diff --git a/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx b/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx index eca396d927..8c5aa2c4b1 100644 --- a/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx +++ b/website/content/docs/connect/gateways/mesh-gateway/wan-federation-via-mesh-gateways.mdx @@ -20,6 +20,8 @@ Consul cluster, operators must ensure that all Consul servers in every datacenter must be directly connectable over their WAN-advertised network address from each other. +[![WAN federation without mesh gateways](/img/wan-federation-connectivity-traditional.png)](/img/wan-federation-connectivity-traditional.png) + This requires that operators setting up the virtual machines or containers hosting the servers take additional steps to ensure the necessary routing and firewall rules are in place to allow the servers to speak to each other over @@ -38,7 +40,7 @@ Operators looking to simplify their WAN deployment and minimize the exposed security surface area can elect to join these datacenters together using [mesh gateways](/docs/connect/gateways/mesh-gateway) to do so. -![Mesh Gateway Architecture](/img/mesh-gateways.png) +[![WAN federation with mesh gateways](/img/wan-federation-connectivity-mesh-gateways.png)](/img/wan-federation-connectivity-mesh-gateways.png) ## Architecture diff --git a/website/public/img/wan-federation-connectivity-mesh-gateways.png b/website/public/img/wan-federation-connectivity-mesh-gateways.png new file mode 100755 index 0000000000..c88dad28cc Binary files /dev/null and b/website/public/img/wan-federation-connectivity-mesh-gateways.png differ diff --git a/website/public/img/wan-federation-connectivity-mesh-gateways.svg b/website/public/img/wan-federation-connectivity-mesh-gateways.svg new file mode 100755 index 0000000000..8d4599f7ff --- /dev/null +++ b/website/public/img/wan-federation-connectivity-mesh-gateways.svg @@ -0,0 +1,2371 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + DC1 + + + + + | ON PREMISES + + + + DC2 + + + + + | CLOUD US-EAST-1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + + + + + + + + + + + + + + 8300/tcp + Remote listener-wan-address=ip:port + Local listener-address=ip:port + + + + + + + + PRIMARY + SECONDARY + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + + 8443/tcp + + + + + + + + + + + + + + + + + + 8443/tcp + + + + + With Mesh Gateways + CROSS-DC CONTROL PLANE COMMUNICATION (WAN FEDERATION) + + + consul connect envoy \ -gateway=mesh -register \ -service "dc1-mesh-gw" \ -address "ip1:8443" \ -wan-address "ip2:8443" \ -token=<used by gateway> + $ + + 8300/tcp + 8300/tcp + + + DC2 + DC1 + + Server RPC & Cross-DC WAN Gossip + ####/tcp + Intra-DC WAN Gossip + when using mesh gateways, cross-DC WAN gossipexclusively uses TCP over the server RPC port (8300) + Direct Primary GW Connection + unidirectional connection from all Consul server agentsin secondary DCs to the mesh gateway of the primary DC(see "primary_gateways" agent config option); necessaryfor infrequent internal operations (e.g., bootstrapping) + GW Local Listener + see "-address" config optionwhen launching gateway + EXAMPLE GATEWAY CONFIG + ####/tcp + GW Remote Listener + see "-wan-address" config optionwhen launching gateway + 8302/tcp + 8302/udp + not shown: the Consul client agent deployedwith each gateway to manage its configuration + + + + + + + + + + + + + + + Mesh Gateway + + + paths through gateways can differ forDC1 DC2 versus DC2 DC1 because agateway's local listener (for internal traffic) typicallydiffers from its remote listener (for external traffic) + + + + + + Control Plane + + + + + + + LEADER + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Consul Server Agent + System Components + Communication Paths + Ports + Requires server agent configuration: connect.enable_mesh_gateway_wan_federation=true + Not shown: Consul client agents and their LAN Serf Gossip traffic on ports 8301/{udp,tcp} are not shown because they are not involved in cross-DC communication. + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + diff --git a/website/public/img/wan-federation-connectivity-traditional.png b/website/public/img/wan-federation-connectivity-traditional.png new file mode 100755 index 0000000000..ae58cc4709 Binary files /dev/null and b/website/public/img/wan-federation-connectivity-traditional.png differ diff --git a/website/public/img/wan-federation-connectivity-traditional.svg b/website/public/img/wan-federation-connectivity-traditional.svg new file mode 100755 index 0000000000..0a8f64c9b7 --- /dev/null +++ b/website/public/img/wan-federation-connectivity-traditional.svg @@ -0,0 +1,1539 @@ + + + + + + + + + + + DC1 + + + + + | ON PREMISES + + + + DC2 + + + + + | CLOUD US-EAST-1 + + PRIMARY + SECONDARY + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + LEADER + + + + + + + + + + + + + + + + + 8300/tcp + 8302/tcp + 8302/udp + + Standard: Without Mesh Gateways + CROSS-DC CONTROL PLANE COMMUNICATION (WAN FEDERATION) + + 8302/tcp + 8302/udp + + 8300/tcp + Server RPC + WAN Serf Gossip + all servers are connected in the WAN gossip pool + Control Plane + + + + + + LEADER + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Consul Server Agent + System Components + Communication Paths + Ports + gossip occurs primarily via UDP,TCP is only used as a fallback + + + + Not shown: Consul client agents and their LAN Serf Gossip traffic on ports 8301/{udp,tcp} are not shown because they are not involved in cross-DC communication. + +