Cisco Catalyst SD-WAN High Availability Configuration Guide, Releases 26.x and Later

Configure the resilient data plane

Updated: October 14, 2026

Want to summarize with AI?

Configures resilient branch-to-hub connectivity by using the CLI on the hub and branch Cisco IOS XE Catalyst SD-WAN devices.

Cisco SD-WAN Manager configuration is not supported. Configure the hub before you configure the branch device.

Procedure

Configure a resilient data plane hub.

See Configure a resilient data plane hub.
Configure a resilient data plane spoke.

See Configure a resilient data plane spoke.
Configure a resilient tunnel.

See Configure a resilient tunnel.

Configure a resilient data plane hub

The following configuration is organized by function. The information for each step explains the purpose of the configuration and identifies the example values that you must customize for your deployment.

Note

Maintain consistent names and values wherever an object is referenced by another configuration block.

Procedure

Configure network authorization.
IKEv2 uses network authorization when it applies the authorization policy defined later in this configuration. This example uses the default AAA method list and the local authorization source. Customize the method list and authorization source to match your AAA design.
```
aaa authorization network default local
```
Configure route filtering and tagging policies.
The prefix list identifies resilient-tunnel infrastructure routes. The route maps prevent these routes from being advertised as service routes and tag routes learned through the resilient path. Customize the prefix, route-map names, and tag value. If you change a name or tag, update every configuration statement that references it.
```
ip prefix-list TUNNEL-SUBNETS seq 5 permit 172.16.0.0/16 le 32
!
route-map TO-SPOKES deny 10
  match ip address prefix-list TUNNEL-SUBNETS
route-map TO-SPOKES permit 20
!
route-map OMP-TO-BGP deny 5
  match ip address prefix-list TUNNEL-SUBNETS
route-map OMP-TO-BGP permit 10
  set tag 9999
route-map OMP-TO-BGP permit 20
!
route-map RESILIENT-IN permit 10
  set tag 9999
```
Configure the IKEv2 proposal, policy, and spoke keyring.
These objects define the IKEv2 cryptographic parameters and authenticate the spoke. Replace 200.100.1.164 with the spoke tunnel-source address and replace <resilient-tunnel-psk> with the shared secret configured on the spoke. Customize the cryptographic algorithms and object names if required by your security policy, and use the same names in subsequent references.
```
crypto ikev2 proposal IKEV2-PROP
  encryption aes-cbc-256
  integrity sha256
  group 14
crypto ikev2 policy IKEV2-POLICY
  proposal IKEV2-PROP
!
crypto ikev2 keyring IKEV2-KEYRING
  peer SPOKE-PEER-0
    address 200.100.1.164
    pre-shared-key local <resilient-tunnel-psk>
    pre-shared-key remote <resilient-tunnel-psk>
  !
!
```

Configure the IPsec transform set and IKEv2 authorization and security profiles.

The transform set defines IPsec protection. The IKEv2 authorization policy assigns the hub loopback interface and accepts routes from the spoke. The IKEv2 and IPsec profiles bind the security objects to the dynamic tunnel. Customize the transform set and profile names, hub tunnel-source address 200.100.1.118, loopback interface ID, virtual-template ID, and authentication settings to match your deployment.

crypto ipsec transform-set IPSEC-TS esp-aes 256 esp-sha256-hmac
  mode tunnel
!
crypto ikev2 authorization policy IKEV2-AUTH-T20
  route set interface Loopback20
  route accept any
!
crypto ikev2 profile IKEV2-PROFILE-T20
  match identity remote any
  identity local address 200.100.1.118
  authentication local pre-share
  authentication remote pre-share
  keyring local IKEV2-KEYRING
  aaa authorization group list default IKEV2-AUTH-T20
  virtual-template 20
!
crypto ipsec profile IPSEC-PROFILE-T20
  set ikev2-profile IKEV2-PROFILE-T20
  set transform-set IPSEC-TS

