Configure DC Cluster Group
Objective
This guide provides instructions on how to add a site to a DC Cluster Group (DC-CG) using F5® Distributed Cloud Console (Console). A DC-CG represents a collection of sites that can directly communicate with each other using the underlay network.
DC-CG versus SMG
A DC-CG is used for cloud sites when the sites are connected over a private backbone. With legacy orchestrated CE deployments, you can use a DC-CG if your CE Site is using the Ingress/Egress Gateway (Two Interface) or App Stack Cluster (One Interface) options. With the new Secure Mesh Site v2 workflow, you can use a DC-CG for all your deployments.
A Site Mesh Group (SMG) is preferred for public cloud sites, while a DC-CG is preferred for physical K8s or F5® Distributed Cloud App Stack sites. An SMG uses IPsec tunnels and a DC-CG uses MPLSoUDP encapsulation. A DC-CG gives your CE deployments better performance, while an SMG is more secure.
Before you begin
Before you begin, ensure you have:
-
A Distributed Cloud Services account. If you do not have an account, see Getting Started with Console.
-
One or more Distributed Cloud Services sites deployed. For AWS/Azure/GCP sites, you must enable peering within the same public cloud prior to configuring the DC cluster group. For more information, see documentation:
- AWS VPC Peering: Create a VPC peering connection
- Azure VNet Peering: Tutorial: Connect virtual networks with virtual network peering using the Azure portal
- GCP VPC Network Peering: Use VPC Network Peering
Create DC Cluster Group
Create a DC cluster group without having to create or update an existing CE Site.
-
Navigate to Multi-Cloud Network Connect > Manage > Networking > DC Cluster Groups.
-
Select Add DC Cluster Group.
-
In the object configuration form:
-
Enter a name for the DC-CG.
-
Optionally, add a label and description.
-
From the Mesh Type menu, select an option:
- Data Plane Mesh: This option extends only the data plane across all participating sites in the DC-CG.
- Control and Data Plane Mesh: This option extends both the data plane and control plane across all participating sites in the DC-CG.
-
-
Select Add DC Cluster Group.
Configure DC Cluster Group
Add new CE sites or existing CE sites to a DC-CG.
-
For a new Secure Mesh Site v2:
- During the initial configuration, scroll to the Site To Site Connectivity section.
- From the Connect using SLO Local VRF menu, select Member of DC Cluster Group. From the Member of DC Cluster Group menu, select the DC-CG object created previously.
- To connect your Site to other sites using the SLI network, from the Connect using SLI Local VRF menu, select Member of DC Cluster Group. Then, select the DC-CG object created previously.
- Continue to configure your CE Site, and then select Add Secure Mesh Site.
- Perform the same steps for each CE Site you want to add to the DC-CG.
-
For an existing Secure Mesh Site v2:
- Navigate to the CE Site.
- Select ... under the Actions column, and then select Manage Configuration.
- In the configuration form, select Edit Configuration.
- Scroll to the Site To Site Connectivity section.
- From the Connect using SLO Local VRF menu, select Member of DC Cluster Group. From the Member of DC Cluster Group menu, select the DC-CG object created previously.
- To connect your Site to other sites using the SLI network, from the Connect using SLI Local VRF menu, select Member of DC Cluster Group. Then, select the DC-CG object created previously.
- Continue to configure your CE Site, and then select Save Secure Mesh Site.
- Perform the same steps for each CE Site you want to add to the DC-CG.
Verify health
Verify that the DC Cluster Group is operational and working as intended.
-
In the Multi-Cloud Network Connect workspace, select Manage > DC Cluster Groups.
-
Locate your DC Cluster Group and then select it.
-
In the side popout window, confirm health is good.
-
To verify connectivity, navigate to your CE Site dashboard and confirm connectivity in the Connectivity table.
References
For more information, see: