Course contents

Unit 8: High availabilityLesson 8.7 (3 of 4 in this unit)20 of 25 in the Advanced Cisco SD-WAN course

Last-resort circuit

A transport that carries tunnels only when the others are gone: how it works, what it costs and saves, and how to test the switchover.

Advanced · 10 min read

You'll learn to explain when a last-resort circuit brings its tunnels up, estimate what the switchover costs in time and traffic, and plan a safe test.

Technical definition

Last-resort circuit is a transport interface in Cisco Catalyst SD-WAN that stays up but does not carry tunnels while the router's other transports are healthy. It brings its tunnels up only when the other tunnel interfaces are gone, which makes it a good fit for a cellular link that costs money per megabyte or is slow.

A backup link that stays quiet until needed

BR-02 (site 102) has one internet link. A cellular modem gives it a second way out for the day the cable breaks, but the data plan is metered and the radio link is slower than the wired one. Making the cellular transport a normal tunnel interface would bring its tunnels up next to the main one: BFD probes and control traffic would flow all the time, and traffic could be sent over it whenever a policy or a path comparison allowed. A last-resort circuit avoids that. The interface is up and ready, but it does not carry tunnels while another transport is working.

What the router does, in order

  1. Normal state: the internet tunnel interface is up and carries the tunnels and the control connection. The cellular interface, marked as a last-resort circuit, has no tunnels.
  2. The internet link fails. BFD sessions on it stop receiving replies and are declared down.
  3. With no other tunnel interface left, the router brings up tunnels on the last-resort circuit, and the control connection to the SD-WAN Controller (formerly vSmart) and Manager moves with it if it was lost.
  4. The remote sites learn of the new TLOC through OMP and BFD comes up on the new tunnels.
  5. Traffic flows over the cellular link.
  6. The internet link returns. The router sees the normal transport is healthy again and the last-resort tunnels are torn down. Traffic returns to the main link.

The exact conditions that trigger and release the circuit, and how the router decides that the other transports are gone, can differ by release. Check your release's guide before relying on a particular trigger.

A last-resort circuit that stays quiet until needed
A last-resort circuit that stays quiet until neededBR-02 normally carries its tunnels over the internet circuit. The cellular interface, marked as last resort, has no tunnels. When the internet link fails, BFD declares the tunnels down, and with no other transport left, BR-02 brings up tunnels on the cellular link. Remote sites learn the new path over OMP. When the internet returns, the last-resort tunnels come down and traffic goes back.BR-0210.255.2.2Internet circuitCellular, last resortHUB-0110.255.1.1normal pathused only on failure

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Plan on seconds to tens of seconds for the switch, measured in your own lab. All of the site's traffic moves onto the radio link at once, so check its capacity.

What the switchover costs

What the switchover costs
What the switchover costsPhase; What happens; Time to plan for. Detection: BFD declares the main tunnels down Set by the BFD timers on the main transport Bring-up: Tunnels and control connection start on the cellular link Seconds, plus the time the radio link needs to carry traffic Route update: OMP advertises the new TLOC and remote sites resolve it Short once the control connection is upPhaseWhat happensTime to plan forDetectionBFD declares the main tunnels downSet by the BFD timers on the maintransportBring-upTunnels and control connection starton the cellular linkSeconds, plus the time the radio linkneeds to carry trafficRoute updateOMP advertises the new TLOC andremote sites resolve itShort once the control connection isup

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Together this is typically seconds to tens of seconds. It is not a promise. It depends on the BFD timers, the radio conditions and the carrier, so measure it in your own lab and keep the result. A design that needs a sub-second failover needs a second wired transport, not a last-resort circuit.

Cautions before relying on it

  • All traffic moves at once. When the circuit activates, the whole site's traffic goes onto the cellular link. A 20 Mbit/s radio link carrying a branch that normally uses 200 Mbit/s will be saturated. Size for it, or limit what may use it. The single-application scenario looks at that.
  • The far side must be reachable. The hubs and Controllers must be reachable from the cellular carrier's network, and the hubs need a transport that the cellular tunnels can connect to, on a matching colour where the design requires one.
  • The link must be monitored. A backup that is down when needed is found out too late. An idle circuit still needs a check for signal, SIM state and plan.
  • Fail-back needs a test. Do not assume the tunnels return to the main link cleanly. Test what happens to open sessions when they do.

The configuration idea

On IOS XE SD-WAN the circuit is an option on the tunnel interface. The fragment below shows the idea for a cellular interface in colour lte. Confirm the exact syntax in your release's configuration guide. In practice it is set in the SD-WAN Manager template, not typed by hand.

sdwan interface Cellular0/2/0 tunnel-interface encapsulation ipsec color lte last-resort-circuit no allow-service all exit exit exit

Fragment written for this lesson; confirm the syntax in your release's guide. The interface name is an example. The sdwan interface block makes the cellular port part of the overlay. tunnel-interface turns it into a transport. encapsulation ipsec sets the tunnel type. color lte names the transport, and the colour is an example. last-resort-circuit is what keeps the tunnels down while another interface works. The allow-service line closes management services on the radio link; it is a design choice, not a requirement of the feature.

A switchover test for a lab or maintenance window

Run it in a lab or a planned window, with a person at the site or a way to restore the link remotely. Keep a continuous ping from BR-02 to an application address in the data centre, for example in 10.20.1.0/24, from the beginning.

  1. Record the baseline: control connections, BFD sessions and OMP routes on BR-02, showing tunnels on the main transport only.
  2. Disconnect the main internet link (shut the interface or pull the cable). Note the time.
  3. Note when the ping stops and when it resumes. The gap is the measured switchover time.
  4. Record the same outputs on the cellular link: tunnels on lte, control connection state, and the throughput that the link gives.
  5. Restore the main link. Note when the cellular tunnels go away and whether the ping drops again.
  6. Record the carrier data used during the test, so the cost of a real event can be estimated.

What to record: the three times (failure, resume, fail-back), the throughput on the cellular link, the data used, the software release, and any session that broke. Repeat the test when the release, the carrier plan or the BFD timers change.

Test yourself on last-resort circuits

Predict · scenario 1

BR-02 has a wired internet link and a cellular link set as a last-resort circuit. Both are physically up and the wired link is healthy. Where do the tunnels run?

Predict · scenario 2

A branch needs a failover that is almost unnoticeable for voice. Is a last-resort cellular circuit enough?

Predict · scenario 3

During a test, the cellular circuit activates but the application is slow and a monitoring tool shows the link at 100% utilisation. What was most likely missed in the design?

Predict · scenario 4

After the wired link is restored, the cellular tunnels are still up an hour later. What should you check?

FAQ

Why not just keep the cellular tunnels up all the time at low priority?
Because an up tunnel costs traffic. BFD probes run every few seconds, control traffic flows, and a policy or a misjudged path preference can send real traffic over it. On a metered link that adds up. A last-resort circuit keeps the tunnels down until they are needed.
How fast is the switchover?
Not instant. The router first has to notice that the other transports have failed, which BFD does. Then it brings up the tunnels and the control connection on the last-resort circuit. Expect seconds to tens of seconds. Treat that as a design figure to measure in your own lab, not as a promise.
Does a last-resort circuit have to be cellular?
No. It is a setting on a tunnel interface, so any transport can use it. Cellular is the usual case because it is the one that is metered, slower or less stable. Check the platforms and interface types your release supports.