Configure VPN ethernet interface

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

Create and configure a Transport VPN feature in Transport and Management profile.

Create and configure Ethernet Interface feature in Transport VPN.

1. Configure basic VPN parameters.

   Field	Description
   Shutdown	Enable or disable the interface.
   Interface Name*	Enter a name for the interface. Spell out the interface names completely (for example, GigabitEthernet0/0/0). Configure all the interfaces of the router, even if you are not using them, so that they are configured in the shutdown state and so that all default values for them are configured.
   Description	Enter a description for the interface.
   Auto Detect Bandwidth	Enable this option to automatically detect the bandwidth for WAN interfaces. The device detects the bandwidth by contacting an iPerf3 server to perform a speed test.
   IPv4 Settings	Configure an IPv4 VPN interface. Dynamic: Choose Dynamic to set the interface as a Dynamic Host Configuration Protocol (DHCP) client so that the interface receives its IP address from a DHCP server. Static: Choose Static to enter an IP address that doesn't change.
   Dynamic DHCP Distance	Enter an administrative distance value for routes learned from a DHCP server. This option is available when you choose Dynamic. Default: 1
   IP Address	Enter a static IPv4 address. This option is available when you choose Static.
   Subnet Mask	Enter the subnet mask. From Cisco Catalyst SD-WAN Control Components Release 20.15.1, if you enter a variable in the IP Address field, this field automatically uses a variable.
   Configure Secondary IP Address	Enter up to four secondary IPv4 addresses for a service-side interface. IP Address: Enter the IP address. Subnet Mask: Enter the subnet mask.
   DHCP Helper	To designate the interface as a DHCP helper on a router, enter up to eight IP addresses, separated by commas, for DHCP servers in the network. A DHCP helper interface forwards BOOTP (broadcast) DHCP requests that it receives from the specified DHCP servers.
   IPv6 Settings	Configure an IPv6 VPN interface. Dynamic: Choose Dynamic to set the interface as a Dynamic Host Configuration Protocol (DHCP) client so that the interface receives its IP address from a DHCP server. Static: Choose Static to enter an IP address that doesn't change. None
   IPv6 Address Primary	Enter a static IPv6 address. This option is available when you choose Static.
   Add Secondary Ipv6
   IP Address	Enter up to two secondary IPv6 addresses for a service-side interface.
   Bandwidth Upstream	Enter upstream bandwidth reference value.
   Bandwidth Downstream	Enter downstream bandwidth reference value.

2. Apply Access Lists and QoS Parameters

   Field	Description
   Adaptive QoS	To enable or disable adaptive QoS on an ethernet interface on the transport side.
   Shaping Rate	Enter the shaping rate to control the maximum rate of traffic sent.
   ACL	To define IPv4 and IPv6 ACL as ingress and egress.

