SteelHead SD supports SteelHead Active Directory integration. Because the virtual SteelHead instance has full control of the primary interface, it supports Active Directory integration and server-side out-of-path deployments.
Data store synchronization
SteelHead SD supports SteelHead data store synchronization on the primary interface with an adjacent SteelHead appliance.
Caching DNS service
SteelHead SD supports the SteelHead caching DNS service. With the caching DNS service, because the AUX port isn’t available to the virtual SteelHead, caching DNS is limited to the primary interface only.
Transport performance features
SteelHead SD supports SteelHead high speed TCP and bandwidth estimation, satellite features such as SCPS, and single-ended connections.
Management, reporting, and diagnostics
SteelHead SD supports SteelHead domain, host, and port labels, as well as in-path and peering rules.
Secure vault
SteelHead SD supports SteelHead secure vault. The secure vault password is retained when you upgrade from SteelHead to SteelHead SD.
Management access controls
SteelHead SD supports SteelHead management access controls including Radius and TACACS, and role-based access.
TCP dump export
SteelHead SD supports SteelHead export of TCP dumps.
SteelHead features changed after upgrading to SteelHead SD
This table summarizes the features that have changed after converting to SteelHead SD.
SteelHead feature
Feature after upgrading to SteelHead SD
WAN-optimization only mode
WAN-optimization only mode is not supported on SteelHead SD.
Hybrid networking services (path selection, secure transport, QoS)
Hybrid networking services (path selection, secure transport, QoS) are not supported on SteelHead SD. The network services of QoS, path selection and secure transport replaced by SteelConnect SD-WAN counterparts.
Any QoS feature configuration on the original SteelHead must be converted to the new QoS in SCM.
MX-TCP, because it was part of QoS, is not supported on SteelHead SD.
Citrix Multistream ICA is not supported on SteelHead SD.
Multiple in-path interfaces for WAN optimization
SteelHead SD does not support multiple in-path interfaces for WAN optimization. Given that SteelHead SD is a Layer 3 gateway, multiple LAN ports and segments can be mapped to a single in-path interface. There is no longer a need for multiple in-path interfaces on an SteelHead SD appliance. After upgrading from SteelHead to SteelHead SD you must reconfigure your multiple in-path interfaces to a single in-path configuration.
Virtual in-path or WCCP/PBR
Virtual in-path or WCCP/PBR is not supported on SteelHead SD. The concept of virtual in-path is not relevant for the WAN optimization of SteelHead SD. Thus, there is no need for WCCP or PBR.
Simplified Routing and VLAN transparency
Simplified Routing and VLAN transparency is not supported on SteelHead SD. Because the in-path interface on the virtual SteelHead instance within SteelHead SD doesn’t sit physically in-path on the network, there is no need for Simplified Routing or VLAN transparency.
IPSec, subnet side rules, MXTCP and link state propagation
IPSec, subnet side rules, MXTCP and link state propagation are not supported on SteelHead SD.
Serial high availability (HA)
After upgrading, serial HA is not supported on SteelHead SD 2.0. SteelHead appliances in an HA pair must be individually shut down and upgraded separately.
Active-active (1:1) HA is supported on SteelHead SD 2.0.
NIC bypass (fail-to-wire)
Currently, NIC level bypass or fail-to-wire is not supported in SteelHead SD.
If at any point the status of the virtual SteelHead instance shows a failure condition, for example a reboot or a crash, the system stops sending traffic that was destined for the virtual SteelHead. Instead, it bypasses the SteelHead thereby ensuring the traffic is not black-holed. You can compare this behavior with a physical SteelHead entering bypass mode.
The traditional SteelHead bypass functionality doesn’t apply 1:1 to a SteelHead SD appliance because it is now an SD-WAN appliance that acts as a Layer 3 hop (or a custom edge router in some cases). Enabling NIC bypass mode without proper routing architecture support can lead to unintended traffic path behavior and can have security implications.
Fail-to-block
If a SteelHead SD appliance fails, the appliance goes into fail-to-block mode.
