Integrating Routers with the Nile Access Service

When deploying the Nile Access Service, the integration between the Nile Service Block (NSB) and the customer's upstream routers or firewalls is a critical step. This article provides guidance on how to configure the router integration to ensure a successful Nile Access Service deployment.

All Nile access and distribution switches provide several high-speed uplink ports to connect to the customer's upstream routers or firewalls. Nile recommends connecting, via the high-speed uplink ports, each of the NSB Gateways to the customer's upstream routers or firewalls.

The uplink speeds supported by the Nile Service Blocks range from 1Gbps to 100Gbps, with the choice of Ethernet or fiber optic ports depending on the required throughput and the customer's existing infrastructure.

Since the Nile Access Service operates at Layer 3, there is no Layer 2 VLAN trunking between the NSB and the customer's upstream routers. All traffic is routed between the Nile Service Block and the customer's upstream devices.

In the next section, we can see examples of OSPF and ECMP being used to route traffic across the transit networks that connect the NSB to the customer's firewall and routing infrastructure. The diagram below shows the topology used in the examples.

The Nile Service Block (NSB) requires an upstream router or firewall for connectivity to the Nile Cloud. The NSB gateway, an access or distribution switch, serves as the connection point between the NSB and the upstream network device.

NSB gateways operate in an active-active configuration and act as the default gateway for all Nile Elements (access switches, access points, and sensors). Traffic is routed to the upstream router or firewall using either OSPF or static routes, with OSPF being the preferred method.

When OSPF is used, no configuration is necessary on the NSB gateways. The upstream firewall or router's configuration is sufficient for the NSB gateways to automatically learn routing parameters from Hello messages. If OSPF is not configured, the NSB gateway automatically employs static routes with Equal Cost Multi-Path (ECMP) for traffic forwarding.

Example OSPF Configuration



Example ECMP Configuration

Regardless of the routing protocol used, the key is to ensure that the routes to the client subnets behind the Nile Service Block are reachable from the customer's upstream devices. Nile will be the default gateway for all client subnets and these default gateways must be accessible from the upstream routers or firewalls.

To activate the entire network of access switches, access points, and sensors, the NSB gateway requires the following parameters:

These settings are transmitted to the NSB gateway via Bluetooth.

To allow all Nile Service Block elements to communicate with the necessary cloud services, any firewalls or router ACLs in the traffic path should be configured with the following rules:

By following these specific firewall configuration guidelines, you can ensure that the Nile Service Block elements can communicate with the required cloud services and authentication servers.