Cisco SD-AVC

Feature history for Cisco SD-AVC

Developments in Cisco SD-AVC, by release.

Table 1. Feature history

Feature name

Release information

Description

Default Enablement of SD-AVC

Cisco Catalyst SD-WAN Control Components Release 20.18.1

The Cisco SD-AVC component is enabled by default in new Cisco Catalyst SD-WAN environments. The control for enabling or disabling is in Administration > Settings > SD-AVC.

Cloud-hosted SD-AVC Service for On-premises Environments

Cisco Catalyst SD-WAN Control Components Release 20.18.1

This release extends the use of a cloud-hosted SD-AVC service to on-premises installations of Cisco Catalyst SD-WAN where internet access is available.

Cisco SD-AVC

Cisco SD-AVC is a component operating within Cisco Catalyst SD-WAN that

  • provides recognition of network application traffic for visibility, analytics, application-aware routing, and application-based policies, such as QoS and application-based firewall policy, and

  • provides analytics at the network level.

Cloud-hosted SD-AVC

From Cisco Catalyst SD-WAN Control Components Release 20.10.1, some Cisco Catalyst SD-WAN environments have used a cloud-hosted SD-AVC service instead of a local service.

Benefits

  • Resources

    Using the cloud-hosted SD-AVC service reduces the load on SD-WAN Manager host resources.

  • Service maintenance

    Cisco can provide patches to the cloud-hosted SD-AVC service at any time, optimizing SD-AVC operation.

Environment type

Uses cloud-hosted SD-AVC

From this release

Comments

Cisco Catalyst SD-WAN Cloud (formerly Cisco Cloud-delivered Catalyst SD-WAN)

Yes

Cisco Catalyst SD-WAN Control Components Release 20.10.1

Cisco Catalyst SD-WAN Cloud Pro (formerly Cisco Hosted Catalyst SD-WAN)

Yes

Cisco Catalyst SD-WAN Control Components Release 20.10.1

On-premises installations of Cisco Catalyst SD-WAN where internet access is available, and where the Cloud Services feature is enabled

Yes

Cisco Catalyst SD-WAN Control Components Release 20.18.1

Air-gapped environments without internet access

No

—

Uses a local SD-AVC service.

Environments with the Cloud Services feature not enabled

No

—

Uses a local SD-AVC service.

Restrictions for cloud-hosted SD-AVC

Describes restrictions for cloud-hosted SD-AVC.

Compliance for government installations

For compliance reasons, some government installations of Cisco Catalyst SD-WAN do not use all available cloud services, including cloud-hosted SD-AVC.

Upgrade information

This information is relevant only if you have upgraded your Cisco Catalyst SD-WAN environment from a release earlier than Cisco Catalyst SD-WAN Control Components Release 20.18.1.

Upgraded from

Conditions

Result

Release earlier than Cisco Catalyst SD-WAN Control Components Release 20.18.1

Cloud services and SD-AVC enabled

The upgraded environment uses the cloud-hosted SD-AVC service.

Either Cloud Services disabled, or SD-AVC disabled

The upgraded environment uses the local SD-AVC service.

After upgrading, if you enable Cloud Services (Administration > Settings > Cloud Services), the environment switches to using the cloud-hosted SD-AVC service.

Installing and enabling Cisco SD-AVC, Releases 20.3.1 and later

Cisco SD-AVC is pre-installed from 20.3.1 and pre-enabled from 20.18.1. The details are described here.

Pre-installed from 20.3.1

Installing or upgrading to Cisco vManage Release 20.3.1 or later automatically includes installation of Cisco SD-AVC as a component.

Enabled by default from 20.18.1

From SD-WAN Control Components 20.18.1, the SD-AVC component is enabled by default in new Cisco Catalyst SD-WAN installations. The enablement applies to all Cisco SD-WAN Manager nodes.

Upgrading to 20.18.1 or later

If you upgrade an environment to SD-WAN Control Components 20.18.1 or later from earlier releases, SD-AVC is not necessarily enabled. The SD-AVC status before upgrade is preserved after upgrade. For example, if you have a 20.17.x installation, with SD-AVC disabled, and you upgrade to 20.18.1, SD-AVC remains disabled. This is true even though from 20.18.1, SD-AVC component is enabled by default in new installations.

Enable or disable in Administration > Settings > SD-AVC.

Enable Cisco SD-AVC on Cisco vManage Release 20.3.1 through SD-WAN Manager 20.16.x

From SD-WAN Manager 20.18.1, SD-AVC is enabled by default.

Before you begin

Ensure that routers in the network that are included in the Cisco Catalyst SD-WAN topology have a DNS server configured.

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Administration > Cluster Management.

Step 2

For the desired host (the portal on which you are enabling SD-AVC), click ... and select Edit.

Step 3

In the Edit Manager pop-up window, select the checkbox for Enable SD-AVC.


Note

The Edit Manager pop-up window provides an option for disabling the application server. After disabling the application server, you cannot later enable other services using this method. If you need to disable the application server, do not do this at the same time that you enable other features.

Step 4

Enter the username and password, using Cisco SD-WAN Manager credentials. Reboot the device to apply the changes.

Step 5

After the reboot, Cisco SD-WAN Manager comes up automatically and displays progress on the SD-AVC activation. Wait for the activation to complete.

Step 6

After installation is complete, you can verify that Cisco SD-WAN Manager has the SD-AVC virtual service installed and operating correctly.

  1. From the Cisco SD-WAN Manager menu, choose Administration > Cluster Management.

  2. Click Service Configuration, in the Cisco SD-WAN Manager row of the table. Verify that SD-AVC indicates that it is reachable.

Enable Cisco SD-AVC on Cisco IOS XE Catalyst SD-WAN Devices

To enable SD-AVC on a Cisco IOS XE Catalyst SD-WAN device, create a localized policy that enables app visibility and apply the policy to the template for the Cisco IOS XE Catalyst SD-WAN device.

Before you begin

  • A template exists for the Cisco IOS XE Catalyst SD-WAN device (example: Cisco ASR 1001-X, Cisco ISR 4321).

  • TCP port 10501 destination traffic must be permitted.

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

Step 2

Select Localized Policy.

Step 3

To add a policy and enable Application, follow these steps:

  1. Select Add Policy.

  2. Click Next on several pages (Create Groups of Interest, Configure Forwarding Classes/QOS, Configure Access Control Lists, Configure Route Policy) until the Policy Overview page.

  3. In the Policy Overview page, enter a policy name and policy description.

  4. Select Application.

  5. Save the policy.

Step 4

To add the localized Policy to the device template, follow these steps:

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

  2. For the device on which you have to enable SD-AVC, click … and select Edit from the menu.

  3. Select Additional Templates.

  4. Add the localized policy created in an earlier step of this procedure.

  5. Select Update and proceed through the next screens to push the updated template to the device.

Step 5

After pushing the update to the device, you can check the status of SD-AVC on the device with one of the following commands.

show avc sd-service info summary

or

show avc sd-service info connectivity