Cloud OnRamp for SaaS, Cisco Catalyst SD-WAN Releases 20.15.1 and Later

Cloud OnRamp for SaaS, Cisco Catalyst SD-WAN Releases 20.15.1 and Later

Table 1. Feature History

Feature Name

Release Information

Description

Cloud OnRamp for SaaS Workflow

Cisco IOS XE Catalyst SD-WAN Release 17.15.1a

Cisco Catalyst SD-WAN Control Components Release 20.15.1

Cisco SD-WAN Manager provides a fully-guided workflow for selecting specific applications to enable Cloud OnRamp for SaaS. Cloud OnRamp for SaaS identifies the best paths for handling traffic for each of these applications.

Cloud OnRamp for SaaS for user-defined SaaS application lists

Cisco IOS XE Catalyst SD-WAN Release 17.18.1a

Cisco Catalyst SD-WAN Manager Release 20.18.1

Cisco SD-WAN Manager supports adding, editing, and deleting user-defined probe endpoints for applications listed in the application catalog. Applications with endpoint details are eligible for:

  • cloud monitoring, and

  • steering through best path.

You can also create an application list with applications having a common probe endpoint and enable Cloud OnRamp for SaaS for that application list.

Cloud OnRamp for SaaS Telemetry Settings

Cisco IOS XE Catalyst SD-WAN Release 26.1.1

Cisco Catalyst SD-WAN Manager Release 26.1.1

This feature provides setting options for enabling and disabling Webex and Microsoft 365 telemetry from the Cloud OnRamp for SaaS monitoring dashboard in Cisco SD-WAN Manager.

Secure Service Edge Support for Cloud OnRamp for SaaS

Cisco IOS XE Catalyst SD-WAN Release 26.1.1

Cisco Catalyst SD-WAN Manager Release 26.1.1

This feature extends Cloud OnRamp for SaaS support to Secure Service Edge (SSE) tunnel.

With this feature you can access SaaS applications securely, and automatically select the best SSE tunnel for accessing the SaaS applications.

DNS resolver prioritization

Cisco IOS XE Catalyst SD-WAN Release 26.1.1

Refinement of the DNS resolver prioritization for application traffic subjected to Cloud OnRamp for SaaS, when using Cisco Umbrella Connector or data policy Redirect DNS.

Information About Cloud OnRamp for SaaS

Cloud OnRamp for SaaS can determine the best network path for each type SaaS application, also called cloud application, traffic. Select specific SaaS applications and Cloud OnRamp for SaaS identifies the best traffic paths for each of the SaaS applications.

Benefits

An organization with multiple branch offices can use Cloud OnRamp for SaaS to ensure that SaaS application traffic at each office uses the most efficient path. Using the most efficient path ensures that the employees at different locations experience consistent and high-quality access to cloud services such as Microsoft Office 365, Salesforce, or Google Workspace.

User-defined probe endpoints for applications

User-defined probe endpoint support is an enhancement that:

  • enables adding probe endpoint details directly to applications in the Application Catalog,

  • enables any application in the Application Catalog having probe endpoint details to be considered capable of cloud monitoring and/or steering through the best path using Cloud SLA action,

  • provides a distinct view of user-defined cloud application lists and all application lists in the guided workflow, and

  • simplifies the creation and deployment of application lists with applications having a common user-defined endpoint through a guided workflow.

Cloud OnRamp for SaaS capable applications

An application in Application Catalog that includes endpoint details is capable of supporting:

  • Cloud Monitoring: Enabling detailed visibility and monitoring of these applications, and

  • Cloud SLA: Ensuring that applications are steered through the best path computed with cloud monitoring.

A Cloud OnRamp for SaaS capable application list includes the following types of application lists:

  • Default cloud application lists: 14 predefined application groups with predefined endpoints.

  • User-defined cloud application lists: Application lists with applications that have common user-defined endpoints.

