Skip to content
Megaport ONE Documentation
Connecting MVEs

Connecting MVEs Integrated with Fortinet Secure SD-WAN

This topic describes how to connect a Megaport Virtual Edge (MVE) integrated with Fortinet Secure SD-WAN to another MVE.

This deployment uses the Megaport private software defined network (SDN) to reduce reliance on the internet and connect enterprise branch locations.

Branch to branch

With two MVEs configured, you can create a private VXC to connect them on the Megaport network without the need for any physical infrastructure. A VXC is essentially a private point-to-point Ethernet connection between an A-End MVE and a B-End MVE.

Note

The internet-facing interface on an MVE can reach the internet-facing interface on another MVE over the public internet. That is, you can exchange traffic from MVE to MVE in different metros over the internet. The basic connection model consists of an MVE at one metro connecting via IP Transit to an MVE at another metro. Connectivity consists of a customer/SD-WAN partner managed connection, not Megaport managed.

Before you begin

Provision two MVEs in different locations. If you haven’t already created MVEs, see Creating an MVE in FortiManager.

Creating a VXC between two MVEs

A private VXC deployment between two MVEs integrated with Fortinet starts in the Megaport ONE Portal. To complete the configuration, you use the Fortinet FortiManager console.

To create a VXC

  1. In the Megaport ONE Portal, choose Networking > Services.
  2. Click the gear icon Gear icon next to the originating A-End Fortinet FortiGate MVE.
  3. Select Add Connection.

  4. Select Private VXC as the Connection Type. Private VXC

  5. Select the destination B-End MVE.
    Use the Country filter to narrow the selection.

  6. Specify the VXC Configuration details:

    • Connection Name – Specify a name for the VXC that is easily identifiable. For example, LA MVE 2 to Dallas MVE 4. You can change the name later, if you like.
    • Rate Limit (Mbps) – Specify a rate limit. The maximum speed is displayed. Although the rate limit for a VXC can be up to 10 Gbps, the compute capacity of the A-End or B-End MVE can influence the circuit throughput. Consult Fortinet’s documentation for details.
    • Preferred VLAN – Specify the 802.1q VLAN tag for this connection. Each VXC is delivered as a separate VLAN on the MVE. The VLAN ID must be unique on this MVE and can range from 2 to 4093. Megaport ONE will attempt to use the same VLAN ID at both MVE instances. If you specify a VLAN ID that is already in use, you will be notified when placing the MVE order.
      Private VXC details

  7. Specify the Billing Details:

    • Service Level Reference (optional) – Specify a unique identifying number for the VXC to be used for billing purposes, such as a cost center number or a unique customer ID. The service level reference number appears for each service under the Product section of the invoice. You can also edit this field for an existing service.
    • Monthly Price – The monthly rate is based on location and size.
    • Promo Code – If you have a promotional code, enter it and click Add Code.

  8. Click Create Connection to order the connection.

  9. Review the new connection details and pricing then click Confirm.

Once the VXC is deployed, you can view it in the Megaport ONE Portal Services page. The Services page displays the VXC under the A-End MVE and the B-End MVE. Note that the service ID number is the same for the VXC at both ends of the connection.

The next step is to configure the A-End and B-End MVEs in FortiManager.

Note

The next procedure configures IP connectivity with BGP, providing just one solution out of many. Consult your SD-WAN vendor documentation for specific network design and configuration options before configuring interfaces for the MVEs.

Configuring the A-End MVE in FortiManager

  1. Log in to your FortiManager Cloud instance at Fortinet Support.

  2. Choose Services > FortiManager.

  3. Select the A-End MVE.

  4. Go to the System menu and choose Interface.

  5. Click +Create New > Interface.

    A-End MVE in FortiManager

  6. Provide these details:

    • Interface Name – Enter a name for the interface, for example, VLAN2500.

    • Alias Name (optional) – Provide an alternate name, for example, MVE-2 to MVE-4.

    • Type – Select VLAN.

    • Interface – Select the parent interface: port1.

    • VLAN ID – Enter the Local VLAN.

    • Role – Select Undefined.

    • Addressing Mode – Select Manual.

    • IP/Netmask – Enter the local IP address and subject mask.

    • Administrative Access – Select how you want to access this interface, such as HTTPS, PING, and SSH.

    • DHCP Server – Choose OFF.

  7. Click OK.
    The new VLAN interface appears with your port1 physical interface.

You can run an execute ping command from FortiOS to verify the connection.

At this point, the interface is created. The next step is to optionally create the Border Gateway Protocol (BGP) session.

To configure a BGP neighbor

  1. In FortiManager, go to Router > BGP.

  2. Provide this information:

    • Local AS – Enter a unique, private autonomous system number (ASN).

    • Router ID – Enter an IP address in use on the system.

  3. In Neighbors, click +Create New.

    BGP neighbor in FortiManager

  4. Enter the neighbor IP address.

  5. Enter the Remote ASN.

  6. Click OK.

  7. Click Apply.

To push the configuration to the device

  1. Choose Managed Devices.
    The device Config Status is Modified.

  2. Select the device.

  3. Choose Install > Quick Install (Device DB).

  4. Click OK.

  5. Verify a successful installation and click Finish.

    Push config to device in FortiManager

Configuring the B-End MVE in FortiManager

  1. Log in to your FortiManager Cloud instance at Fortinet Support.

  2. Choose Services > FortiManager.

  3. Select the B-End MVE.

  4. Go to the System menu and choose Interface.

  5. Click +Create New > Interface.

    A-End MVE in FortiManager

  6. Provide these details:

    • Interface Name – Enter a name for the interface, for example, VLAN2500.

    • Alias Name (optional) – Provide an alternate name, for example, MVE-4 to MVE-2.

    • Type – Select VLAN.

    • Interface – Select the parent interface: port1.

    • VLAN ID – Enter the Local VLAN.

    • Role – Select Undefined.

    • Addressing Mode – Select Manual.

    • IP/Netmask – Enter the local IP address and subject mask.

    • Administrative Access – Select how you want to access this interface, such as HTTPS, PING, and SSH.

    • DHCP Server – Choose OFF.

  7. Click OK.
    The new VLAN interface appears with your port1 physical interface.

You can run an execute ping command from FortiOS to verify the connection.

At this point, the interface is created. The next step is to optionally create a BGP session.

To configure a BGP neighbor

  1. In FortiManager, go to Router > BGP.

  2. Provide this information:

    • Local AS – Enter a unique, private autonomous system number (ASN).

    • Router ID – Enter an IP address in use on the system.

  3. In Neighbors, click +Create New.

    BGP neighbor in FortiManager

  4. Enter the neighbor IP address.

  5. Enter the Remote AS.

  6. Click OK.

  7. Click Apply.

To push the configuration to the device

  1. Choose Managed Devices.
    The device Config Status is Modified.

  2. Select the device.

  3. Choose Install > Quick Install (Device DB).

  4. Click OK.

  5. Verify a successful installation and click Finish.

    Push config to device in FortiManager

Validating your connection

You can review connection details, including the connection state, from the CLI with these commands:

  • get system interface – Displays configuration details and current status for the device interfaces.
  • get router info bgp neighbor <ip-address> – Displays configuration details and current status for the BGP neighbors.
Last update: 2023-10-12