If only the SteelHead WAN optimization service fails, then traffic is passed through unoptimized and the SteelConnect SD-WAN service remains fully operational.
If only the SteelConnect SD-WAN service fails, then all traffic on the gateway is blocked.
Data store synchronization
Data store synchronization is supported only on the primary interface because the AUX interface isn’t available to the virtual SteelHead. (The AUX port is the dedicated port used in HA configurations; it can also be used as an additional WAN uplink.)
RADIUS/Authentication server under Sites
RADIUS/Authentication server under Sites configuration in SCM is not supported on SteelHead SD 570-SD, 770-SD, 3070-SD, and SDI-2030 appliances.
Consult with your Riverbed sales engineer or Riverbed Professional Services at http://www.riverbed.com/services/index.html.
Redirection of UDP traffic through the virtual SteelHead
Redirection of UDP traffic through the virtual SteelHead is not supported in SteelHead SD 2.0. You cannot optimize UDP traffic using the SteelHead IP blade.
Source NAT on underlay traffic
Source NAT on underlay traffic is not supported on SteelHead SD 570-SD, 770-SD, 3070-SD, and SDI-2030.
SteelHead SD appliances do not perform source NATing on underlay traffic exiting via the Internet uplink if it is destined for a private address, regardless of the configured outbound NAT setting. This is a change from the previous behavior for SteelHead SD 1.0 appliances, if NAT was enabled for an uplink, NAT was performed for all traffic exiting via the Internet uplink. For details on configuring NAT, see the SteelConnect Manager User Guide.
SteelHead Management Console GUI pages
These SteelHead Management Console GUI elements are not supported in SteelHead SD 2.0:
•QoS reports.
•Flow export settings: Export QoS and application statistics to Cascade Flow Collectors.
•Subnet side rules.
•WCCP settings.
•Connection forwarding settings.
•Failover settings.
•In-Path Settings: Enabling Link State Propagation.
•IPSec settings.
•AUX interface setting in the Base Interfaces page.
•Caching DNS: Listen on AUX interface check box.
Interface behavior before and after upgrading
Interface attribute
Before upgrade (SteelHead)
After upgrade (SteelHead SD)
Appliance management
SteelHead Management Console
SCM
Primary port interface
•SteelHead management via the SCC or SteelHead Management Console.
•DHCP or statically configured.
The virtual SteelHead instance within the SteelHead SD does not have control of the physical network ports except for the Primary interface.
•The primary port is used for management of the virtual SteelHead on SteelHead SD using the SCC or SteelHead Management Console.
•DHCP or statically configured using the SteelHead SD Management Console. The primary IP address can be acquired using DHCP from the SteelConnect DHCP service. You must cable the primary back to a LAN port using a switch.
•In a deployments where data store synchronization is used between two adjacent SteelHead appliances, the primary interface must be used for the data synchronization of traffic.
Auxiliary (AUX) port interface
Backup management port.
The AUX port can be used as an additional WAN uplink on SteelHead SD. The AUX port is also the dedicated port for SteelHead SD HA deployments.
The AUX port is not available for data store synchronization between two adjacent SteelHead appliances, the primary interface must be used for the synchronization traffic.
In-path management
Management through the SCC or SteelHead Management Console.
Management of the vSH through the in-path management interface must be reconfigured.
In-path interface
Typically one or two SteelHead in-path interfaces are configured (for example, internet and MPLS) over physical LAN and WAN pairs.
The inpath0_0 interface must be reconfigured after upgrade.
SCC hosting
Typically, in the data center and used to manage remote SteelHeads using MPLS paths.
The virtual SteelHead on SteelHead SD will continue to be managed via SCC over MPLS path.
Internet connectivity options
Local breakout or through MPLS from headquarters site.
Internet breakout options must be configured appropriately in SCM.
Baseboard Management Controller (BMC)
Available to remotely power the appliance off and on.
For SteelHead SD 2.0, this port is unavailable.
