Configure SD-WAN Cloud OnRamp for SaaS

Introduction

This document describes the configuration for Cloud OnRamp for Software as a Service (SaaS) using branch local exit.

Prerequisites

Requirements

Cisco recommends that you have knowledge of the Cisco Software-Defined Wide Area Network (SD-WAN).

Components Used

The information in this document is based on these software and hardware versions:

• Cisco vManage version 20.9.4
• Cisco WAN Edge router version 17.9.3a

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

For an organization using SD-WAN, a branch site typically routes SaaS application traffic by default over SD-WAN overlay links to a data center. From the data center, the SaaS traffic reaches the SaaS server.

For example, in a large organization with a central data center and branch sites, employees can use Office 365 at a branch site. By default, the Office 365 traffic at a branch site is routed over an SD-WAN overlay link to a centralized data center and, from DIA exit, to the Office 365 cloud server.

This document covers this scenario: If the branch site has a direct internet access (DIA) connection, you can improve performance by routing the SaaS traffic through the local DIA, bypassing the data center.

Note: Configuring Cloud OnRamp for SaaS when a site uses a loopback as a transport locator (TLOC) interface is not supported.

Configure

Network Diagram

Network Topology

Configurations

Enable NAT on the Transport Interface

Navigate to Feature Template . Choose the  Transport VPN interface template and Enable NAT.

Enable Interface NAT

CLI Equivalent Configuration:

interface GigabitEthernet2 
ip nat outside 

ip nat inside source list nat-dia-vpn-hop-access-list interface GigabitEthernet2 overload 
ip nat translation tcp-timeout 3600
ip nat translation udp-timeout 60

Create a Centralized AAR Policy

In order to establish a Centralized policy, you must adhere to this procedure:

Step 1. Create a Site list:

VPN Interface NAT Template

Step 2. Create a VPN list:

Centralized Policy Custom Site List

Step 3. Configure the Traffic Rules and create the Application Aware Routing Policy.

Application Aware Route Policy

Step 4. Add the policy to the intendedSites and VPN:

Add policies to Sites and VPNs

CLI Equivalent Policy:

viptela-policy:policy
app-route-policy _VPN1_Cloud_OnRamp_SAAS
vpn-list VPN1
sequence 1
match
cloud-saas-app-list office365_apps
source-ip 0.0.0.0/0
!
action
count Cloud_OnRamp_-92622761
!
!
!
lists
app-list office365_apps
app skype 
app ms_communicator 
app windows_marketplace 
app livemail_mobile 
app word_online 
app excel_online 
app onedrive 
app yammer 
app sharepoint 
app ms-office-365 
app hockeyapp 
app live_hotmail 
app live_storage 
app outlook-web-service 
app skydrive 
app ms_teams 
app skydrive_login 
app sharepoint_admin 
app ms-office-web-apps 
app ms-teams-audio 
app share-point 
app powerpoint_online 
app ms-lync-video 
app live_mesh 
app ms-lync-control 
app groove 
app ms-live-accounts 
app office_docs 
app owa 
app ms_sway 
app ms-lync-audio 
app live_groups 
app office365 
app windowslive 
app ms-lync 
app ms-services 
app ms_translator 
app microsoft 
app sharepoint_blog 
app ms_onenote 
app ms-teams-video 
app ms-update 
app ms-teams-media 
app ms_planner 
app lync 
app outlook 
app sharepoint_online 
app lync_online 
app sharepoint_calendar 
app ms-teams 
app sharepoint_document 
!
site-list DCsite_100001
site-id 100001 
!
vpn-list VPN1
vpn 1 
!
!
!
apply-policy
site-list DCsite_100001
app-route-policy _VPN1_Cloud_OnRamp_SAAS
!
!

Enable Application and Direct Internet Access in vManage

Step 1. Navigate to Cloud OnRamp for SaaS.

Select Cloud onRamp for SaaS

Step 2. Navigate to Applications and Policy.

Select Applications and Policy

Step 3. Navigate to Application > Enableand Save. Then click Next.

Select Applications and Enable Monitoring

Step 4. Navigate to Direct Internet Access (DIA) Sites.

Select Direct internet Access Sites

Step 5. Navigate to Attach DIA Sites  and choose the Sites.

Attach DIA sites

Verification

This section describes the outcomes in order to verify the Cloud OnRamp for SaaS.

• This output shows Cloudexpress local-exits:

cEdge_West-01#sh sdwan cloudexpress local-exits 
cloudexpress local-exits vpn 1 app 2 type app-group subapp 0 GigabitEthernet2 
application office365 
latency 6 
loss 0

• This output shows Cloudexpress applications:

cEdge_West-01#sh sdwan cloudexpress applications 
cloudexpress applications vpn 1 app 2 type app-group subapp 0 
application office365 
exit-type local 
interface GigabitEthernet2 
latency 6 
loss 0

• This output shows incrementing counters for interested traffic:
  

cEdge_West-01#sh sdwan policy app-route-policy-filter 
NAME                       NAME        COUNTER NAME                        PACKETS     BYTES 
-------------------------------------------------------------------------------------------------
_VPN1_Cloud_OnRamp_SAAS    VPN1        default_action_count                640         66303 
                                       Cloud_OnRamp_-403085179             600         432292 

• This output shows the vQoE status and Score:

vQoE Status and Score

• This output shows the service-path from vManage GUI:

Service Path

• This output shows the service-path from Device CLI:

cEdge_West-01#sh sdwan policy service-path vpn 1 interface GigabitEthernet4 source-ip 10.2.20.70 dest-ip <Office365 server IP> protocol 6 
Next Hop: Remote 
Remote IP: 10.2.30.129, Interface GigabitEthernet2 Index: 8 

Related Information

• Cisco Catalyst SD-WAN Cloud OnRamp Configuration Guide
• Cisco Technical Support & Downloads