3. Create a tunnel interface.

   Field	Description
   Tunnel Interface	Enable this option to create a tunnel interface.
   Per-tunnel QoS	Enable this option to apply a Quality of Service (QoS) policy on individual tunnels.
   Color	Choose a color for the TLOC.
   Color Description	Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.18.1 Enter a description associated to the TLOC color.
   Restrict	Enable this option to limit the remote TLOCs that the local TLOC can establish BFD sessions with. When a TLOC is marked as restricted, a TLOC on the local router establishes tunnel connections with a remote TLOC only if the remote TLOC has the same color.
   Groups	Enter a group number. Range: 1 through 4294967295
   Border	Enable this option to set the TLOC as a border TLOC.
   Maximum Control Connections	Specify the maximum number of Cisco SD-WAN Controllers that the WAN tunnel interface can connect to. To have the tunnel establish no control connections, set the number to 0. Range: 0 through 100 Default: 2
   Validator As Stun Server	Enable Session Traversal Utilities for NAT (STUN) to allow the tunnel interface to discover its public IP address and port number when the Cisco IOS XE Catalyst SD-WAN device is located behind a NAT.
   Exclude Controller Group List	Set the identifiers of one or more Cisco SD-WAN Controller groups that this tunnel is not allowed to connect to. Range: 1 through 100
   Manager Connection Preference	Set the preference for using a tunnel interface to exchange control traffic with Cisco SD-WAN Manager. Range: 0 through 8 Default: 5
   Full Port Hop	Minimum release: Cisco IOS XE Catalyst SD-WAN Release 17.18.1a Enable full port hopping at the TLOC level to allow devices to establish connections with controllers by switching to the next port if the current port is blocked or non-functional. Default: Disabled
   Port Hop	Enable port hopping. If port hopping is enabled globally, you can disable it on an individual TLOC (tunnel interface). Default: Enabled Starting from Cisco IOS XE Catalyst SD-WAN Release 17.18.1a, this field is deprecated. Instead use the Full Port Hop option. See the Full Port Hop field.
   Low-Bandwidth Link	Enable this option to characterize the tunnel interface as a low-bandwidth link.
   Tunnel TCP MSS	Specify the maximum segment size (MSS) of TPC SYN packets passing through the router. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented. Range: 500 to 1460 bytes Default: None
   Clear-Dont-Fragment	Enable this option to clear the Don't Fragment (DF) bit in the IPv4 packet header for packets being transmitted out the interface. When the DF bit is cleared, packets larger than the MTU of the interface are fragmented before being sent.
   CTS SGT Propagation	Enable CTS SGT propagation on an interface.
   Network Broadcast	Enable this option to accept and respond to network-prefix-directed broadcasts.
   Allow Service	Allow or disallow the following services on the interface: All BGP DHCP NTP SSH DNS ICMP HTTPS OSPF STUN SNMP NETCONF BFD
   Encapsulation
   Encapsulation*	Choose an encapsulation type: gre: Use GRE encapsulation on the tunnel interface. ipsec: Use IPsec encapsulation on the tunnel interface. Note If you select both IPsec and GRE encapsulations, two TLOCs are created for the tunnel interface that have the same IP addresses and colors, but that differ by their encapsulation. When you choose gre, the following fields appear: GRE Preference: Enter a preference value for directing traffic to the tunnel. A higher value is preferred over a lower value. Range: 0 through 4294967295 Default: 0 GRE Weight: Enter a weight to use to balance traffic across multiple TLOCs. A higher value sends more traffic to the tunnel. Range: 1 through 255 Default: 1 When you choose ipsec, the following fields appear: IPSEC Preference: Enter a preference value for directing traffic to the tunnel. A higher value is preferred over a lower value. Range: 0 through 4294967295 Default: 0 IPSEC Weight: Enter a weight to use to balance traffic across multiple TLOCs. A higher value sends more traffic to the tunnel. Range: 1 through 255 Default: 1
   Multi-Region Fabric Note These options appear only when Multi-Region Fabric is enabled.
   Connect to Core Region	(Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.13.1) (Applicable to a border router only) In a Multi-Region Fabric scenario, enable this option to specify how to use the Ethernet interface: Share Interface with Access Region: Share the interface between the access region and core region. Keep Exclusive to Core Region: Use the interface only for the core region.
   Connect to Secondary Region	(Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.13.1) (Applicable to an edge router only) In a Multi-Region Fabric scenario, enable this option to specify how to use the Ethernet interface: Share Interface with Access Region: Share the interface between the primary and secondary regions. Keep Exclusive to Secondary Region: Use the interface only for the secondary region.

4. Configure an interface as a NAT device.

   Field	Description
   IPv4 Settings
   NAT	Enable this option to have the interface act as a NAT device.
   NAT Type	Choose the NAT translation type for IPv4: interface pool loopback Default: interface. It is supported for NAT64.
   UDP Timeout	Specify when NAT translations over UDP sessions time out. Range: 1 through 8947 minutes Default: 1 minute
   TCP Timeout	Specify when NAT translations over TCP sessions time out. Range: 1 through 8947 minutes Default: 60 minutes (1 hour)
   Add Multiple NAT	Choose the NAT type: Interface: This is the default value. Pool: Configure the following: Pool ID: Enter a NAT pool number configured in the centralized data policy. The NAT pool name must be unique across VPNs and VRFs. You can configure up to 31 (1–32) NAT pools per router. Range Start: Enter a starting IP address for the NAT pool. Range End: Enter a closing IP address for the NAT pool. Prefix length: Specify the maximum number of source IP addresses that can be NATed in the NAT pool. Overload: Enable this option to configure per-port translation. If this option is disabled, only dynamic NAT is configured on the end device. Per-port NAT is not configured. Default: Disabled Loopback: Provide a value for the NAT inside source loopback interface.
   Configure New Static NAT	Add a static NAT mapping
   Source IP	Enter the source IP address to be translated.
   Translate IP	Enter the translated source IP address.
   Direction	Choose the direction in which to perform network address translation. inside: Translates the IP address of packets that are coming from the service side of the device and that are destined for the transport side of the router. outside: Translates the IP address of packets that are coming to the device from the transport side device and that are destined for a service-side device.
   Source VPN	Enter the source VPN ID.
   IPv6 Settings
   IPv6 NAT	Enable this option to have the interface act as a NAT device.
   Select NAT	Choose NAT64 or NAT66. When you choose NAT66, the following fields appear: Source Prefix: Enter the source IPv6 prefix. Translated Source Prefix: Enter the translated source prefix. Source VPN ID: Enter the source VPN ID. Egress Interface: Enable this option to have the interface act as an egress interface.

