Explore Cisco
How to Buy

Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco Managed Services Accelerator (MSX) 3.9 SD-WAN Service Pack User Guide

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Managed Services Accelerator (MSX) 3.9 SD-WAN Service Pack User Guide

Chapter Title

Monitoring Cisco SD-WAN and Meraki SD-WAN Services in MSX

Results

Updated:
September 22, 2020

Chapter: Monitoring Cisco SD-WAN and Meraki SD-WAN Services in MSX

Monitoring Cisco SD-WAN and Meraki SD-WAN Services in MSX

Cisco MSX has a dashboard and workspace that provide service status, alerts, and device monitoring in a consolidated view. Cisco MSX 3.9 Release uses tenant centric interface that is visible only when Enterprise Access (EA) service pack is subscribed with one or more service packs.


Note
The tenant centric user interface is not supported on other service packs. If EA is not installed, you will see the MSX legacy interface without the tenant workspace.

This chapter contains the following sections:

Monitoring SD-WAN Service Status from the MSX Dashboard (Legacy UI)

To access the legacy dashboard, from the MSX main menu, click MSX Dashboard. The MSX legacy interface is displayed only when the SD-WAN service pack is installed without the Enterprise Access (EA) service pack.

Figure 1. MSX Dashboard (Legacy UI)

You can view the data in only those dashlets that you have access to. If you are a user with an administrator privilege, you can view all the dashlets available in MSX with the data populated for all the users.

The following are the dashlets that are available in Cisco MSX Portal:

  • Subscriptions—This dashlet displays all the subscriptions sorted by the service type, customers, status, number of issues, and status of the issues. This dashboard also displays the service pack-specific subscriptions with details of the services, such as, Up, Down, Unregistered, Ordering, Updating, and Sites.

    The SD-WAN subscription dashlet provides the overview (high-level status) of the control plane status for each tenant and allows you to further drill-down to the operational state of the sites on the corresponding Control Plane. The service pack-specific subscription page is also linked to their detailed services page. For more information, see Monitoring SD-WAN Control Plane Status.

  • Devices Deployed—This dashlet lists the devices that are deployed for the Cisco SD-WAN and Meraki SD-WAN services. For more information, see Monitoring Site/Device Status.

  • Tenants—This dashlet lists the existing tenants (customers) for the logged in user.

Monitoring SD-WAN Services Status

From the MSX Portal, you can monitor the following for an SD-WAN subscription:

  • Control Plane Status: Monitor connectivity to the control plane used for provisioning and managing devices in SD-WAN. You can add only one control plane per tenant. The Subscription dashlet displays the status of the Control Plane for each tenant. For more information, see Monitoring SD-WAN Control Plane Status.

  • Site/Device Status: Monitor the sites/devices that were added to the tenant's control plane. For more information, see Monitoring Site/Device Status.

  • Tunnel Health Status: Monitor the health of the tunnel health across the branch devices. For more information, see Monitoring Tunnel Health.

Monitoring SD-WAN Control Plane Status

In MSX SD-WAN, Control Plane allows you to centrally manage the devices for a tenant, including provisioning, monitoring, and so on.

Before you begin

To monitor the status of the SD-WAN control plane:

Procedure
Step 1

Log in to the Cisco MSX Portal.

Step 2

In the main menu, click Dashboard.

Step 3

From the Subscriptions pane, select the SD-WAN services, and click a tenant name.

The SD-WAN page for the tenant appears and displays the control plane status for the selected tenant. The controller type specifies whether the site is Meraki or Cisco SD-WAN. The tenant can have both Cisco SD-WAN and Meraki SD-WAN control planes.

Step 4

Select the desired control type (either Cisco SD-WAN or Meraki SD-WAN). Depending on the controller type Cisco SD-WAN or Meraki SD-WAN control plane is displayed.

The following is the Meraki Control Plane status.

Figure 2. Meraki Control Plane Status

The following is the Cisco SD-WAN Control plane status after the certification, the security groups, and other configurations are completed.

