--- title: "ANAP configuration - Edge Routed Mode" canonical: "https://docs.aryaka.com/space/KNOW/1299611679/ANAP%20configuration%20-%20Edge%20Routed%20Mode" format: markdown --- The edge routed installation mode connects the ANAP’s M1 or M2 port (copper) or FM1/F1 and FM2/F2 ports (fiber) to the ISP links. Aryaka ANAPs support one, two, or three ISP links. If there are two ISP providers, the VPN traffic from the ANAP to the Aryaka POP can utilize both of the links, with the Internet traffic from the LAN passing over the single ISP link connected to the copper or fiber ports. In the case of failure of one of the links, the internet traffic automatically switches to the other link. This detection mechanism is built into the ANAP. The following overview describes the general ANAP set up. The remainder of this document describes many of these points in greater detail. Aryaka supplies the ANAP device along with ethernet cables and power cord. Connect the ANAP as shown in the graphic in the next section. The ANAP is self-provisioned by downloading its configuration file from the Aryaka Centralized Provisioning server. Verify that the ANAP is reachable from the firewall and the LAN subnet. Verify that the VPN tunnel between the ANAP and the POP is established: Log in to MyAryaka. The Home page appears. Click SD-WAN >  Status  in the left navigation pane. The SD-WAN Status page appears. Click the site whose details you want to view. The selected site's details page appears. Verify internet access from the LAN through the ANAP. This confirms that the default NAT rules on the ANAP that provide internet access are working as expected. Route the traffic as described in Routing traffic later in this document. Wiring the ANAP The edge routed mode supports the following connection types: One ANAP connected to a single ISP One ANAP connected to two (or three) ISPs to provide ISP failover Two ANAPs connected to a single ISP for HA failover Two ANAPs connected to two (or three) ISPs for HA and ISP failover Using a WAN Switch In addition to the previously mentioned connection types, the two ANAPs can also be connected to a single or a pair of ISPs using a Layer 2 switch or a WAN switch to provide high availability (HA). This is the only supported configuration when either ISP handover or ANAP ports are fiber.    The following table describes the wiring methodology and combinations of ports supported for each scenario.  Wiring Type ANAP 1 ANAP 2 ISP 1 ISP 2 Without WAN switch M1 M2 M1 M2 Copper only Copper only With WAN switch M1 M2 M1 M2 Fiber or copper F1/FM1 F2/FM2 F1/FM1 F2/FM2 M1 F2/FM2 M1 F2/FM2 F1/FM1 M2 F1/FM1 M2 To connect one ANAP to a single ISP M1 port of the ANAP connects to the ISP. LAN port of the ANAP connects to the LAN switch. The following graphic illustrates the component relationships using edge routed mode with one ANAP and one ISP: To connect one ANAP to two ISPs ISP 1 connects to the M1 port of the ANAP. ISP 2 connects to the M2 port of the ANAP. LAN port of ANAP connects to the LAN switch. The following graphic illustrates the component relationships using edge routed mode with one ANAP and two ISPs: To connect two ANAPs to one ISP ISP connects to the M1 port of the primary ANAP. M2 of primary ANAP should be directly connected directly to M1 of the secondary ANAP, without any other L2 connections in the path. LAN port of each ANAP connects to the LAN switch. The following graphic illustrates the component relationships using edge routed mode with two ANAPs and one ISP: To connect two ANAPs to two ISPs ISP 1 connects to the M1 port of the primary ANAP. ISP 2 connects to the M2 port of the primary ANAP. M2 of primary ANAP should be directly connected directly to M1 of the secondary ANAP, without any other L2 connections in the path. LAN port of each ANAP connects to the LAN switch. The following graphic illustrates the component relationships using edge routed mode with two ANAPs and two ISPs: To connect two ANAPs to two ISPs using a WAN switch A Layer 2 switch (WAN switch) is placed between the ANAP and the ISPs links. ISP1 and ISP2 connect to the switch ports of the switch. The ISP handoffs can be copper or fiber.  The fiber ports (FM1/2 or F1/2) on the ANAP connect to the 1G SFP switch port on the switch. If copper ports (M1/2) are used, connect them to the ethernet switch ports.  Switch ports connected to FM1/F1 or M1 of both ANAPs and the ISP1 must be configured under VLAN XYZ. Switch ports connected to FM2/F2 or M2 of both ANAPs and the ISP2 must be configured under VLAN ABC. LAN/FLAN port of each ANAP connects to the LAN switch. The following graphic illustrates the component relationships using edge routed mode with two ANAPs and two ISPs using fiber ports: To connect two ANAPs to a single ISP using a WAN switch A Layer 2 switch is placed between the ANAP and the ISP's links The ISP connects to the switch port of the switch The ISP handoff can be copper or fiber.  The ANAPs' fiber ports (FMx or Fx) connect to the 1G SFP switch port on the switch. If copper ports (Mx) are used, connect them to the ethernet switch ports.  