Virtual Edge Groups

Introduction

Cloud Control Center version 16.1.0 brings a new feature for the management of Policy Infrastructure, Virtual Edge Groups. Virtual Edge (VE) Groups are an innovative feature designed to enhance the efficiency, reliability, and simplicity of managing Virtual Edges in enterprise environments. By organizing VEs into groups managed as a single unit, VE Groups offer significant benefits in manageability and redundancy in the event of a Virtual Edge outage.

Overview of Virtual Edge Groups

Some important concepts regarding Virtual Edge Groups are listed below. Each of these concepts are explained in more detail in this document.

• Virtual Edge Groups are used to assign Site Labels and Distribution Zones to groups of VEs and VENs.
• Virtual Edge Groups effectively provide redundancy in the event of a Virtual Edge outage.
• Virtual Edge Nodes will inherit the Site Label and Distribution Zone of their Virtual Edge Group instead a specific Virtual Edge, unless the VEN is assigned to a standalone-VE or manually configured with different Site Labels and/or Distribution Zones.
• Virtual Edge Nodes can be easily moved to a different VE Group using the "Change Group" function.
• Virtual Edges need to be deleted from Cloud Control Center and onboarded to a different VE Group to change groups.
• All Virtual Edges in a group must have connectivity to all Virtual Edge Nodes assigned to the group.

Key Benefits of Virtual Edge Groups

Enhanced Reliability and High Availability

• Seamless Failover: Virtual Edge Nodes (VENs) are now assigned to VE Groups. In the event of a VE failure or a loss of connection to Cloud Control Center (CCC), the management of VENs is automatically transferred to another VE within the group. This ensures uninterrupted policy enforcement, system updates and analytics, maintaining network reliability without any manual intervention. 

Simplified VE Management

• Centralized Configuration: VE Groups allow for centralized management by enabling administrators to assign Site Labels and Distribution Zone tags to the entire group instead of individual VEs. This reduces the likelihood of misconfiguration and simplifies the process, especially in large-scale environments with numerous VEs.
• Consistent Policy Application: By managing VEs as a group, organizations can ensure that all VEs within a group adhere to the same configuration settings. This minimizes the risk of misconfiguration between Virtual Edges that can result in inconsistent policy application within a site.

Deployment Options

• Standalone VEs: VE Groups are fully supported for VE 16.x hypervisor-hosted deployments. However, for VE 15.x deployments or scenarios requiring standalone VEs, such as 1:1 switch-hosted virtual edges, the original standalone model is still available, offering flexibility based on specific network needs.
• Virtual Edge Node Deployment: Virtual Edge Nodes can be assigned to VE Groups or Standalone VEs during deployment with a single click. After onboarding, VENs can easily be transferred between VE Groups or Standalone VEs. 

Creating Virtual Edge Groups

When adding new Virtual Edges or Virtual Edge Nodes in Cloud Control Center, they can now be onboarded directly to Virtual Edge Groups. This allows for easy onboarding and management of VEs, ensuring they benefit from the group’s configuration and failover capabilities.

To create a Virtual Edge Group, go to Virtual Edges in Cloud Control Center and click + CREATE GROUP in the VE Groups section.

Virtual Edge Groups are assigned Site Labels and Distribution Zones during creation that can be modified at any time. Give your VE Group a logical name, and optionally a description. These attributes are core to the functionality of Virtual Edge Groups, as all VEs and VENs (by default) inherit Site Labels and Distribution Zones from the VE Group for consistent policy enforcement. Click Create to finish creating the VE Group.

As a reminder, Site Labels and Distribution Zones are core components of Policy Distribution and should be well understood by Administrators prior to creating and configuring your Virtual Edge Groups. See our in-depth guides on these topics below.
Distribution Zones

Policy Sets and Site Labels

Assigning a Distribution Zone During VE Group Creation or Edit

When creating or editing a Virtual Edge Group, you must assign a Distribution Zone to control identity tag distribution and policy enforcement across all associated Virtual Edges and Virtual Edge Nodes.

After selecting a Site Label, the Distribution Zone field becomes available. You can either select an existing Distribution Zone tied to the selected Site Label, or click + Create Distribution Zone to define a new one inline.

First, select a Distribution Zone Type - as this selection will determine the configuration options available.

Options for Access Type Distribution Zones

Options for Core Type Distribution Zones

Once created, the new Distribution Zone is automatically selected and associated with the group.

You can also assign or create a Distribution Zone during VE Group editing. Clicking the Edit icon on any existing VE Group opens the same panel. The Distribution Zone field behaves identically — allowing you to assign a new zone or create one inline.

Any changes to the Distribution Zone are applied upon saving, and all Virtual Edges and Virtual Edge Nodes in the group will inherit the updated Distribution Zone unless overridden individually at the node level.

Note: For details on Distribution Zones, the various types and how they function, and how best to utilize them, see the Distribution Zones article.

Adding Virtual Edges to a VE Group

Once a VE Group has been created, new Virtual Edges can be onboarded to the VE Group. To onboard a new VE to a VE Group, select the appropriate VE Group in the left menu pane and click +Add Virtual Edge.

After clicking + ADD VIRTUAL EDGE the Virtual Edge deployment pane will appear, with the appropriate options pre-selected. In this case, we elected to add a Virtual Edge to IND-VE-GROUP-2, so we can see that VE 16.0+ (hypervisor-hosted) has been selected for us in the Virtual Edge Type category, along with the appropriate VE Group in the Virtual Edge Configurations section. Virtual Edge Type and Group can be easily changed during the deployment process, simplifying the deployment workflow if you attempted to add a VE to the wrong Group, for example.

After filling out the required fields, click ADD to begin deploying the new Virtual Edge.

Different types of Virtual Edges (switch-hosted vs. hypervisor-hosted) have different configuration fields that need to be populated. Due to this, the Virtual Edge Configuration section will change depending on the type of Virtual Edge selected initially. Be sure to select the correct Virtual Edge type before filling out the required configurations.

For more information on possible deployment models or for more information on deploying Virtual Edges, please see these articles.
Virtual Edge and Virtual Edge Node Design Guide

Virtual Edge Deployment Guide (Virtual Edge 16.0+) Switch Hosted

Virtual Edge Deployment Guide (Virtual Edge 16.0+) Hypervisor Hosted

Onboarding Virtual Edge Nodes to a VE Group

When deploying new Virtual Edge Nodes, you can select standalone Virtual Edges or VE Groups to manage the Nodes you are onboarding. Click + Add Virtual Edge Node as normal.

After clicking either the single or multiple Add Virtual Edge Node option, a selection pane will appear with options for selecting a VE Group, Standalone VE, Switch-hosted VE, or Cloud-hosted VE (ie. Juniper VE) for managing the VEN or VENs that you are attempting to deploy. Note that Standalone Virtual Edges are not currently supported when onboarding multiple VENs.

After selecting your VE or VE Group and clicking save, you can finish filling out the required fields for deploying your VEN. For more information on this process, see relevant articles linked below.

Onboarding Catalyst 9000/3850/3650 as a Virtual Edge Node

Bulk Onboarding Virtual Edges and Virtual Edge Nodes

Reassigning Virtual Edges and Virtual Edge Nodes to New VE Groups

Virtual Edges

Deletion and Reassignment Process: If there is a need to move a VE to a different group, the VE must be deleted from Cloud Control Center and redeployed in the new group. This process ensures that the VE is properly integrated into the new group with the appropriate configurations and settings. Reassignment of Virtual Edges to new VE Groups will be enhanced in a future release to eliminate the need to delete VEs during the group migration process.

Virtual Edge Nodes

Reassigning Virtual Edge Nodes to new VE Groups can be accomplished by selecting the actions button to the right of a Virtual Edge Node and selecting Change Group. 

After clicking Change Group, You can select a different VE group to manage the selected VEN. Click save to move the VEN to a different group.

As a reminder, Site Label and Distribution Zone can be configured independently of the parent Virtual Edge or VE Group. To make configuration changes to these attributes on a VEN, simply edit the VEN and check the Assign Manually button, where you can then create or assign Site Labels and Distribution Zones for the selected VEN. The VEN will no longer inherit these attributes from the parent VE or VE Group.

Changing the Active Virtual Edge Within a Group

In addition to moving a Virtual Edge Node to a different group, you can reassign a VEN to a specific Virtual Edge within its current group. The Change Active Virtual Edge action lets you direct which Virtual Edge in the group actively manages a given VEN — useful for targeted troubleshooting (for example, testing a specific VE-to-VEN path), maintenance (moving VENs away from a Virtual Edge you intend to service), or load management — all without triggering a full group rebalance.

To change the Active Virtual Edge for a VEN, open the Virtual Edge Details page for any Virtual Edge in the group, locate the Virtual Edge Node in the VEN table, and select Change Active Virtual Edge from the VEN's actions menu.

The Change Active Virtual Edge dialog lists only the Virtual Edges that are currently Online and belong to the same VE Group, sorted alphabetically. The VEN's current Active Virtual Edge is excluded from the list, as are any Virtual Edges that are offline, not yet registered, or in maintenance. Select the Virtual Edge you want to manage the VEN, then click Save. The VEN's Active Virtual Edge is updated immediately and reflected in the UI.

The Change Active Virtual Edge action is disabled, with an explanatory tooltip, when it cannot be performed:

• No other Online Virtual Edges are available in the group — "No other Online Virtual Edges are available in this group."
• A rebalance is already in progress on the group — "Virtual Edge Node Reassignment is in progress."
• The Virtual Edge Node is being decommissioned — "Virtual Edge Node decommission is in progress."

If the Virtual Edge you selected goes offline between the time the dialog is opened and the time you click Save, the operation is rejected with the message "Selected Virtual Edge is not in Online status." Reopen the dialog and choose an Online Virtual Edge.

Virtual Edge Group Rebalancing

Within a Virtual Edge Group, multiple Virtual Edges (VEs) collaborate to manage a shared set of Virtual Edge Nodes (VENs). Each VEN is associated with one Active Client VE, which is responsible for its management, and one or more Candidate Client VEs, which can assume active management if the current Active VE becomes unavailable.

Under normal conditions, VENs are distributed evenly across all VEs in the group to maintain a balanced number of Active Client VENs per VE. This even distribution helps ensure optimal resource utilization and high availability across the group.

If the number of Active Client VENs becomes uneven—for example, if a VE is temporarily offline during onboarding, if new VENs are added to the group, or if manual assignments create an imbalance—Cloud Control Center displays a banner indicating that Virtual Edge Nodes are imbalanced.

When this message appears, it means one or more VEs are managing a disproportionate number of Active Client VENs compared to others in the same group.

Users with the appropriate permissions will see a Rebalance button in the banner. Clicking Rebalance redistributes VENs evenly across all VEs within the group, restoring balance in Active Client assignments. During this process, Elisity automatically reassigns VENs so that each VE manages an approximately equal number of Active Client VENs, while the remaining VENs stay as Candidate Clients for redundancy. During an automatic rebalance, Elisity decides VEN-to-VE assignment automatically. If you need a specific Virtual Edge to manage a particular VEN, use the Change Active Virtual Edge action described above; note that a subsequent rebalance event may override a manual assignment.

After the rebalance operation completes:

• VENs are evenly distributed across all available VEs in the group.

• Each VE manages a balanced number of Active Client VENs.

• The imbalance banner disappears, confirming the group has been rebalanced.

• Policy enforcement and traffic forwarding remain uninterrupted during the process.

Virtual Edge Maintenance Mode

Maintenance Mode allows administrators to gracefully place a Virtual Edge into an In Maintenance state ahead of planned work that will disrupt its connectivity—for example, servicing the firewall, switch, or router that a Virtual Edge depends on. When a Virtual Edge enters maintenance, the Virtual Edge Nodes it manages are migrated to other online Virtual Edges in the same group, using the same selection criteria applied when a Virtual Edge goes offline. This preserves uninterrupted policy enforcement and analytics while the underlying infrastructure is taken out of service.

Maintenance Mode is the recommended way to prepare a Virtual Edge for planned downtime. Rather than allowing the Virtual Edge to drop offline unexpectedly—which generates heartbeat-loss alerts and an unplanned failover—maintenance mode hands off VEN management in a controlled manner and suppresses the offline alerting that would otherwise be raised.

Enabling Maintenance Mode

Maintenance Mode is available only when viewing Virtual Edges within a VE Group; it is not available from the All Virtual Edges view. To place a single Virtual Edge in maintenance, select the appropriate VE Group in the left pane, open the three-dot Actions menu on the Virtual Edge, and choose Enable Maintenance Mode. To place several Virtual Edges in maintenance at once, select the check box next to each Virtual Edge and choose Enable Maintenance Mode from the Bulk Actions menu.

A Virtual Edge can be placed in maintenance regardless of its current status. In certain situations the Enable Maintenance Mode option is unavailable or blocked:

• Oversubscription: If placing a Virtual Edge in maintenance would leave the group unable to support its Virtual Edge Nodes, Cloud Control Center displays an orange notification and the action is prevented. A VE Group must retain at least two active Virtual Edges to absorb migrated VENs.
• Decommissioning: If the Virtual Edge is being decommissioned, the action is greyed out, with a tooltip explaining why it is unavailable.
• Rebalancing: If the group is actively rebalancing, the action is greyed out until the rebalance completes.
• All VEs in a group: You cannot enable maintenance mode on every Virtual Edge in a group that still has online Virtual Edge Nodes assigned, as there would be no online Virtual Edge available to manage them.

In Maintenance Status

In Maintenance is a distinct Virtual Edge status with its own non-warning chip color, so it is visually separable from the Offline state at a glance. The status is filterable within the VE Group view and is counted in the Virtual Edge Summary on the Virtual Edges dashboard, allowing administrators to quickly see how many Virtual Edges are currently in maintenance. The Status Duration column shows how long a Virtual Edge has been in its current state.

While a Virtual Edge is in maintenance, Cloud Control Center continues to track its heartbeats in the background, but the usual offline and online state-change alerts are suppressed. This prevents unnecessary alerting during expected, planned downtime while still allowing the platform to detect when the Virtual Edge becomes reachable again.

Disabling Maintenance Mode

To return a Virtual Edge to service, open the Actions menu (or Bulk Actions for multiple Virtual Edges) and choose Disable Maintenance Mode. After maintenance mode is disabled, Cloud Control Center allows a 180-second heartbeat window for the Virtual Edge to report in. If no heartbeat is received within that window, the Virtual Edge transitions to Offline; otherwise it returns to Online.

To avoid repeated, disruptive reshuffling of Virtual Edge Nodes immediately after maintenance, automatic rebalancing is deferred for a short stability period once a Virtual Edge comes back online. If you want to redistribute Virtual Edge Nodes back across the group sooner, you can trigger a manual Rebalance from the imbalance banner, as described in the previous section.

Conclusion

Virtual Edge Groups offer a powerful tool for simplifying the management of Virtual Edges while enhancing network reliability. By leveraging VE Groups, organizations can achieve higher availability, consistent policy enforcement, and streamlined management, making it an essential feature for modern enterprise networks.