5. Add ARP table entries.

   Field	Description
   IP Address	Enter the IP address for the ARP entry in dotted decimal notation or as a fully qualified host name.
   MAC Address	Enter the MAC address in colon-separated hexadecimal notation.

6. Configure advanced properties.

   Field	Description
   Duplex	Specify whether the interface runs in full-duplex or half-duplex mode. Default: full
   MAC Address	Specify a MAC address to associate with the interface, in colon-separated hexadecimal notation.
   IP MTU	Specify the maximum MTU size of packets on the interface. Range: 576 through 9216 Default: 1500 bytes
   Interface MTU	Enter the maximum transmission unit size for frames received and transmitted on the interface. Range: 1500 through 1518 (GigabitEthernet0), 1500 through 9216 (other GigabitEthernet) Default: 1500 bytes
   TCP MSS	Specify the maximum segment size (MSS) of TPC SYN packets passing through the router. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented. Range: 500 to 1460 bytes Default: None
   Speed	Specify the speed of the interface, for use when the remote end of the connection does not support autonegotiation. Values: 10, 100, 1000, 2500, or 10000 Mbps
   ARP Timeout	ARP timeout controls how long we maintain the ARP cache on a router. Specify how long it takes for a dynamically learned ARP entry to time out. Range: 0 through 2147483 seconds Default: 1200 seconds
   Autonegotiate	Enable this option to turn on autonegotiation.
   Media Type	Specify the physical media connection type on the interface. Choose one of the following: auto-select: A connection is automatically selected. rj45: Specifies an RJ-45 physical connection. sfp: Specifies a small-form factor pluggable (SFP) physical connection for fiber media.
   TLOC Extension	Enter the name of a physical interface on the same router that connects to the WAN transport. This configuration then binds this service-side interface to the WAN transport. A second router at the same site that itself has no direct connection to the WAN (generally because the site has only a single WAN connection) and that connects to this service-side interface is then provided with a connection to the WAN. Note TLOC extension over L3 is supported only for Cisco IOS XE Catalyst SD-WAN devices. If configuring TLOC extension over L3 for a Cisco IOS XE Catalyst SD-WAN device, enter the IP address of the L3 interface.
   GRE tunnel source IP	Enter the IP address of the extended WAN interface.
   XConnect	Enter the name of a physical interface on the same router that connects to the WAN transport.
   Load Interval	Enter an interval value for interface load calculation.
   IP Directed Broadcast	An IP directed broadcast is an IP packet whose destination address is a valid broadcast address for some IP subnet, but which originates from a node that is not itself part of that destination subnet. A device that is not directly connected to its destination subnet forwards an IP directed broadcast in the same way it would forward unicast IP packets destined to a host on that subnet. When a directed broadcast packet reaches a device that is directly connected to its destination subnet, that packet is broadcast on the destination subnet. The destination address in the IP header of the packet is rewritten to the configured IP broadcast address for the subnet, and the packet is sent as a link-layer broadcast. If directed broadcast is enabled for an interface, incoming IP packets whose addresses identify them as directed broadcasts intended for the subnet to which that interface is attached are broadcast on that subnet.
   ICMP Redirect Disable	ICMP redirects are sent by a router to the sender of an IP packet when a packet is being routed sub-optimally. The ICMP redirect informs the sending host to forward subsequent packets to that same destination through a different gateway. By default, an interface allows ICMP redirect messages.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

Create and configure Prefix List for VRRP in a Policy Object Profile.

1. Choose the Prefix policy object from the Select Policy Object drop-down list.
2. Enter the Prefix List Name.
3. In the Internet Protocol field, click IPv4 or IPv6.
4. Under Add Prefix, enter the prefix for the list. Optionally, click the Choose a file link to import a prefix list.
5. Click Save.

   The following table describe the options for configuring the prefix.

   Table 1. Prefix List

   Field	Description
   Prefix List Name	Enter a name for the prefix list.
   Internet Protocol	Specifies the internet protocol. The options are IPv4 and IPv6.