--- title: "ANAP configuration - Inline Routed Mode" canonical: "https://docs.aryaka.com/space/KNOW/1300168837/ANAP%20configuration%20-%20Inline%20Routed%20Mode" format: markdown --- When the ANAP is configured using the inline routed mode , the ANAP is installed between the LAN switch and firewall. The firewall uses the M1/M2 copper ports or FM1/2 or F1/F2 fiber ports to connect to the ANAP. Though the ANAP supports NAT in this mode, we recommended not having any NAT configuration on the ANAP. Instead, configure the firewall or L3 device connected to the ISP link to provide NAT. The following overview describes the general ANAP set up. The remainder of this document describes many of these points in greater detail. Aryaka supplies the ANAP device along with ethernet cables and power cord. Connect the ANAP as shown in the graphic in the next section. The ANAP is self-provisioned by downloading its configuration file from the Aryaka Centralized Provisioning server. Download the  firewall instructions  for the site and configure your firewall. Verify that the ANAP is reachable from the firewall and the LAN subnet. Verify that the VPN tunnel between the ANAP and the POP is established: Log in to MyAryaka. The Home page appears. Click SD-WAN >  Status  in the left navigation pane. The SD-WAN Status page appears. Click the site whose details you want to view. The selected site's details page appears. Route the traffic as described in Routing traffic later in this document. Wiring the ANAP The inline routed mode supports using a single ANAP, or using two ANAPs to provide high availability (HA) failover. If fiber ports on the ANAP are used, an additional Layer 2 switch (WAN switch) needs to be placed between the ANAP and the firewall.  The descriptions of each connection type follows. To connect a single ANAP LAN port of ANAP connects to the LAN switch. M1 port of the ANAP connects to the upstream firewall. The following graphic illustrates the component relationships using inline routed mode: To connect two ANAPs for HA failover LAN IPs of both ANAPs and the virtual IP must be in the same subnet and part of same VLAN. M2 of the primary ANAP must be connected directly to M1 of the secondary ANAP, without any other L2 connections in the path. The following graphic illustrates the component relationships using inline routed mode and HA (the primary ANAP is shown above the secondary ANAP): To connect two ANAPs for HA failover with two ISPs using a WAN switch  Using a WAN switch is the only way to configure HA when ANAP fiber ports are used. You can also use a WAN switch while using an ANAP's copper ports. A Layer 2 switch (WAN switch) is placed between the ANAP and the firewall. Connect two cables between the switch and the firewall. These can be either copper or fiber cables.  FMx/Fx or Mx ports of both ANAPs connect to the four 1G SFP switch ports. Connect the switch ports to FM1/F1/M1 of both ANAPs and the switch port connecting to the firewall for traffic towards ISP1 should be configured under VLAN XYZ. Connect the switch ports to FM2/F2/M2 of both ANAPs and the switch port connecting to the firewall for traffic towards ISP2 should be configured under VLAN ABC. The LAN/FLAN port of each ANAP connects to the LAN switch. The following graphic illustrates the component relationships using inline routed mode and HA using fiber ports: To connect two ANAPs for HA failover using a WAN switch and a single ISP A Layer 2 switch is placed between the ANAP and the firewall. Connect a single cable—either fiber or copper—between the firewall and the WAN switch.  The fiber ports (FMx or Fx) on the ANAP connect to the 1G SFP switch port on the switch. If you use copper ports (Mx), connect them to the ethernet switch ports.  The switch ports connected to FMx/Fx or Mx of both ANAPs and the switch port connected to the firewall for traffic towards the ISP should be configured under one VLAN.  LAN/FLAN port of each ANAP connects to the LAN switch. The following graphic illustrates the component relationships using inline routed mode and HA using fiber ports: ANAP configuration ANAP configuration can be performed by the following two methods:  ANAP provisioning server USB connection These methods are described in the sections that follow. ANAP provisioning server The ANAP can load the required configuration from Aryaka’s provisioning server if it is directly connected to the internet or has internet access and meets the following prerequisites: The network to which the ANAP is connected must have a DHCP server. The ANAP obtains the DHCP IP from the server. The ANAP IP leased by the DHCP server must have internet access. The ANAP is