Figure 3. SD-WAN Control Plane Status
Note 

If your Cisco SD-WAN control plane remains in the 'Not Configured' state or is unable to connect to the control plane due to the authentication issue, see Troubleshooting Control Plane.

Step 5

Click the Toggle button on the top right-hand side of the page to toggle between the list and map view with the list of devices on the tenant's control plane.

Step 6

Click on a site to display the Site Summary page with site information and basic device details. For more information, see Monitoring Site/Device Status.

Monitoring Site/Device Status

Tenant's Site Summary page displays all the devices added to the tenant's control plane as a mapped or unmapped device.

Unmapped Sites/Devices are the devices that are in the process of being shipped to the customer site. These are plotted as unmapped site as these still do not have any address or map coordinates to plot them on the map.

The SD-WAN Home screen display devices available on the SD-WAN and the Meraki Control Plane. The tenant can have both Cisco SD-WAN and Meraki SD-WAN control planes. You can filter the site by Controller Type, Device Type, Device Model, and Status. The controller type specifies whether the site is Meraki or Cisco SD-WAN.

Select the desired control type (either Cisco SD-WAN or Meraki SD-WAN) to monitor the devices added on that control plane.

Procedure
Step 1

On the main menu of the MSX Portal, select Dashboard.The Dashboard screen appears.
Step 2

Click the SD-WAN Home button. The SD-WAN Home screen appears.

Step 3

Select a tenant name to display site status and control planes status for the selected tenant.

Step 4

Click the Toggle button on the top right-hand side of the page to toggle between the list and map view with the list of sites for the selected tenant.

Note 
Both list view and map view displays all the sites (Meraki and Cisco SD-WAN) for the selected tenant.
Figure 4. List View of the Sites for Selected Tenants

You can also monitor the device statuses from the Devices main menu on the MSX Portal.

Step 5

From the list or the map view, select a site to display site summary, site information, and basic device details, such as chassis number, system IP, site ID, and so on.

Note 
If a device is in the process of being shipped to a customer site, MSX portal does not show physical devices on the map as these still do not have any address or map coordinates for the sites to plot them on the map. The site is plotted as Unmapped Sites on MSX map. In the map view, a site when selected will have an additional blue circle around it.
Figure 5. Unmapped Sites
Step 6

(For Meraki) To view site status for a site, click on a site to display the following details on the Site Summary page:

  • Latitude, longitude, uplink information, and status of the devices.

  • Status of the devices assosciated to the site.

For information on what the site statuses indicates, see Understanding Site/Device Statuses.

Step 7

(For Meraki) From the site status screen, you can do the following:

  • Add more devices to the existing Meraki site, by clicking the Add Device button.

  • Delete the device already associated with a site by clicking the Delete Device button.

Figure 6. Meraki Site Status Summary
Figure 7. Meraki Site Status Summary Devices View
Step 8

To view health of IPsec tunnels across branch devices, see Monitoring Tunnel Health.

Monitoring Tunnel Health

The tunnel health graph gives an overview of the health of the IPSec tunnels from the SD-WAN device.

The tunnel report in MSX shows how many of these tunnels are up, which is an indication of whether the device is at risk of losing connectivity.

For example: In the following figure, tunnels are established for vEdge with every other vEdge in the network. If more tunnels are down, it could indicate that vEdge device from where tunnels are established is experiencing degradation. If only a small subset of tunnel links are down, it means other vEdge devices may be possibly experiencing degradation.

Figure 8. Tunnel Connecitivity between vEdge Devices

Tunnel Health Reporting/Tunnel Health Status Calculations:

Tunnels Up % = (Number of Tunnels in Up state / Total Number of Tunnels) * 100

For example:

If there are 200 tunnels and 80 tunnels are up, the Tunnel Up % will be (80/200)*100 = 40%

For other tunnel performance metrics, such as data loss, latency, jitter information, click View Tunnel details on Control Plane to launch the tunnel details. For more information on these metrics, see Cisco SD-WAN documentation.

