Skip to main content
Viptela is now part of Cisco.
Support
Product Documentation
Viptela Documentation

VPN Interface Cellular

Use the VPN-Interface-Cellular feature template to configure cellular module parameters on vEdge routers.

To configure cellular interfaces using vManage templates:

  1. Create a VPN-Interface-Cellular feature template to configure cellular module parameters, as described in this article.
  2. Create a Cellular-Profile template to configure the profiles used by the cellular modem. See the Cellular Profile help topic.
  3. Create a VPN feature template to configure VPN parameters. See the VPN help topic.

Navigate to the Template Screen

  1. In vManage NMS, select the Configuration ► Templates screen.
  2. In the Device tab, click Create Template.
  3. From the Create Template drop-down, select From Feature Template.
  4. From the Device Model drop-down, select the type of device for which you are creating the template.
  5. Click the Transport & Management VPN tab located directly beneath the Description field, or scroll to the Transport & Management VPN section.
  6. Under Additional VPN 0 Templates, located to the right of the screen, click VPN Interface Cellular.
  7. From the VPN Interface Cellular drop-down, click Create Template. The VPN-Interface-Cellular template form is displayed. The top of the form contains fields for naming the template, and the bottom contains fields for defining VPN Interface Cellular parameters.
  8. In the Template Name field, enter a name for the template. The name can be up to 128 characters and can contain only alphanumeric characters.
  9. In the Template Description field, enter a description of the template. The description can be up to 2048 characters and can contain only alphanumeric characters.

When you first open a feature template, for each parameter that has a default value, the scope is set to Default (indicated by a check mark), and the default setting or value is shown. To change the default or to enter a value, click the scope drop-down to the left of the parameter field and select one of the following:

Parameter Scope

Scope Description

Device Specific (indicated by a host icon)

Use a device-specific value for the parameter. For device-specific parameters, you cannot enter a value in the feature template. You enter the value when you attach a Viptela device to a device template.

When you click Device Specific, the Enter Key box opens. This box displays a key, which is a unique string that identifies the parameter in a CSV file that you create. This file is an Excel spreadsheet that contains one column for each key. The header row contains the key names (one key per column), and each row after that corresponds to a device and defines the values of the keys for that device. You upload the CSV file when you attach a Viptela device to a device template. For more information, see Create a Template Variables Spreadsheet.

To change the default key, type a new string and move the cursor out of the Enter Key box.

Examples of device-specific parameters are system IP address, hostname, GPS location, and site ID.

Global (indicated by a globe icon)

Enter a value for the parameter, and apply that value to all devices.

Examples of parameters that you might apply globally to a group of devices are DNS server, syslog server, and interface MTUs.

Configure Basic Cellular Interface Functionality

To configure basic cellular interface functionality, select the Basic Configuration tab and configure the following parameters. Parameters marked with an asterisk are required to configure an interface. You must also configure a tunnel interface for the cellular interface.

Parameter Name Description
Shutdown* Click No to enable the interface.
Technology Cellular technology. The default is lte. Other values are auto and cdma. For ZTP to work, the technology must be auto.
Interface Name* Enter the name of the interface. It must be cellular0.
Profile ID* Enter the identification number of the cellular profile. This is the profile identifier that you configure in the Cellular-Profile template.
Range: 1 through 15
Description Enter a description of the cellular interface.
IPv4 Configuration

To configure a static address, click Static and enter an IPv4 address.

To set the interface as a DHCP client so that the interface to receive its IP address from a DHCP server, click Dynamic. You can optionally set the DHCP distance to specify the administrative distance of routes learned from a DHCP server. The default DHCP distance is 1.

IPv6 Configuration

To configure a static address for an interface in VPN 0, click Static and enter an IPv6 address.

To set the interface as a DHCP client so that the interface to receive its IP address from a DHCP server, click Dynamic.You can optionally set the DHCP distance to specify the administrative distance of routes learned from a DHCP server. The default DHCP distance is 1. You can optionally enable DHCP rapid commit, to speed up the assignment of IP addresses.

DHCP Helper

Enter up to four IP addresses for DHCP servers in the network, separated by commas, to have the interface be a DHCP helper. A DHCP helper interface forwards BOOTP (Broadcast) DHCP requests that it receives from the specified DHCP servers.

Block Non-Source IP Click Yes to have the interface forward traffic only if the source IP address of the traffic matches the interface's IP prefix range.
Bandwidth Upstream For transmitted traffic, set the bandwidth above which to generate notifications.
Range: 1 through (232 / 2) – 1 kbps
Bandwidth Downstream For received traffic, set the bandwidth above which to generate notifications.
Range: 1 through (232 / 2) – 1 kbps
IP MTU*

Enter 1428 to set the MTU size, in bytes. This value must be 1428. You cannot use a different value.

To save the feature template, click Save.

