Prepare network foundation and baseline administrative services (DNS, NTP, AAA, Syslog, SNMP)

Before onboarding edge routers and applying overlay policies, configure essential baseline services within Cisco Catalyst SD-WAN Manager. These foundational services establish identity trust, ensure accurate event correlation, and provide administrative control across both controllers and WAN Edge routers:

Domain Name System (DNS) Resolution: Configure primary and secondary DNS servers on VPN 0 transport interfaces and local service VPNs. Edge devices require reliable DNS resolution to resolve controller fully qualified domain names (FQDNs), connect to Cisco Plug and Play (PnP) Connect servers, reach cloud SaaS endpoints, and support DNS redirection policies for cloud security breakouts.
Network Time Protocol (NTP) Synchronization: Define synchronized, reliable NTP servers across all controllers and edge routers. Accurate system clocks are mandatory for validating PKI/X.509 certificate validity windows, establishing mutual TLS/DTLS control connections, and correlating telemetry timestamps for BFD path quality measurements. Configure at least two NTP peers and apply authentication keys where required.
Authentication, Authorization, and Accounting (AAA): Establish centralized administrative access using RADIUS or TACACS+ servers (such as Cisco ISE) to enforce Role-Based Access Control (RBAC). Define user groups with granular read-only or read-write permissions, configure strong password lifetime policies, and ensure local administrative credentials remain configured as a fallback during network isolation.
Centralized System Logging (Syslog): Configure remote Syslog servers in either Transport VPN 0 or Management VPN 512 to collect system and security audit logs. Set logging severity levels (e.g., informational, warning, and error) to balance network visibility against storage overhead, and enable audit logging to track all administrative changes and template deployments.
SNMP Monitoring & Traps: Configure SNMPv3 with authentication and encryption (authPriv using SHA and AES) to allow external Network Management Systems (NMS) to securely poll interface health, CPU/memory utilization, and tunnel statistics. Define SNMP trap or inform destinations to alert monitoring platforms to unexpected interface flaps or hardware events.

In Release 20.15 and later, define these baseline services once within a modular System Profile and attach it to your target Configuration Groups for automated distribution across all controllers and routers.

Resources and Reference Documentation