To use Cloud OnRamp SaaS capable application lists in policy groups, see the following procedures:

Telemetry settings for Microsoft 365 and Webex

Telemetry settings option for Microsoft 365 allows you to enable or disable the application telemetry sharing with Cisco SD-WAN for rich application telemetry visualization and optionally to influence the Cloud OnRamp for SaaS Microsoft 365 best path selection.

Telemetry settings option for Webex allows you to enable or disable the application telemetry sharing with Cisco SD-WAN from Webex for rich application telemetry visualization.

Benefits

  • Telemetry settings option allows you to independently enable or disable the application telemetry for Microsoft and Webex applications irrespective of whether these applications are enabled for Cloud OnRamp for SaaS optimization.

Secure Service Edge Support

Secure Service Edge (SSE) support on Cloud OnRamp for SaaS is a network solution that

  • enables secure access to SaaS applications over SSE tunnels at SD-WAN sites, and

  • allows Cisco IOS XE Catalyst SD-WAN devices to probe multiple SSE tunnels and identify the best SSE tunnel to reach the application server, and

For more information about Secure Service Edge with Cisco Catalyst SD-WAN, see Integrate Your Devices with Secure Service Edge .

DNS resolver prioritization for traffic

From Cisco IOS XE Catalyst SD-WAN Release 26.1.1, this is how the DNS resolver prioritizes application traffic when Cloud OnRamp for SaaS is operating:

  • A data policy that redirects DNS traffic, such as configured with the redirect-dns command, overrides Cloud OnRamp for SaaS DNS redirection.

  • The Umbrella Connector DNS Resolver, which can be configured with the parameter-map command, performs its functions on DNS packets as configured. However, with Cloud OnRamp for SaaS operating, Umbrella Connector DNS Resolver does not route DNS packets, and the DNS packets use the best path as determined by Cloud OnRamp for SaaS.

Prerequisites for Cloud OnRamp for SaaS

  • To enable Cloud OnRamp for SaaS for Webex and Microsoft Office 365 applications, ensure that Cisco SD-AVC is enabled (Administration > Cluster Management).

    Enable Cisco SD-AVC and cloud services.

    For Cisco Catalyst SD-WAN Manager Release 20.16.1 and earlier, enable cloud services in Cisco Catalyst SD-WAN. This also enables the Cisco SD-AVC Cloud Connector. For information on how to enable SD-AVC on SD-WAN Manager, see Enable SD-AVC for Cisco SD-WAN devices.

    Starting from Cisco Catalyst SD-WAN Manager Release 20.18.1, Cisco SD-AVC is enabled by default in SD-WAN Manager.

  • To enable Cloud OnRamp for SaaS for Webex, verify that SD-WAN Manager can reach this domain:

    https://info.net-int.infra.webex.com/v1/prefixes/regions

Restrictions for Cloud OnRamp for SaaS, General

Maximum supported applications

A Cloud OnRamp for SaaS capable application list supports maximum eight applications with common endpoint. A device supports maximum of eight user-defined application lists.

Support for SIG tunnels only

Supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.18.x and earlier

If you choose Cloud OnRamp for SaaS capable applications under Internet Offload Traffic to Secure Internet Gateway, it is supported only with the SIG tunnels.

DNS traffic handling

As a general policy restriction not specific to Cloud OnRamp for SaaS, data policy does not support both of these conditions together:

  • Data policy redirecting DNS traffic to Umbrella

  • Secure Internet Gateway (SIG) configured

This restriction is relevant when considering the DNS resolver prioritization for application traffic in the context of Cloud OnRamp for SaaS.

Restrictions for Service VPN Gateway Mode

When you change the VPN settings of the service-VPN DIA interface, and Cloud OnRamp for SaaS is running in service-VPN Gateway mode, Cloud OnRamp for SaaS fails to work with the new service-VPN settings. The system continues to display stale data from the previous service-VPN setting for up to 10 minutes following the change and there is no data for the new service-VPN settings.