To view the control plane status for the SD-WAN service:

Before you begin

To monitor tunnel health, make sure users have the following permission assigned:

  • Under Services, Configurations, and Devices category, select Service Metrics (View) permission permission.

Procedure
Step 1

Log in to the Cisco MSX Portal.
Step 2

In the main menu, click Dashboard.

Step 3

From the Subscription dashlet, select the SD-WAN Service.
Step 4

Select a tenant to display the tenant-specific SD-WAN home page.

The tenant-specific SD-WAN homepage displays the control plane status for the selected tenant.
Step 5

Click the Toggle button on the top right-hand side of the page to toggle between the List view and Map view with the list of SD-WAN sites/devices for the selected tenant.

Step 6

Select a site/device from the list of devices. The Site Summary page appears with site information and basic device details, such as chassis number, system IP, site ID, and so on.

The Site Status in the details page changes based on the various status of SD-WAN devices along with status of tunnel health. For more information on the overall site/device statuses, see Understanding Site/Device Statuses.

The following table displays the Tunnel Health status that appears below the overall Site Status image based on the Tunnel Up %.
Tunnel Health Status Tunnel Up %
Good 70-100
Fair 35-69
Critical 0-34
Note 

If MSX is unable to determine the tunnel health, the Tunnel Health status changes to an 'Unknown' state.

The following are a few examples of the overall Site/Device Status depending on control plane status and the text beneath the image is based on the tunnel health status.

Figure 9. Connected to control plane but the tunnels are starting to degrade (fair)
Figure 10. No connectivity to Control Plane but tunnel performance is fair
Step 7

On the Site Summary page, scroll down to the Tunnel Health section to view the current tunnel metrics. A graphical representation of all existing tunnels for the device appears.

Figure 11. Tunnel Health Graph

Where:

X axis - Time range

Y axis - Tunnels Up % (values 0-100)
Step 8

Select the time interval for displaying the tunnel health for that period. Choose one of the available time intervals from the Viewing drop-down list or click Custom to choose a time duration of your choice for which the reporting is displayed. Provide the day and time from when the reporting data must be collected until the specified end time. By default, last 24 hours chart is loaded.

Hover over the aggregated data points on the chart to get specific details, including the timestamp when the event occurred. These aggregated data points are system-generated. For more information on these data points, click on the Learn More link.

Understanding Site/Device Statuses

The site summary page displays overall status of the devices for Cisco SD-WAN and Meraki SD-WAN. The color and the status transition of the overall site/device status depends on the following factors:

  • Status of the Control Plane

  • Health of the tunnels established between the sites (Applicable only for Cisco SD-WAN devices)

This section covers the overall statuses of the following devices on MSX:


Note
If the images in the HTML help appear pixelated, download this chapter in the PDF format. Use the Download option on the top right hand side of the HTML help.

Site Statuses for Physical Device

The table below show the site status for Physical site (vEdge or IOS XE) with various validation messages shown on MSX, along with next steps.

Table 1. Site Statuses for Physical Device

Site Summary Status

Description

Next Steps

The device is in the process of being shipped to customer site. At this point, MSX portal does not show physical devices on the map as these still do not have any address or map coordinates for the sites to plot them on the map. The site is plotted as ‘Unmapped sites’ on MSX map.

Connect the device. After the device is installed on the premise, connect the device, it goes through the ZTP (Zero Touch Provisioning) process and gets connected to the Control Plane.

The device has established connectivity to the Control Plane, but does not have the provisioning data to provision a device.

Import bulk data. For information, on how to import, see Importing Multiple Site Data into MSX.

After importing, MSX displays various validation messages to indicate the errors or missing information in the template file. You can click View Details in the validation message to display the Site Import Summary with the error list.

Note 
We recommend that you download the error list as the information this screen is temporary and will disappear after you exit this page.