SteelHead SD and SteelConnect feature compatibility by model
Feature
SteelHead 570-SD, 770-SD, 3070-SD
SDI-2030
SDI-130
SDI-330
SDI-1030
SDI-5030
Virtual GW
Cloud GW
eBGP
Yes
Yes
Yes
Yes
Yes
Yes
Yes
No
iBGP
Yes
Yes
No
No
No
No
No
No
OSPF single area
Yes
Yes
Yes
Yes
Yes
No
No
—
OSPF multi-area ABR
Yes
Yes
No
No
No
No
No
—
ASBR
Yes
Yes
Yes* (Underlay routing inter-working solution)
Yes* (Underlay routing inter-working solution)
Yes* (Underlay routing inter-working solution)
No
Yes* (Underlay routing inter-working solution)
No
Route retraction
Yes
Yes
No
No
No
Yes
No
No
Default route originate
OSPF/BGP
OSPF/BGP LAN and WAN
OSPF-only LAN
OSPF-only LAN
OSPF-only LAN
BGP only
OSPF-only LAN
No
Overlay route injection in LAN
Yes
Yes
No
No
No
Yes
No
No
Local subnet discovery
Yes
Yes
No
No
No
Yes
No
No
Static routes
Yes
Yes (LAN and WAN)
Yes (3rd-party routes)
Yes (3rd-party routes)
Yes (3rd-party routes)
Yes
Yes (3rd-party routes)
Yes (3rd-party routes)
VLAN support (LAN side)
Yes
Yes
Yes
Yes
Yes
Yes
Yes
—
1:1 Active-Active High Availability
Yes
Yes
No (Active-Passive HA)
No (Active-Passive HA)
No (Active-Passive HA)
No (HA cluster)
No (Active-Passive HA)
No (Active-Passive HA AWS)
Brownfield transit for internet-only branch
Yes
(As an edge device only)
Yes
Yes
(As an edge device only)
Yes
(As an edge device only)
Yes
Yes
Yes
(As an edge device only)
Yes
(As an edge device only)
Native VLAN support
No
No
Yes
Yes
No
No
Yes
—
*SCM 2.9 and later support an underlay routing interworking solution that bridges BGP and OSPF. For details, see the SteelConnect Manager User Guide.
Hardware and software requirements
Riverbed component
Hardware and software requirements
SteelHead SD appliance
The SteelHead SD 570-SD and 770-SD appliances are desktop models.
The SteelHead SD 3070-SD appliance requires a 19-inch
(483 mm) four-post rack. For details, see the Rack Installation Guide.
Upgrading from SteelHead to SteelHead SD requires the RiOS 9.7.1a virtual SteelHead (vSH) image. The 9.7.1a vSH image is contained within the SteelHead SD 2.0/SteelConnect 2.11. The supported SteelHead to SteelHead SD upgrade paths are:
–9.6.1 > SteelHead SD 2.0 (includes 9.7.1a vSH)
–9.6.2 > SteelHead SD 2.0 (includes 9.7.1a vSH)
–9.6.2a > SteelHead SD 2.0 (includes 9.7.1a vSH)
–9.7.0 or 9.7.0a > 9.7.1 > SteelHead SD 2.0 (includes 9.7.1a vSH)
SteelHead SD Management Console
The Management Console has been tested with all versions of Chrome, Mozilla Firefox Extended Support Release version 38, and Microsoft Internet Explorer 11.
JavaScript and cookies must be enabled in your web browser.
SteelConnect and SteelConnect Manager (SCM)
SteelHead SD requires SteelConnect 2.11or later.
SCM supports the latest version of the Chrome browser. SCM requires a minimum screen resolution of 1280 x 720 pixels. We recommend a maximum of 1600 pixels for optimal viewing.
SteelCentral Controller for SteelHead (SCC)
To use the SCC to upgrade SteelHead to SteelHead SD, you must have SCC 9.7.1 installed.
Upgrading SCC to 9.8 removes the in-field upgrade option in SCC. The SCC must be running version 9.7.1 for the SteelHead SD in-field upgrade wizard to appear.
