Prerequisites Before Deploying a Site
This topic helps you prepare a physical location before you create a Site in the Customer Portal. Deploying a Site assumes three layers of readiness on the OneOS6 router, also known as customer premises equipment (CPE) and on your network. Use this topic to check what must be in place, why it matters, and who is responsible: you, your Service Provider, or your Partner.
For the configuration sequence in the portal (Labels, Traffic Rules, Overlays, and Sites), see Get ready to deploy your network. After these prerequisites are met, continue with Create Sites and Assign Overlays.
Overview
Deploying a Site in SD-WAN assumes three layers of readiness:
Device readiness — factory or staging preconfiguration on the router itself.
Network readiness — WAN IP connectivity and outbound firewall rules so the device can reach the Director and the Controller.
Service readiness (VPN) — when the Site participates in a VPN Hub & Spoke overlay: IPsec rules on the WAN toward the hub (and additional rules if this Site is the hub).
Mandatory and optional readiness
Device readiness and network readiness are mandatory for every Site. Service readiness is additional: it is required for spoke Sites in a VPN Hub & Spoke overlay, and for hub Sites when Hub type: Site. It is not required for the Site to register with the Director .
Layer | What to confirm |
|---|---|
Device readiness | The router was staged before delivery; Call-Home can authenticate to the Director . |
Network readiness | The WAN has IP connectivity (route, DNS, time sync); outbound management traffic to the Director (and later the Controller) is allowed. |
Service readiness (VPN) | If you use VPN Hub & Spoke: IPsec is allowed between spoke and hub (Site or Gateway); if Hub type: Site, hub-side rules are also in place. |
Layers 1 + 2 → the device can register in the Director and the Site can come Up.
Layer 3 (when applicable) → the VPN overlay can come up.
Value | Meaning |
|---|---|
Outbound | The Site router initiates traffic toward the Director, the Controller, a File Server, DNS, NTP, or another peer. Allow on the customer firewall as egress from the router WAN. |
Inbound | A remote system connects to the Site router (the router is listening). Allow as ingress on the router WAN. |
Bidirectional | Both sites send and receive on the same port (typical for IPsec). Allow in both directions between peer WAN addresses. |
What it is
Device readiness means the router already has the factory or staging preconfiguration (golden image) required to bootstrap and open Call-Home to the Director.
Call-Home is the primary management channel between the router and the Director. The session is always initiated by the router (outbound). The Director does not need an inbound management port through your firewall. Once Call-Home is up, the Director can push configuration, schedule software upgrades, and collect monitoring data.
On SASE Box hardware (SB600, SB2500, SB3500), two front-panel LEDs can help you check bootstrap health without logging in:
LED | Solid green | Waiting / red |
|---|---|---|
Director | Active Call-Home session to the Director | No Director session (slow blink) |
Internet | DNS resolution works on the WAN | DNS not available |
Why it matters
Without device readiness, Call-Home authentication fails. The router cannot register in the Director, even if the WAN and firewall are correctly set up. Call-Home is required for zero-touch operation from the portal.
What happens if it is not ready
The CPE cannot establish Call-Home.
The device will not register in the Director .
In the portal, device status remains Down or Update Pending; configuration is not applied.
Who is accountable?
Who | Responsibility |
|---|---|
Ekinops or your Partner | Factory / staging preconfiguration, Call-Home baseline, and related device preparation. |
Your Partner / Service Provider | Register the router in the Director, assign it to your tenant, associate the hardware model, and allocate a Controller. |
You (Customer) | Confirm the device appears as available when you create a Site; on SASE Box, you can use the LEDs above as a local check. You do not perform staging in the Customer Portal. |
Available devices
Available devices are routers assigned to your Customer account by your Partner and not yet used by another Site. If no serial number appears in the list, contact your Partner.
What it is
Network readiness means the router has IP connectivity on at least one WAN link, including an address, a default route, DNS as needed, and a valid clock for time synchronization, and that outbound firewall rules allow management traffic from the router to the Director and, after the Site is created, to the Controller.
External firewall (upstream of the router)
The outbound rules in this section apply to a firewall or filter outside the SD-WAN router, not to the Site firewall you configure in the Customer Portal. Typical cases: a firewall between the router WAN and the internet access device, or filtering in the ISP / broadband box that provides WAN access to the router.
All management flows are initiated by the router. Before you create the Site in the portal, allow this egress traffic on the firewall or ISP router upstream of the SD-WAN router. No inbound rule toward the router is required for Director orchestration.
For new Sites, use the recommended secure Call-Home path: TCP 2201 (mutual TLS). SASE Box devices use this by default from factory staging.
WAN IP settings are prepared in staging by the Service Provider or Partner. For SASE Box, the WAN interface is typically in DHCP client mode, waiting for an IP address, default route, and DNS. Public SNTP servers are pre-configured so the clock is valid for mTLS.
Typical SASE Box deployment
WAN access is often provided through an external broadband or ISP router. In that case, outbound rules on that upstream device (or on your firewall) must allow management traffic from the SD-WAN router.
Ask your Partner for the Director and Controller destinations (FQDN or IP) to allow on your firewall.
Why it matters
The Director and the Controller must be reachable over the WAN for orchestration, monitoring, time services, and related control-plane functions. Network readiness keeps Call-Home up and allows the Site to operate as Up in the portal.
What happens if it is not ready?
Call-Home fails or stays down.
The Site will not appear as Up in the portal.
Configuration is not pushed; monitoring and upgrades are impaired.
Who is accountable?