To prevent the issue, perform the following steps:

  1. Detach the site from Cloud OnRamp for SaaS sites.

  2. Update the VPN settings for the desired DIA interface on the Interface Configuration page.

  3. Re-attach the site to Cloud OnRamp for SaaS as a service-VPN Gateway site.

Configure Cloud OnRamp for SaaS Using a Workflow

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Workflows > Workflow Library > Cloud OnRamp for SaaS.

Starting from Cisco Catalyst SD-WAN Manager Release 20.18.1, the application list displays separate lists for default cloud application lists and user-defined cloud application lists. Additionally, there is a tab that displays all available applications.

Step 2

Follow the on-screen instructions to complete the workflow.

Starting from Cisco Catalyst SD-WAN Manager Release 20.18.1, you have the following options:

  • In the Select application lists step of the workflow, you can use + Add application list for the following:

    • Create user-defined list with applications having a common probe endpoint. For more information about defining a probe endpoint, see Add a user-defined endpoint to applications.

    • Create custom applications with probe endpoints and associate the newly created applications in a new user-defined cloud application list.

      To create an inline custom application list with applications having a probe endpoint, follow these steps:

      1. Click on the Applications with probe endpoint dropdown.

      2. Click +Add Custom Application and fill the required fields.

        For more information about configuring a custom application with endpoint, see Configure Custom Applications.

  • In the Select Policy step of the workflow, you can view the devices associated with the policy group and review their update status.

Step 3

When the workflow is complete, you'll be prompted with a success screen to add policies to a policy group or associate devices with the policy groups or deploy the policy groups to the devices.

Add SaaS Applications Using Policy Groups

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Policy Groups > Application Priority & SLA.

  2. Create a new Application Priority & SLA or edit an existing Application Priority & SLA.

    For more information, see Application Priority & SLA.


    Note

    Use either Secure Internet Gateway or Direct Internet Access to choose an Cloud OnRamp for SaaS capable appication list.

    Starting from Cisco Catalyst SD-WAN Manager Release 20.18.1, the following scenarios occur depending on whether the application list is Cloud OnRamp for SaaS capable or not Cloud OnRamp for SaaS capable.

    • If the application list is Cloud OnRamp for SaaS capable, a cloud SaaS sequence is generated for that application list.

    • If the application list is not Cloud OnRamp for SaaS capable, the application list has NAT DIA or SIG configuration.

  3. If you are an advanced user, switch to the Advanced Layout and configure Cloud OnRamp for SaaS. For more information, see Advanced Layout.


    Note

    • Choose Cloud OnRamp for SaaS applications from the Application (Lists) drop-down list in the Match field. For more information on match conditions, refer to Configure Traffic Rules.

    • Choose Cloud Monitoring and Cloud SLA as Action conditions. For more information on action conditions, refer to Configure Traffic Rules.


    Note

    In the Advanced Layout, if you choose an application list that is Cloud OnRamp for SaaS capable and add cloud SaaS actions to the sequence, Cisco SD-WAN Manager generates corresponding App-route policy sequence and Cloud OnRamp for SaaS probe configuration for Cisco IOS XE Catalyst SD-WAN edge device.

    If you choose an application list that is not Cloud OnRamp for SaaS capable and add cloud SaaS actions, a warning message appears when you save the configuration. The message informs you that the application list contains applications that are not Cloud OnRamp for SaaS capable. This implies that some applications in the application list have no endpoints or have different endpoints.

    The Cloud OnRamp for SaaS probe configuration for this application list is not generated in the Cisco IOS XE Catalyst SD-WAN edge device.

Deploy SaaS Applications Using Policy Groups

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Policy Groups > Application Priority & SLA. The application priority you just created appears here in the list.

  2. In the Policy Group tab, choose a policy group to deploy. Choose the respective application priority from the drop-down list.

    • When you've included Cloud OnRamp for SaaS applications in the policy group, the deploy workflow provides options to choose device variables such as Site Type, TLOC. Cisco SD-WAN Manager populates these fields with default values.

    • Enable Secure Internet Gateway (SIG) Interface if you want to secure your internet gateway.

    • Select Enable Load Balancing to balance the traffic using cloud SaaS probe.