CLI equivalent:

vpn 0
  interface cellular0
    bandwidth-downstream kbps
    bandwidth-upstream kbps 
    block-non-source-ip
    (ip address ip-address/length | ip dhcp-client [dhcp-distance number])
    (ipv6 address ipv6-prefix/length | ipv6 dhcp-client [dhcp-distance number] [dhcp-rapid-comit])
    mtu 1428
    profile  number
    no shutdown

Create a Tunnel Interface

To configure an interface in VPN 0 to be a WAN transport connection, you must configure a tunnel interface on the cellular interface. The tunnel, which provides security from attacks, is used to send the phone number. At a minimum, select On and select a color for the interface, as described in the previous section. You can generally accept the system defaults for the remainder of the tunnel interface settings.

To configure a tunnel interface, select the Tunnel tab and configure the following parameters. Parameters marked with an asterisk are required to configure a cellular interface.

Parameter Name Description
Tunnel Interface* Click On to create a tunnel interface.
Color* Select a color for the TLOC. The color typically used for cellular interface tunnels is lte.
Control Connection The default is On, which establishes a control connection for the TLOC. If the vEdge router has multiple TLOCs, click No to have a tunnel not establish a TLOC.
Maximum Control Connections

Set the maximum number of vSmart controllers that the WAN tunnel interface can connect to. To have the tunnel establish no control connections, set the number to 0.
Range: 0 through 8

Default: 2

vBond As STUN Server Click On to enable Session Traversal Utilities for NAT (STUN) to allow the tunnel interface to discover its public IP address and port number when the vEdge router is located behind a NAT.
Exclude Control Group List Set the identifiers of one or more vSmart controller groups that this tunnel is not allows to establish control connections with.
Range: 0 through 100
vManage Connection Preference Set the preference for using the tunnel to exchange control traffic with the vManage NMS.
Range: 0 through 9
Default: 5
Low-Bandwidth Link Click On to set the tunnel interface as a low-bandwidth link.
Allow Service Click On or Off for each service to allow or disallow the service on the cellular interface.

To configure additional tunnel interface parameters, click Advanced Options and configure the following parameters:

Parameter Name Description
Encapsulation

Select the encapsulation to use on the tunnel interface. The default is IPsec.

You can select both IPsec and GRE encapsulation. In this case, two TLOCs are created for the tunnel interface, and they have the same IP address and color, but they have different encapsulations.

IPsec Preference

Enter a value to set the preference for directing traffic to the tunnel. A higher value is preferred over a lower value.
Range: 0 through 4294967295
Default: 0

IPsec Weight

Enter a weight to use to balance traffic across multiple TLOCs. A higher value sends more traffic to the tunnel.
Range: 1 through 255
Default: 1

Carrier

Select the carrier name or private network identifier to associate with the tunnel.
Values: carrier1, carrier2, carrier3, carrier4, carrier5, carrier6, carrier7, carrier8, default
Default: default

Bind Loopback Tunnel Enter the name of a physical interface to bind to a loopback interface. The interface name has the format geslot/port.
Last-Resort Circuit Use the tunnel interface as the circuit of last resort
NAT Refresh Interval Set the interval between NAT refresh packets sent on a DTLS or TLS WAN transport connection.
Range: 1 through 60 seconds
Default: 5 seconds
Hello Interval Enter the interval between Hello packets sent on a DTLS or TLS WAN transport connection.
Range: 100 through 10000 milliseconds
Default: 1000 milliseconds (1 second)
Hello Tolerance

Enter the time to wait for a Hello packet on a DTLS or TLS WAN transport connection before declaring that transport tunnel to be down.

Range: 12 through 60 seconds
Default: 12 seconds

To save the feature template, click Save.

CLI equivalent:

vpn 0
  interface cellular0
    tunnel-interface
      allow-service service-name
      bind interface-name
      carrier carrier-name
color color
      encapsulation (gre | ipsec)
        preference number
        weight number
      exclude-controller-group-list number
      hello-interval milliseconds
      hello-tolerance seconds
      hold-time milliseconds
      low-bandwidth-link
      max-control-connections number
      last-resort-circuit
      nat-refresh-interval seconds
      vbond-as-stun-server (on vEdge routers only)
      vmanage-connection-preference number

Configure the Cellular Interface as a NAT Device

To configure a cellular interface to act as a NAT device for applications such as port forwarding, select the NAT tab, click On and configure the following parameters:

Parameter Name Description
NAT Click On to have the interface act as a NAT device.
Refresh Mode

Select how NAT mappings are refreshed, either outbound or bidirectional (outbound and inbound).
Default: Outbound

UDP Timeout

Specify when NAT translations over UDP sessions time out.
Range: 1 through 65536 minutes
Default: 1 minutes

TCP Timeout

Specify when NAT translations over TCP sessions time out.
Range: 1 through 65536 minutes
Default: 60 minutes (1 hour)

Block ICMP

Select On to block inbound ICMP error messages. By default, a vEdge router acting as a NAT device receives these error messages.
Default: Off

Respond to Ping Select On to have the vEdge router respond to ping requests to the NAT interface's IP address that are received from the public side of the connection.

To create a port forwarding rule, click Add New Port Forwarding Rule and configure the following parameters. You can define up to 128 port-forwarding rules to allow requests from an external network to reach devices on the internal network.