Configure the hub tunnel interfaces.
The loopback interface provides the hub tunnel address. The virtual template supplies the service VRF and IPsec settings for dynamically created spoke tunnels. Customize the loopback and virtual-template IDs, service VRF 1, tunnel address 172.16.20.1/32, TCP maximum segment size, and IPsec profile name.
```
interface Loopback20
  vrf forwarding 1
  ip address 172.16.20.1 255.255.255.255
!
interface Virtual-Template20 type tunnel
  vrf forwarding 1
  ip unnumbered Loopback20
  ip tcp adjust-mss 1360
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile IPSEC-PROFILE-T20
```

Configure BGP route exchange with the spokes.

BGP dynamically accepts spoke neighbors, exchanges service routes across the resilient tunnels, and applies the filtering and tagging policies. Customize the hub autonomous system number 65005, BGP listen range, spoke autonomous system number 65011, service VRF, peer-group name, and route-map names.

router bgp 65005
  bgp log-neighbor-changes
  bgp listen range 172.16.20.0/24 peer-group PG-65011
  address-family ipv4 vrf 1
    neighbor PG-65011 peer-group
    neighbor PG-65011 remote-as 65011
    neighbor PG-65011 ebgp-multihop 2
    neighbor PG-65011 activate
    neighbor PG-65011 route-map RESILIENT-IN in
    neighbor PG-65011 route-map TO-SPOKES out
    neighbor PG-65011 send-community both
    redistribute connected route-map TO-SPOKES
    redistribute omp route-map OMP-TO-BGP
  exit-address-family

Advertise the hub routes to OMP.
This configuration advertises the permitted connected and BGP routes from the service VRF to the Cisco Catalyst SD-WAN overlay. Customize the service VRF and route-map name to match the BGP configuration.
```
sdwan
  omp
    address-family ipv4 vrf 1
      advertise connected route-map TO-SPOKES
      advertise bgp route-map TO-SPOKES
```

Configure a resilient data plane spoke

Note

Maintain consistent names and values wherever an object is referenced by another configuration block. The hub and spoke must use compatible IKEv2 and IPsec settings and matching pre-shared keys.

Procedure

Enable AAA and configure network authorization.
IKEv2 uses network authorization when it applies the authorization policy defined later in this configuration. This example enables AAA and uses the default AAA method list with the local authorization source. Customize the method list and authorization source to match your AAA design.
```
aaa new-model
aaa authorization network default local
```
Configure the IKEv2 proposal, policy, hub keyring, and IPsec transform set.
These objects define the cryptographic parameters and authenticate the hub. Replace 200.100.1.118 with the hub tunnel endpoint and replace <resilient-tunnel-psk> with the shared secret configured on the hub. Customize the cryptographic algorithms and object names if required by your security policy, and use the same names in subsequent references.
```
crypto ikev2 proposal IKEV2-PROP
  encryption aes-cbc-256
  integrity sha256
  group 14
crypto ikev2 policy IKEV2-POLICY
  proposal IKEV2-PROP
!
crypto ikev2 keyring IKEV2-KEYRING
  peer HUB-PEER
    address 200.100.1.118
    pre-shared-key local <resilient-tunnel-psk>
    pre-shared-key remote <resilient-tunnel-psk>
!
crypto ipsec transform-set IPSEC-TS esp-aes 256 esp-sha256-hmac
  mode tunnel
```

Configure route filtering and tagging policies.