Who | Responsibility |
|---|---|
Your Partner / Service Provider | Provide the platform destinations to allow; enable and configure Controller-side management flows for your tenant as required |
Partner (staging) | Initial WAN-oriented staging (for example DHCP client and SNTP on SASE Box) before delivery |
You (Customer) | Ensure WAN connectivity at the site and allow the required outbound management traffic on firewalls or upstream routers you control |
Destination | Ports | Direction |
|---|---|---|
Director | TCP 2201 | Outbound (Site → Director Call-Home) |
DNS | UDP 53 | Outbound (Site → DNS) |
NTP | UDP 123 | Outbound (Site → NTP) |
After the Site is created and the router is bound to a Controller, also allow outbound traffic to the Controller for SD-WAN control-plane and monitoring functions (for example secure logging and analytics, DNS load-balancing, WAN path monitoring, and software or application-dictionary updates).
For SASE Box deployments (and other new Sites using Management Flow mTLS, recommended and default on SASE Box), allow at least the following:
Protocol | Port | Service | Traffic direction |
|---|---|---|---|
UDP | 123 | NTP — SD-WAN time reference from Controller | Outbound (Site → Controller) |
UDP | 53 | DNS — SD-WAN load-balancer (LBDNS) | |
TCP | 6514 | Secure Syslog (mTLS) | |
TCP | 4740 | Secure NetFlow (mTLS) |
Protocol | Port | Service | Traffic direction |
|---|---|---|---|
ICMP | — | Link Quality Measurement (echo probes; replies return on the same flow) | Outbound (Site → Controller) |
TCP | 80 | WAN Path Monitoring (HTTP health checks) | |
TCP | 8085 | Controller File Server (HTTPS): Downloading files hosted on the Controller's software repository | Outbound (Site → Controller File Server) |
Your Partner confirms the Controller (and File Server) destinations (FQDN or IP) for your deployment. Ask your Partner if additional HTTP/HTTPS access to a Service Provider File Server (TCP 80 or 443) is required for OneOS6 software repository updates.
ICMP note
Allow outbound ICMP from the SD-WAN router toward the probe destination (typically your Controller). If a stateful firewall sits upstream, ensure echo replies can return to the router.
Protocol | Port | Service | Traffic direction |
|---|---|---|---|
TCP | 8085 | Controller : download of SaaS application dictionary updates from Controller | Outbound (Site → Controller) |
TCP | 80 or 443 | File Server : download of OneOS Software Repository updates from your Service Provider platform. IP address and TCP port may vary depending on File Server but this is HTTP or HTTPS protocol | Outbound (Site → Service Provider File Server) |
Warning
This layer applies only when the Site is attached to a VPN Hub & Spoke overlay.
What it is
Service readiness means the firewall (or upstream device) on the Site WAN allows IPsec traffic needed for the encrypted VPN overlay, in addition to the management flows in network readiness.
Site role | Hub type | What you must allow |
|---|---|---|
Spoke | Site, Gateway, or Gateway cluster | IPsec between the spoke WAN and the hub (hub Site public IP, or Gateway public IP provided by your Partner). |
Hub | Site | The same IPsec ports toward spokes, plus hub monitoring from the Controller. |
Hub | Gateway or Gateway cluster | The hub is not on your premises; your Partner manages the Gateway. |
Why it matters
VPN Hub & Spoke carries private overlay traffic between sites (or between sites and a Partner Gateway). Management readiness alone does not establish those tunnels.
What happens if it is not ready
The Site may still be Up in the portal.
VPN tunnels do not come up.
Private overlay traffic fails (spoke cannot reach the hub Site or Gateway, or the hub Site cannot reach spokes).
Who is accountable?
Who | Responsibility |
|---|---|
Your Partner | Manage Gateway or Gateway cluster hubs; provide Gateway public addressing when the hub is not a Site at your premises. Confirm which VPN setup options apply to your overlay. |
You (Customer) | On Sites at your premises (spoke, or hub when Hub type: Site), allow the required IPsec traffic on the WAN path you control. Obtain the hub or Gateway peer address from your design or your Partner. |
In addition to management traffic, allow the following on the spoke Site WAN — or on upstream firewalls in front of the WAN link:
Protocol | Port | Service | Traffic direction | Peer |
|---|---|---|---|---|
UDP | 500 | VPN setup and key exchange (IKEv2) | Bidirectional | Spoke Site ↔ Hub (Site or Gateway), when the VPN protocol is IKEv2 |
TCP | 1728 | VPN setup and key exchange (TINA) | Outbound → Controller | Spoke or Hub Site → Controller, when the VPN protocol is TINA |
UDP | 4500 | VPN data (IPsec over NAT-T) | Bidirectional | Spoke Site ↔ Hub (Site or Gateway) |
The IPsec ports are the same whether the hub is a Site at your premises or a Gateway managed by your Partner; only the peer WAN address differs. Obtain the hub Site public IP or the Gateway public IP from your design or your Partner.
When Hub type: Site, the hub must allow the same IPsec ports inbound from spokes and outbound toward spokes. In addition, the hub is monitored by the Controller:
Protocol | Port | Service | Traffic direction | Between |
|---|---|---|---|---|
UDP | 500 | VPN Hub Monitoring (IKEv2 SA INIT) | Inbound | Controller → Hub (Site or Gateway) |
The port is the same as for VPN setup and key exchange (IKEv2); only the source IP of the incoming flow to the hub differs.
Next steps
When device readiness and network readiness are in place, and service readiness if you use VPN Hub & Spoke:
Complete the portal design sequence if needed: Labels → Traffic Rules → Overlays → Sites (see Get ready to deploy your network).
Create the Site, assign the device, configure LAN/WAN interfaces, and assign overlays (see Create Sites and Assign Overlays).
For WAN and LAN design patterns (see Topologies in the Configuration Guide section).