    • Starting from Cisco Catalyst SD-WAN Manager Release 20.18.1, choose None to remove the probe configuration from the applications for a selected site. This option is useful when there are multiple sites associated to a policy group. It allows you to remove the Cloud OnRamp for SaaS capability on specific sites by removing the Cisco SD-WAN Edge probe configuration.

    • From Cisco IOS XE Catalyst SD-WAN Release 26.1.1, you can select the Secure Service Edge (SSE) Interface for secure internet access. Here you can select all SSE tunnels or a specific SSE tunnel.

      Ensure that the Secure Access feature is part of a policy group and is deployed before you configure it for Cloud OnRamp for SaaS, especially if you choose a specific SSE tunnel. If you select a specific SSE tunnel, deploy the Secure Access feature first. If you select all SSE tunnels, you can deploy the policy group together with the Cloud OnRamp for SaaS configurations.

      The SSE interface list displays the SSE tunnels linked to the configured Secure Internet Access feature. Each device can be associated with only one SSE instance, and all devices within the same site must use the same SSE instance.

    For information about deploying policy groups, see Deploy Policy Groups Workflow.

  3. Click Deploy.

Add a user-defined endpoint to applications

You can add or remove endpoint details for any application in the application catalog using the following procedure.

Before you begin

Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.18.1 and Cisco IOS XE Catalyst SD-WAN Release 17.18.1a

Procedure

Step 1

If..

Then..

You want to add endpoint details for an existing application, which also includes custom applications.

From the Cisco SD-WAN Manager menu, choose Configuration > Application Catalog > Applications.

You want to create a custom application with endpoint details.

From the Cisco SD-WAN Manager menu, choose Configuration > Application Catalog > Custom Application.

Step 2

Follow one of the following procedures to add probe endpoint for an application or multiple applications:

  1. To add or edit endpoint details for an existing application, click the ellipsis icon (...) next to the application under Action and click Edit.

    Note

     

    If you edit an application list or applications in an application list, you must save the Application Priority and SLA policy again.

  2. (Optional) To create a custom application with endpoint details, click Custom Application.

    To create a custom application with endpoint details, click Custom Application and follow the steps mentioned here. After defining the custom application, you can choose to add the endpoint details for it. For more information, see Configure Custom Applications.

    Note

     
    For custom applications, to prevent packet loss, do one of the following:

    • Add a valid traffic class and business relevance while entering endpoint details on the Application Catalog page. This is the most preferable option.

    • Switch to Advanced layout and add data policy sequences.

    • Change the policy’s default action to "accept."
    This action prevents packets from being dropped if you choose the simple layout in Application Policy and SLA with the default action set to "drop".

Alternately, do the following:

  1. Choose an application or multiple applications from the application list to add a user-defined endpoint. You can also filter specific applications using the Search field.

  2. Click Define Probe Endpoint.

    The applications that you choose are added to the Selected Application(s) area, which shows each application.

Step 3

In the SaaS probe endpoint type area, choose an endpoint type from the following options:

  • IP Address: Enter an IP address. Cloud OnRamp for SaaS probes the server using port 80.
  • FQDN: Enter a fully qualified domain name.

  • URL: Enter a URL using HTTP or HTTPS. Cloud OnRamp for SaaS probes the server using port 80 or port 443, depending on the URL provided.

Step 4

In SaaS probe endpoint value field, enter an endpoint value, based on the endpoint type that you choose.

Example:

192.168.0.1, https://www.example.com, www.google.com

Step 5

Click Save.

(Optional) After adding endpoint details, you can also remove them. To remove the endpoint details of an application, click the ellipsis icon (...) next to the application under Action and click Edit. Navigate to the SaaS probe endpoint value area and remove the value field. Ensure you save the changes.

Enable telemetry settings for Microsoft 365 and Webex

Follow these steps to enable telemetry settings for:

  • Microsoft 365

  • Webex

Before you begin

  • Ensure that SD-AVC is enabled.