  • Incomplete: Device is not ready to be provisioned because the data filled was incorrect or incomplete. The device will be in this status until the details are corrected, and the template file is imported again into MSX.

  • Ready to Provision: Device is connected and bulk data is imported. All provisioning details are complete and device is ready to provision.

  • For site with ‘Incomplete’ status, see Provisioning Details under Site Summary. This section lists the fields that have missing data. Enter the missing details in the Site template file and import again.

  • For site with ‘Ready to Provision’ status, see Provisioning Details under Site Summary, click Provision Site to initiate the provisioning process.

  • Up: Site was provisioned successfully.

  • Critical: Site was up and was provisioned, but after a while it lost connectivity to the SD-WAN Control Plane.

If the status is ‘Critical’, troubleshoot SD-WAN control plane connectivity issue. For more information, see Troubleshooting SD-WAN Reachability Issues.

  • Provisioning: Provisioning process pushes the configuration data into the Control Plane such that the site is set up for day one configurations. The provisioning process on the Control Plane takes approximately 5 to 10 minutes.

  • Provisioning Failed: The Site Status changes to ‘Provisioning Failed’ if the configuration data imported does not match with the values on the Control Plane. See Next Steps for more details.

Provisioning could fail because of one of the following reasons.

  • Data could not be validated as the template on MSX modified since the last upload. Correct the entries that are missing or incorrect. For information, on how to edit these entries, see Step 5 in Importing Multiple Site Data into MSX.

  • If the information does not match with the data on the control plane, provisioning fails, and the missing or incorrect fields are highlighted in the Site Summary. Correct the entries that are missing or incorrect. For information, on how to edit these entries, see Step 5 in Importing Multiple Site Data into MSX.

  • Unexpected errors on the Control Plane. If the state of the site appears as Out-of-Sync under the Basic Details, check the Event Log to get more details on the errors. For more information, see Viewing Event Logs.

Offline: A device is in the process of being shipped has been uploaded and provisioned on the Control Plane. When the device is connected and has reachability to the Control Plane, the template on the Control Plane is applied on the device.

Connect the device.

Site Statuses for vEdge SP Cloud and External Sites

The table below show the site statuses for vEdge SP Cloud and external sites with various validation messages shown on MSX, along with next steps.

Table 2. Site Statuses for vEdge SP cloud and External Sites

Site Summary Status

Description

Next Steps

Unknown: Site has been added on MSX Portal and the configurations are downloaded by the service provider. The Unknown state indicates the time period when the Service Provider uses the downloaded configurations to brings up a vEdge cloud to finish deployment.

The site during this phase waits for the vEdge to be deployed and connected back to SD-WAN Control Plane.

During this state, bulk data can be imported and provision the SP Cloud site through MSX. See the topic, ‘ Importing Multiple Site Data into MSX.’

  • Connected: Site Deployment is complete and vEdge is able to communicate to the Control Plane, but does not have the provisioning data to provision a device.

  • Not Connected: Not Connected indicates a state when a connection was established once and then connection with Control Plane was lost because of Interface being shutdown.

After importing, MSX displays various validation messages to indicate the errors or missing information in the template file. You can click View Details in the validation message to display the Site Import Summary with the error list.

Note 
We recommend that you download the error list as the information on this screen is temporary and will disappear after you exit this page.

Ready to Provision: In both cases, that is, connected to control plane and not connected to control plane, bulk data can be imported, and the sites are ready to be provisioned.

For site with ‘Ready to Provision’ status, see Provisioning Details under Site Summary, click Provision Site to initiate the provisioning process.

Incomplete: Device is not ready to be provisioned because the data filled was incorrect or incomplete. The device will be in this status until the details are corrected, and the template file is imported again into MSX.

For site with ‘Incomplete’ status, see Provisioning Details under Site Summary. This section lists the fields that have missing data. Enter the missing details in the Site template file and import again.