The prefix list identifies resilient-tunnel infrastructure routes. The route maps prevent these routes from being advertised as service routes, tag routes learned through the resilient path, and prevent tagged resilient routes from being advertised to the LAN. Customize the prefixes, route-map names, and tag value. If you change a name or tag, update every configuration statement that references it.

ip prefix-list TUNNEL-SUBNETS permit 172.16.20.0/30
ip prefix-list TUNNEL-SUBNETS permit 172.16.0.0/16 le 32
!
route-map CONN-TO-BGP deny 10
  match ip address prefix-list TUNNEL-SUBNETS
route-map CONN-TO-BGP permit 20
!
route-map RESILIENT-IN permit 10
  set tag 9999
!
route-map TO-HUB deny 10
  match ip address prefix-list TUNNEL-SUBNETS
route-map TO-HUB permit 20
!
route-map TO-LAN deny 10
  match tag 9999
route-map TO-LAN deny 20
  match ip address prefix-list TUNNEL-SUBNETS
route-map TO-LAN permit 30

Configure the IKEv2 authorization policy and security profiles.

The authorization policy installs the remote tunnel address and accepts routes from the hub. The IKEv2 and IPsec profiles bind the authentication and encryption objects to the tunnel. Customize the remote tunnel address 172.16.20.2/32, hub identity address 200.100.1.118, spoke identity address 200.100.1.164, and security object names.

crypto ikev2 authorization policy IKEV2-AUTH-T20
  route set remote ipv4 172.16.20.2 255.255.255.255
  route accept any
!
crypto ikev2 profile IKEV2-PROFILE-T20
  match identity remote address 200.100.1.118 255.255.255.255
  identity local address 200.100.1.164
  authentication local pre-share
  authentication remote pre-share
  keyring local IKEV2-KEYRING
  aaa authorization group list default IKEV2-AUTH-T20
!
crypto ipsec profile IPSEC-PROFILE-T20
  set ikev2-profile IKEV2-PROFILE-T20
  set transform-set IPSEC-TS

Configure the resilient tunnel interface.

The tunnel interface carries service-VRF traffic to the hub and identifies the interface as a resilient tunnel. Customize the tunnel interface ID, description, service VRF, tunnel address, TCP maximum segment size, tunnel-source interface, hub destination address, and IPsec profile name.

interface Tunnel20
  description IKEv2-IPsec VRF1 resilient tunnel to hub
  vrf forwarding 1
  ip address 172.16.20.2 255.255.255.252
  ip tcp adjust-mss 1360
  tunnel source GigabitEthernet0/0/0
  tunnel destination 200.100.1.118
  tunnel mode ipsec ipv4
  tunnel sdwan-resilient
  tunnel protection ipsec profile IPSEC-PROFILE-T20

Configure BGP route exchange with the hub.

BGP exchanges service routes across the resilient tunnel and installs them with an administrative distance that is less preferred than OMP. Customize the spoke autonomous system number 65011, hub autonomous system number 65005, service VRF, hub neighbor address 172.16.20.1, tunnel interface, timers, administrative distance 253, and route-map names. Ensure that the administrative distance is unique for each resilient BGP neighbor in the service VRF and is greater than 251.

router bgp 65011
  bgp log-neighbor-changes
  address-family ipv4 vrf 1
    neighbor 172.16.20.1 remote-as 65005
    neighbor 172.16.20.1 ebgp-multihop 2
    neighbor 172.16.20.1 update-source Tunnel20
    neighbor 172.16.20.1 timers 10 30
    neighbor 172.16.20.1 activate
    neighbor 172.16.20.1 send-community both
    neighbor 172.16.20.1 route-map RESILIENT-IN in
    neighbor 172.16.20.1 route-map TO-HUB out
    distance 253 172.16.20.1 0.0.0.0
    redistribute connected route-map CONN-TO-BGP
    redistribute static
    redistribute omp
  exit-address-family

Configure a resilient tunnel

The tunnel sdwan-resilient command identifies the interface as a resilient tunnel.

Procedure

Configure the resilient tunnel interface.

interface Tunnel20
  tunnel sdwan-resilient
  ip vrf forwarding BRANCH-A
  tunnel source GigabitEthernet0/0/0
  tunnel destination <hub-ip>
  ikev2 profile RES-PROFILE

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.