  • Enable Cloud Services.

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for SaaS.

Step 2

Click Telemetry settings.

Step 3

Enable Webex telemetry.

  1. Enter the client ID and client secret for the Webex telemetry integration.

Step 4

Enable Microsoft 365 telemetry.

  1. Enable telemetry pull from and push to Microsoft to receive traffic metrics for Microsoft 365 traffic.

  2. Enable Traffic steering to allow Cloud OnRamp for SaaS to incorporate Microsoft telemetry data to influence the best path decision.

Step 5

Click Apply.

Monitor Cloud OnRamp for SaaS

Procedure

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for SaaS.

The Application Snapshots section displays information such as the number of active sites, and device health.

Step 2

To view the applications that Cloud OnRamp for SaaS is monitoring, click the Sites tab.

Table 2. Site Information

Field

Description
Site Name

Site name.
Sites List

Site list that the site is associated with.
Device Name

Device name.
Monitored Applications

Monitored applications.
Site Role

Site role.

The view options include showing only active or inactive sites.

Step 3

To view the details of a site, click site name.

Table 3. Site Details

Field

Description
Application

Application associated with the site.
vQoE Status

vQoE Status. A green circle with a tick indicates that vQoE is good, the status with ! indicates that the vQoE needs some attention, and red X indicates that the vQoE is poor.

vQoE Score

vQoE score. Click the score to view detailed charts about the score.
DIA (Dedicated Internet Access) Status

Interface providing the best path for the cloud application.
Selected Interfaces

List of interfaces associated with the application.
Activated Gateways

For a site that connects to the internet through a gateway site, this indicates the IP address of the gateway site.
Local color

For a site that connects to the internet through a gateway site, this is the local color identifier of the tunnel used to connect to the gateway site.

Remote color

For a site that connects to the internet through a gateway site, this is the remote (gateway site) color identifier of the tunnel used to connect to the gateway site.

Application Usage

You can apply filters to view the specific types of data.

Step 4

To view configuration details, such as the configuration source, policy, number of devices, and so on, click the Configuration tab.

Viewing the DNS resolver for application traffic, using CLI commands

Use the show sdwan app-fwd cflowd flows command on a device to view the DNS resolver (shown as dest-ip) for the application traffic on the device. This command helps to identify the chosen DNS server and the egress interface for each application's DNS requests.

In this example, the output indicates that the google-services DNS request is sent to DNS-server 8.8.8.8, egressing on GigabitEthernet5.

Device# show sdwan app-fwd cflowd flows
app-fwd cflowd flows vpn 1 src-ip 10.2.2.11 dest-ip 8.8.8.8 src-port 36342 dest-port 53 dscp 63 ip-proto 1
 tcp-cntrl-bits           0
 icmp-opcode              2048
 total-pkts               1
 total-bytes              56
 start-time               "Wed Jan 21 02:57:23 2026"
 egress-intf-name         GigabitEthernet5
 ingress-intf-name        GigabitEthernet1
 application              google-services

Migrate Older Cloud OnRamp for SaaS Path Selection

If you have enabled Cloud OnRamp for SaaS best path selection using the Application and Policy page before Cisco Catalyst SD-WAN Manager Release 20.15.1, you must perform the following procedure to configure these applications using the Cloud OnRamp for SaaS workflow:

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for SaaS > Configuration.

  2. The first entry in the configuration tab shows the old app route policies in your Cisco SD-WAN Manager named as Template Config.

  3. In the Actions column, click ... and choose Gateways.

  4. Choose the respective Site id and click Detach Gateways.

  5. Follow the same instructions to detach Applications and Policy, Client Sites, DIA Sites, and Custom Application Lists.

  6. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

  7. On the Device Templates page, click ... adjacent to the device and choose the Detach Devices option next to the respective device template to detach the device.

  8. Configure the device using Configuration Groups. For more information, see Configuration Groups.

  9. Follow the instructions to access the Cloud OnRamp for SaaS workflow and deploy using policy groups. For more information, see Deploy policy group.