The remaining statuses for the vEdge SP cloud are similar to the Physical devices. For more information on the other statuses, see Site Statuses for Physical Device .

Site Statuses for vEdge Cloud

The table below show the site status for vEdge Cloud site with various validation messages shown on MSX, along with next steps.

Table 3. Site Statuses for vEdge Cloud

Site Summary Status

Description

Next Steps

ENCS site deployment with a vEdge is in progress.

Not Connected: vEdge is deployed but is not able to establish connection with the Control Plane.

  • Deployed: ENCS site is deployed and vEdge is able to communicate to the Control Plane.

  • Deployment Failed: Could not bring up vEdge using ENCS.

Troubleshoot the data plane. For more information, see Data Plane Troubleshooting.

Connected: vEdge is deployed and connected to Control Plane. System is now ready for bulk import of data from multiple sites.

After the connection is established, you can import bulk data for provisioning the site. See the topic, Importing Multiple Site Data into MSX .

Incomplete: Device is not ready to be provisioned because the data filled was incorrect or incomplete. The device will be in this status until the details are corrected, and the template file is imported again into MSX.

Ready to Provision: Device is connected and bulk data is imported. All provisioning details is complete and device is ready to provision.

  • For site with ‘Incomplete’ status, see Provisioning Details under Site Summary. This section lists the fields that have missing data. Enter the missing details in the Site template file and import again.

  • For site with ‘Ready to Provision’ status, see Provisioning Details under Site Summary, click Provision Site to initiate the provisioning process.

  • Provisioning: Provisioning process pushes the configuration data into the Control Plane such that the site is set up for day one configurations. The provisioning process on the Control Plane takes approximately 5 to 10 minutes.

  • Provisioning Failed: The Site Status changes to ‘Provisioning Failed’ if the configuration data imported does not match with the values on the Control Plane. See Next Steps for more details

    .

Provisioning could fail because of one of the following reasons.

  • Data could not be validated as the template on MSX was modified since the last upload. Correct the entries that are missing or incorrect, and import the site template file again. For information, on how to edit, see step 5 in Importing Multiple Site Data into MSX.

Note 
You can directly edit the site template from MSX any number of time as required.

  • If the information does not match with the data on the control plane, provisioning fails, and the missing or incorrect fields are highlighted in the Site Summary. Correct the entries that are missing or incorrect, and import the site template file again. For information, on how to edit, see step 5 in ‘ Importing Multiple Site Data into MSX.

  • Unexpected errors on the Control Plane. If the state of the site appear as Out-of-Sync under the Basic Details, check the Event Log to get more details on the errors. For more information, see Viewing Event Logs.

  • Up: Site was provisioned successfully.

  • Critical: Site was up and was provisioned, but after a while it lost connectivity to the SD-WAN Control Plane.

If the status is ‘Critical’, troubleshoot SD-WAN control plane connectivity issue. For more information, see Troubleshooting SD-WAN Reachability Issues.

Site Statuses for Meraki SD-WAN Devices

The table below shows the site statuses for Meraki SD-WAN sites shown on MSX, along with the next steps.

Table 4. Site Statuses for Meraki Devices

Site Summary Status

Description

Next Steps
Up At least one of the devices has uplink connectivity to the WAN network. Configure SD-WAN Traffic Shaping rules for the network in the Meraki dashboard.
Down Devices added to the site do not have connectivity to the WAN network. Check the uplink configuration for the devices added to the site. For more information, see Checking Device Connections.
Needs Input No devices added to Meraki site. Add devices to establish connectivity to a WAN network. For more information, see Creating New sites for Meraki.
Unknown Unable to collect information on device status. Unexpected errors on the Control Plane.

  • Check if the Meraki beat is operational. For more information, see the section,Checking Meraki Beat.

  • For a recently added device, wait for a few minutes as the device transitions to the actual status.

