Cisco Catalyst SD-WAN AppQoE Configuration Guide, Release 26.x and Later

PDF

Cisco Catalyst SD-WAN AppQoE Configuration Guide, Release 26.x and Later

Restrictions for DRE

Updated: March 10, 2026

Want to summarize with AI?

Log in

Outlines key restrictions for deploying Data Redundancy Elimination (DRE), including dual-side and symmetry requirements, support dependencies, SSL optimization guidance, and constraints when installing the c8000v external service node on UCS E-Series servers.

Restrictions for DRE

Ensure flow symmetry and deploy DRE at both ends of the overlay; DRE is unsupported for asymmetric flows, on service controllers, or without dual-side SSL where required.

  • DRE is a dual-side solution. Therefore, flow symmetry is required to configure DRE optimization. DRE isn’t supported for asymmetric flows.

  • DRE is supported only if integrated service nodes or external service nodes are deployed at both ends of a Cisco Catalyst SD-WAN overlay tunnel.

  • DRE isn’t supported on devices that are configured as service controllers.

  • In a scenario where Unified Threat Defense (UTD) is installed on a router and there is a data policy to redirect the traffic to an external service node, if the traffic is learned by UTD for a given VRF, then the same traffic cannot be redirected to an external service node.

  • Starting from Cisco IOS XE Catalyst SD-WAN Release 17.6.1a the default mode for SSL proxy is single-side. However, because DRE is a dual-side solution, it requires SSL on both, the sending and the receiving end, of the traffic. To optimize SSL performance for this dual-side use case, enable dual-side SSL optimization using the dual-side optimization enable command in Cisco SD-WAN Manager CLI templates. We don’t recommended enabling dual-side SSL if you use GRE tunnels over the WAN.

  • From Cisco IOS XE Catalyst SD-WAN Release 17.7.1a, SMB 311 auto bypass of encrypted traffic is enabled to the DRE. You can continue to manually enable the SMB311 encrypted traffic bypass policy to DRE, for the service nodes running on the devices prior to Cisco IOS XE Catalyst SD-WAN Release 17.7.1a.

  • DRE optimization is not supported for Cisco Catalyst 8000V when deployed on Cisco Enterprise Network Function Virtualization Infrastructure Software (NFVIS) on CSP devices.

Restrictions for Installing Cisco Catalyst 8000V on UCS E-Series Servers

Install and operate the external service node only with the supported hypervisor and core profiles on UCS E-Series, and configure the platform to meet DRE service requirements.

  • Only the VMware vSphere ESXi (release 6.7) hypervisor is supported for deploying Cisco Catalyst 8000V instances on UCS-E Series server modules.

  • Hyperthreading should be disabled on VMware vSpehere ESXi hypervisor.

  • Hyperthreading is not supported for the app-heavy core allocation profile for Cisco Catalyst 8000V deployed on UCS E-Series servers.

  • Cisco Catalyst 8000V instances on UCS-E series server modules can only have 6, 8, or 12 cores.

  • Cisco Catalyst 8000V instances on UCS-E series server modules should be configured with the app-heavy core allocation profile to enable them to run the DRE service.

  • Only one Cisco Catalyst 8000V instance can be installed on a supported UCS E-Series server.

  • To change the DRE profile applied to a device, you need to uninstall DRE, reinstall it, and then apply the new DRE profile.

    Uninstalling DRE results in loss of cache data.

  • Configuring AppQoE DRE medium profile using configuration groups is not supported on C8235-E-G2 platforms.

UCS E-Series Server support is applicable for installing Cisco Catalyst 8000V as an external service node starting from Cisco IOS XE Catalyst SD-WAN Release 17.6.1a only.