Firewall requirements
The SteelHead SD 570-SD, 770-SD, 3070-SD, and SDI-2030 support stateful application-based firewalls at the network edge. For details on SteelConnect firewall and security features, see the SteelConnect SD-WAN Deployment Guide.
All communication is sourced from the site out to the SteelConnect management service. There’s no need to set up elaborate firewall or forwarding rules to establish the dynamic full-mesh VPN or to gain connectivity to the cloud. After you register an appliance, it receives its assigned configuration automatically. For details on SteelConnect firewall requirements, see the SteelConnect Manager User Guide.
Make sure the firewall ports 80 and 443 are open so that software installation and SCM operations aren’t blocked. For details on SteelConnect default ports, see the SteelConnect Connection Ports.
Ethernet network compatibility
The SteelHead SD appliance supports these Ethernet networking standards.
Ethernet standard
IEEE standard
Ethernet Logical Link Control (LLC)
IEEE 802.2 - 1998
Fast Ethernet 100BASE-TX
IEEE 802.3 - 2008
Gigabit Ethernet over Copper 1000BASE-T (All copper interfaces are autosensing for speed and duplex.)
IEEE 802.3 - 2008
Gigabit Ethernet over Fiber 1000BASE-SX (LC connector)
IEEE 802.3 - 2008
Gigabit Ethernet over Fiber 1000BASE-LX
IEEE 802.3 - 2008
Gigabit Ethernet over Fiber 10GBASE-LR Single Mode
IEEE 802.3 - 2008
Gigabit Ethernet over 10GBASE-SR Multimode
IEEE 802.3 - 2008
SNMP-based management compatibility
SteelConnect SD-WAN service supports proprietary MIBs accessible through SNMPv2 and SNMPv3. For details on the SD-WAN service MIB, see the SteelConnect Manager User Guide.
The SteelHead WAN optimization supports proprietary MIBs accessible through SNMP, SNMPv1, SNMPv2c, and SNMPv3, although some MIB items might only be accessible through SNMPv2 and SNMPv3. For details on the WAN optimization service MIB, see the SteelHead User Guide.
For details on SteelConnect SNMP support, see the SteelConnect Manager User Guide and the SteelHead SD User Guide.
NIC support
Network interface cards (NICs) are supported on the SteelHead SD 3070-SD appliances for nonbypass traffic. NICs aren’t supported on the SteelHead SD 570-SD and 770-SD appliances.
For SteelHead SD 3070-SD appliances, bypass NICs aren’t required for SteelConnect gateway deployments since LAN traffic requires network address translation (NAT) before it reaches the service provider network.
You can install these NICs in the SteelHead SD 3070-SD appliance for nonbypass traffic.
NICs
Size (*)
Manufacturing part #
Orderable part #
Two-Port 10-GbE Fiber SFP+
HHHL
410-00036-02
NIC-1-010G-2SFPP
Four-Port 10-GbE Fiber SFP+
HHHL
410-00108-01
NIC-1-010G-4SFPP
*HHHL = Half Height, Half Length
If you have the Two-Port 10-GbE Fiber SR NIC (410-00302-03/NIC-1-010G-2SR-BP) installed on the CX3070 appliance, you must remove the card before you begin the in-field upgrade. The CX3070 motherboard contains 1GB NICs that can be used for uplinks if capacity planning doesn't mandate 10-GB. You can buy or exchange the 10-GB bypass NIC with a 10-GB nonbypass NIC prior to upgrading if you prefer.
For details on NICs, see the Network and Storage Card Installation Guide.
Before you begin
•Any interim firewalls must be configured to allow traffic on ports 80 and 443 so that the software installation and SCM operations aren’t blocked. (Also, any additional firewall configurations must allow traffic to and from the SteelHead appliance that is being upgraded.)
•Make sure at least one WAN port has internet connectivity.
•We highly recommend that your network provides a DHCP service so the appliance can establish a connection automatically.