connected as described in Wiring the ANAP. To configure the ANAP from the provisioning server Turn the ANAP power on. The ANAP is automatically configured with an IP address using DHCP, and then downloads the configuration file from the provisioning server. To troubleshoot provisioning server connectivity Outbound traffic from the ANAP IP address should be able to reach TCP port 443 (using HTTPS) on the internet. Typically, all outbound traffic from the trusted internal network is permitted. If you have configured any rules or access lists that restrict specific traffic, verify that these rules do not restrict traffic sourced from the ANAP. If the ANAP is unable to obtain an IP address by DHCP, ensure that the DHCP pool is not exhausted. You can plug in another machine to check if it receives an IP address from the DHCP pool. USB connection We recommend using this method only if the ANAP could  not  load the configuration from the Aryaka provisioning server for any reason. Prerequisites ANAP device USB stick supplied with the ANAP Access to MyAryaka portal A Windows computer with a free USB port To configure the ANAP from a USB stick Format the USB stick as a FAT32 file system. Download the ANAP configuration zip file from MyAryaka to your local computer: Log in to MyAryaka. The Home page appears. Click  Sites  in the left navigation pane. The Sites page appears. It displays a summary table that lists all of your organization's existing sites. Click the site whose ANAP you want to configure. The selected site's details page appears with the Site Information tab page displayed by default. Click the  Download  icon. The Site Downloads dialog appears. Click  ANAP Bootstrap Config . The Aryaka_Networks__Inc.- _Backup- .cfg.zip file downloads to your default download folder. Copy the file onto to the USB stick. Do not change the name of the file, or unzip the contents of the file. Power on the ANAP device by pressing the power switch on the back panel.  Do not connect any network cables to the ANAP device at this stage. Wait a few minutes for the ANAP to power up, then plug the USB stick into one of the USB ports on the ANAP's front panel. Reboot the ANAP with the USB stick in place. Routing traffic This section describes the three different routing methods by which traffic can be routed to your ANAP. Static routing On the L3 device, add static routes for the remote subnets using the ANAP private IP address as the next hop. The following example includes the commands to add route on Cisco ASA firewall. Command: route if_name dest_ip mask gateway_ip [distance] Example: hostname(config)# route DMZ 10.10.10.0 255.255.255.0 192.168.1.1 [1] Where 10.10.10.0 255.255.255.0 is remote subnet and 192.168.1.1 is ANAP IP (or is the VIP if two ANAPs are used in VARP). Routing information protocol (RIP) routing When you enable RIP on the L3 device and on the ANAP, the ANAP advertises the remote routes as provisioned in the POP outbound traffic to the L3 device. The ANAP runs on the TRIP (Thin-RIP) version of RIP. The ANAP does not receive RIP updates from connected devices—it only advertises them. The following example includes the commands to enable RIP on Cisco ASA firewall. Command: router rip network network_address Example: hostname(config)# router rip hostname(config-router)# network 192.168.1.0 Where 192.168.1.0 is the ANAP IP subnet. Border gateway protocol (BGP) routing This routing method uses the BGP local IP as the ANAP’s LAN/VAIP IP. After the mandatory router attributes are configured and the configuration is pushed to the ANAP, the  connected-neighbor adjacency  relationship is established. This enables the ANAP to advertise the remote subnets learnt over Aryaka Core to the customer's router and the router advertises the local subnets to the ANAP using BGP. Each site should have a unique AS number. If sites do  not  have unique AS number because iBGP is used or if there is a large number of nexuses and uniqueness is difficult to achieve, you can use MED as the preferred path advertisement method. When MED is used, configure it to use multiples of ten. Use the same preferred path advertisement method at all sites whenever possible. Preferred path calculations The Aryaka POP and the ANAP can be configured to advertise the routes into the customer's network, with one of the following attributes appended: MED AS-Path Prepend Use the same preferred path method at all sites to learn and advertise routes whenever possible. In this topic Related topics ANAP configuration - Simple Routed Mode ANAP configuration - Edge Routed Mode Virtual network firewall Manage virtual machines Configure ANAP information View a site’s status