Switch ports connected to FMx/Fx or Mx of both ANAPs and the ISP must be configured under VLAN XYZ. LAN/FLAN port of each ANAP connects to the LAN switch. ANAP configuration ANAP configuration can be performed by the following two methods:  ANAP provisioning server USB connection These methods are described in the sections that follow. ANAP provisioning server The ANAP can load the required configuration from Aryaka’s provisioning server if it is directly connected to the internet or has internet access and meets the following prerequisites: The network to which the ANAP is connected must have a DHCP server. The ANAP obtains the DHCP IP from the server. The ANAP IP leased by the DHCP server must have internet access. The ANAP is connected as described in Wiring the ANAP. To configure the ANAP from the provisioning server Turn the ANAP power on. The ANAP is automatically configured with an IP address using DHCP, and then downloads the configuration file from the provisioning server. To troubleshoot provisioning server connectivity Outbound traffic from the ANAP IP address should be able to reach TCP port 443 (using HTTPS) on the internet. Typically, all outbound traffic from the trusted internal network is permitted. If you have configured any rules or access lists that restrict specific traffic, verify that these rules do not restrict traffic sourced from the ANAP. If the ANAP is unable to obtain an IP address by DHCP, ensure that the DHCP pool is not exhausted. You can plug in another machine to check if it receives an IP address from the DHCP pool. USB connection We recommend using this method only if the ANAP could  not  load the configuration from the Aryaka provisioning server for any reason. Prerequisites ANAP device USB stick supplied with the ANAP Access to MyAryaka portal A Windows computer with a free USB port To configure the ANAP from a USB stick Format the USB stick as a FAT32 file system. Download the ANAP configuration zip file from MyAryaka to your local computer: Log in to MyAryaka. The Home page appears. Click  Sites  in the left navigation pane. The Sites page appears. It displays a summary table that lists all of your organization's existing sites. Click the site whose ANAP you want to configure. The selected site's details page appears with the Site Information tab page displayed by default. Click the  Download icon. The Site Downloads dialog appears. Click  ANAP Bootstrap Config . The Aryaka_Networks__Inc.- _Backup- .cfg.zip file downloads to your default download folder. Copy the file onto to the USB stick. Do not change the name of the file or unzip the contents of the file. Power on the ANAP device by pressing the power switch on the back panel.  Do not connect any network cables to the ANAP device at this stage. Wait for few minutes for the ANAP to power up, then plug the USB stick into one of the USB ports on the ANAP's front panel. Reboot the ANAP with the USB stick in place. Routing traffic This section describes the three different routing methods by which traffic can be routed to your ANAP. Static routing On the L3 device, add static routes for the remote subnets using the ANAP private IP address as the next hop. The following example includes the commands to add route on Cisco ASA firewall. Command: route if_name dest_ip mask gateway_ip [distance] Example: hostname(config)# route DMZ 10.10.10.0 255.255.255.0 192.168.1.1 [1] Where 10.10.10.0 255.255.255.0 is remote subnet and 192.168.1.1 is ANAP IP (or is the VIP if two ANAPs are used in VARP). Routing information protocol (RIP) routing When you enable RIP on the L3 device and on the ANAP, the ANAP advertises the remote routes as provisioned in the POP outbound traffic to the L3 device. The ANAP runs on the TRIP (Thin-RIP) version of RIP. The ANAP does not receive RIP updates from connected devices—it only advertises them. The following example includes the commands to enable RIP on Cisco ASA firewall. Command: router rip network network_address Example: hostname(config)# router rip hostname(config-router)# network 192.168.1.0 Where 192.168.1.0 is the ANAP IP subnet. Border gateway protocol (BGP) routing This routing method uses the BGP local IP as the ANAP’s LAN/VAIP IP. After the mandatory router attributes are configured and the configuration is pushed to the ANAP, the  connected-neighbor adjacency  relationship is established. This enables the ANAP to advertise the remote subnets learnt over Aryaka Core to the customer's router and the router advertises the local subnets to the ANAP using BGP. Each site should have a unique AS number. If sites do  not  have unique AS number because iBGP is used or if there are a large number of nexuses and uniqueness is difficult to achieve, you can use MED as the preferred path advertisement method. When MED is used, configure it to use multiples of ten. Use the same preferred path advertisement method at all sites whenever possible. Preferred path calculations The Aryaka POP and the ANAP can be configured to advertise the routes into the customer's network, with one of the following attributes appended: MED AS-Path Prepend Use the same preferred path method at all sites to learn and advertise routes whenever possible. In this topic Related topics ANAP configuration - Simple Routed Mode ANAP configuration - Inline Routed Mode Configure ANAP information View a site’s status