Monitoring SD-WAN Reporting Metrics Using Third-Party Network Monitoring Applications

You can integrate third-party network monitoring applications with SD-WAN on Cisco MSX, for example, LiveAction for real-time network insight. If integrated with SD-WAN, users can launch the application dashboard from the MSX Portal.

Before You Begin

Integrate LiveAction with MSX. For more information, see ‘Integrating Cisco MSX with LiveAction’ in the post-installation section of Cisco Managed Services Accelerator 3.7 Install and Upgrade guide .

To launch a third-party monitoring portal from the Cisco MSX Portal:

Procedure

Step 1

In the main menu of the Cisco MSX Portal, select Dashboard. The Dashboard screen appears.
Step 2

Click the SD-WAN Home button. The SD-WAN Home screen appears.

Step 3

Select the tenant from the drop-down. The SD-WAN Home screen refresh and displays the Control Plane status for the selected tenant.

Step 4

To launch the application dashboard, click Launch Monitoring Portal. The application dashboard opens up in a separate browser.

Monitoring the Traffic Policy

Monitoring the Traffic Paths

To confirm traffic path:

Procedure
Step 1

Log in to the vEdge or cEdge (IOX XE) server.

Step 2

Turn on application visibility on the vEdge or cEdge. To do so use the following commands:

Example:

config
policy
flow-visibility
commit
Step 3

Send traffic through the vEdge or cEdge.

Step 4

Check the path for vEdge and cEdge:

  • For vEdge, use the following command:

Example:

show app cflowd flows | tab

  • For cEdge, use the following command:

Example:

Monitoring the Application Queue

To confirm application queues:

Procedure
Step 1

Log in to the vEdge or the cEdge server.

Step 2

Send traffic through the vEdge or cEdge.

Step 3

Check the queues for vEdge and cEdge:

  • For vEdge, use the following command:


show policy data-policy-filter

  • For cEdge, use the following command:


show sdwan policy data-policy-filter

The output will show all the available application queue.

Monitoring SD-WAN Service Status on the Tenant Centric Hybrid UI

The tenant centric interface is visible only when Enterprise Access (EA) service pack is subscribed with one or more service packs. Tenant centric interface has:

  • An Operator workspace, which lists all tenants and the services they have subscribed to.

  • A Tenant Workspace, which allows tenants to access the information related to their subscribed services.

Figure 12. Tenant Centric MSX Dashboard and Tenant Workspace

The following are the menus that are available in the Tenant workspace:

  • Services: Display the status of all services subscribed by a tenant.


    Note

    Services display only the Meraki Control Plane status and does not display the Cisco SD-WAN Control Plane status.

  • Sites: Display the sites a specific tenant is associated with and the overall health status of the sites.


    Note

    SD-WAN (Viptela/Meraki) sites are not displayed in the sites list. For site status, see Monitoring Site/Device Status.

  • Devices: Display devices available at all sites for a particular tenant.


    Note

    Only Meraki devices are displayed in the Devices view. For all device status, see Monitoring Site/Device Status.

  • Service Controls: Display the custom service controls that are used by the services. For SD-WAN, you can view traffic policies (path preference and application relevance settings) used by a tenant.


    Note

    Service Controls are not displayed for SD-WAN services in 3.9.

  • Offer Catalog: Displays existing subscriptions and allows subscribing to new services.


    Note
    In 3.9, you can subscribe to a new SD-WAN service only through Service Catalog main menu. For subscribing SD-WAN services, see Deploying Cisco SD-WAN Services on MSX.

Viewing Event Logs

To view the event logs:

Before you begin

Ensure you have the View Event Log permissions to view the status of the policies in the event log.

Procedure

Step 1

Log in to the Cisco MSX Portal.

Step 2

In the main menu, click Event Log. The Event Log screen appears.

Figure 13. MSX Event Log
Step 3

Select the tenant from the drop-down for which the event log has to be displayed.

Step 4

To filter the event log records, select the filter type from the drop-down. To list event logs for a specific duration, select the Custom Rangecheck box and specify the dates.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco