A centralized policy configured in Cisco Catalyst SD-WAN Manager and pushed to active SD-WAN Controllers dictates overlay routing behavior, control plane topology, and data plane path selection across the entire enterprise fabric
The Single Active Centralized Policy Rule:
Only one centralized policy can be active across the Cisco Catalyst SD-WAN overlay network at any given time. Activating a new centralized policy automatically deactivates and replaces the currently active policy across all controllers. Because of this architectural constraint, you must bundle and consolidate all network-wide policy components into a single centralized policy package before activation:
- Control Plane Topology Rules: Hub-and-spoke, full mesh, partial mesh, or multi-region designs.
- Traffic Data Policies: Quality of Service (QoS), traffic engineering, path redirection, and application firewalls.
- Application-Aware Routing (AAR) Policies: Dynamic path selection based on real-time latency, jitter, and packet loss metrics.
- VPN Membership Restrictions: Enforcing multi-tenant isolation and restricting which service VPNs can communicate across specific sites.
Step-by-Step Policy Configuration Workflow:
Cisco Catalyst SD-WAN Manager provides a guided workflow under Configuration > Policies > Centralized Policy to build and assemble this unified policy bundle:
1. Create Groups of Interest: Define reusable building blocks including Site Lists, VPN Lists, Prefix Lists, TLOC Lists, and Color Lists.
2. Configure Topology and VPN Membership: Define the overlay control plane structure:
- Hub-and-Spoke: Connects spoke sites directly to central data center hubs while restricting spoke-to-spoke direct paths.
- Mesh: Permits direct, site-to-site communication within designated regions or site lists.
- Custom Control (Route & TLOC): Applies match-action filtering on Overlay Management Protocol (OMP) routes and TLOC advertisements.
- VPN Membership: Restricts which service VPNs are reachable at specific branch locations.
3. Configure Traffic Rules: Build ordered match-action sequences for traffic data policies and Application-Aware Routing:
- Define match criteria including application lists, destination ports, DSCP markings, or source/destination IP prefixes.
- Specify forwarding actions such as setting a preferred TLOC color, assigning a forwarding class and QoS queue, applying policers, or selecting fallback paths when SLA thresholds are exceeded.
4. Apply Policies to Sites and VPNs: Bind each configured topology, data, and AAR rule to its corresponding site lists and VPN lists. Give the combined policy package a clear, version-controlled name and description.
5. Activate the Centralized Policy: Select the consolidated policy bundle from the Centralized Policy table, click More Actions (...), and select Activate. Catalyst SD-WAN Manager validates the configuration syntax and distributes the single active policy definition to all active SD-WAN Controllers in the fabric.