Parameter Name Description
Port Start Range

Enter a port number to define the port or first port in the range of interest.
Range: 0 through 65535

Port End Range Enter the same port number to apply port forwarding to a single port, or enter a larger number to apply it to a range of ports.
Range: 0 through 65535
Protocol Select the protocol to which to apply the port-forwarding rule, either TCP or UDP. To match the same ports for both TCP and UDP traffic, configure two rules.
VPN Specify the private VPN in which the internal server resides. This VPN is one of the VPN identifiers in the overlay network.
Range: 0 through 65530
Private IP Specify the IP address of the internal server to which to direct traffic that matches the port-forwarding rule.

To save a port forwarding rule, click Add.

To save the feature template, click Save.

CLI equivalent:

vpn 0
  interface cellular0
    nat
      block-icmp-error
      port-forward port-start port-number1 port-end port-number2
        proto (tcp | udp) private-ip-address ip address private-vpn vpn-id
      refresh (bi-directional | outbound)
      respond-to-ping
      tcp-timeout minutes
      udp-timeout minutes

Apply Access Lists

To configure a shaping rate to a cellular interface and to apply a QoS map, a rewrite rule, access lists, and policers to a router interface, select the ACL/QoS tab and configure the following parameters:

Parameter Name Description
Shaping rate

Configure the aggreate traffic transmission rate on the interface to be less than line rate, in kilobits per second (kbps).

QoS map Specify the name of the QoS map to apply to packets being transmitted out the interface.
Rewrite rule Click On, and specify the name of the rewrite rule to apply on the interface.
Ingress ACL – IPv4

Click On, and specify the name of an IPv4 access list to packets being received on the interface.

Egress ACL– IPv4 Click On, and specify the name of an IPv4 access list to packets being transmitted on the interface.
Ingress ACL – IPv6

Click On, and specify the name of an IPv6 access list to packets being received on the interface.

Egress ACL– IPv6 Click On, and specify the name of an IPv6 access list to packets being transmitted on the interface.
Ingress policer Click On, and specify the name of the policer to apply to packets being received on the interface.
Egress policer Click On, and specify the name of the policer to apply to packets being transmitted on the interface.

To save the feature template, click Save.

CLI equivalent:

vpn 0
  interface cellular0
    access-list acl-name (in | out)
    ipv6 access-list acl-name (in | out)
    policer policer-name (in |out)
    qos-map name
    rewrite-rule name
    shaping-rate name

Add ARP Table Entries

To configure static Address Resolution Protocol (ARP) table entries on the interface, select the ARP tab. Then click Add New ARP and configure the following parameters:

Parameter Name Description
IP Address Enter the IP address for the ARP entry in dotted decimal notation or as a fully qualified host name.
MAC Address Enter the MAC address in colon-separated hexadecimal notation.

To save the ARP configuration, click Add.

To save the feature template, click Save.

CLI equivalent:

vpn vpn-id
  interface irbnumber
    arp
      ip address ip-address mac mac-address

Configure Other Interface Properties

To configure other interface properties, select the Advanced tab and configure the following parameters.

Parameter Name Description
PMTU Discovery Click On to enable path MTU discovery on the interface, to allow the router to determine the largest MTU size supported without requiring packet fragmentation.
TCP MSS

Specify the maximum segment size (MSS) of TPC SYN packets passing through the vEdge router. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented.
Range: 552 to 1460 bytes
Default: None

Clear-Dont-Fragment Click On to clear the Don't Fragment (DF) bit in the IPv4 packet header for packets being transmitted out the interface. When the DF bit is cleared, packets larger than that interface's MTU are fragmented before being sent.
Static Ingress QoS Select a queue number to use for incoming traffic.
Range: 0 through 7
ARP Timeout Specify how long it takes for a dynamically learned ARP entry to time out.
Range: 0 through 2678400 seconds (744 hours)
Default: 1200 seconds (20 minutes)
Autonegotiate Click Off to turn off autonegotiation. By default, an interface runs in autonegotiation mode.
TLOC Extension

Enter the name of a physical interface on the same router that connects to the WAN transport. This configuration then binds this service-side interface to the WAN transport. A second vEdge router at the same site that itself has no direct connection to the WAN (generally because the site has only a single WAN connection) and that connects to this service-side interface is then provided with a connection to the WAN.

Tracker Enter the name of a tracker to track the status of transport interfaces that connect to the internet.

To save the feature template, click Save.

CLI equivalent:

vpn 0
  interface cellular0
    arp-timeout seconds
    [no] autonegotiate
    clear-dont-fragment
    mtu 1428    
    pmtu
    static-ingress-qos number
    tcp-mss-adjust bytes
    tloc-extension interface-name
    tracker tracker-name

Release Information

Introduced in vManage NMS in Release 16.1.
In Release 16.2, add circuit of last resort and its associated hold time.
In Release 16.3, add support for IPv6.
In Release 17.2.2, add support for tracker interface status.

  • Was this article helpful?