Cisco Catalyst SD-WAN Interfaces Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Interfaces Configuration Guide, Releases 26.x and Later

Configure VPN interface multilink

Updated: April 24, 2026

Want to summarize with AI?

Log in

Guides the configuration of VPN interface multilink, detailing procedures for setup using configuration groups and templates to ensure efficient and scalable VPN interface deployment.

Use one of these methods to configure VPN interface multilink:

Follow these steps to configure VPN interface multilink using a configuration group.

Multilink Point-to-Point Protocol (MLP) is used to combine multiple physical links into a single logical connection, called an MLP bundle.

Use the VPN Interface Multilink feature to configure multilink interface properties for Cisco SD-WAN Manager devices.

Before you begin

On the Configuration > Configuration Groups page, choose SD-WAN as the solution type.

Procedure

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

  2. Create and configure VPN Interface Multilink in a service profile.

    1. Enter the basic configuration information.
      Table 1. Basic Configuration

      Parameter Name

      Description

      Interface Name

      Enter the name of the multilink interface.

      Multilink Group Number *

      Enter the number of the multilink group. It must be the same as the number you enter in the multilink interface name parameter.

      Range: 1 through 65535

      PPP Authentication Protocol

      Select the authentication protocol used by the multilink interface:

      • CHAP: Enter the hostname and password provided by your Internet Service Provider (ISP). hostname can be up to 254 characters.

      • PAP: Enter the username and password provided by your ISP. username can be up to 254 characters.

      • PAP and CHAP: Configure both authentication protocols. Enter the login credentials for each protocol. To use the same username and password for both, click Same Credentials for PAP and CHAP.

      Hostname *

      Enter hostname for PPP CHAP Authentication.

      CHAP Password *

      Enter password for PPP CHAP Authentication.

      IPv4 Address *

      To configure a static address, click Static and enter an IPv4 address.

      To set the interface as a DHCP client so that the interface to receive its IP address from a DHCP server, click Dynamic. You can optionally set the DHCP distance to specify the administrative distance of routes learned from a DHCP server.

      Default: 1

      Mask

      Choose a value for the subnet mask.

      IPv6 Address *

      To configure a static address for an interface in VPN 0, click Static and enter an IPv6 address.

      To set the interface as a DHCP client so that the interface to receive its IP address from a DHCP server, click Dynamic. You can optionally set the DHCP distance to specify the administrative distance of routes learned from a DHCP server. The default DHCP distance is 1. You can optionally enable DHCP rapid commit, to speed up the assignment of IP addresses.
    2. Enter multilink information
      Table 2. Multilink

      Parameter Name

      Description

      Add T1/E1 Interface

      T1

      Description

      Enter a description for the T1controller.

      Slot*

      Enter the number of the slot in slot/subslot/port format, where the T1 NIM is installed. For example, 0/1/0.

      Framing

      Enter the T1 frame type:

      • esf: Send T1 frames as extended superframes. This is the default.

      • sf: Send T1 frames as superframes. Superframing is sometimes called D4 framing.

      Clock Source

      Select the clock source:

      • line: Use phase-locked loop (PLL) on the interface. This is the default. When both T1 ports use line clocking and neither port is configured as the primary, by default, port 0 is the primary clock source and port 1 is the secondary clock source.

      • internal: Use the controller framer as the primary clock.

      Line Code

      Select the line encoding to use to send T1 frames:

      • ami: Use alternate mark inversion (AMI) as the linecode. AMI signaling uses frames grouped into superframes.

      • b8zs: Use bipolar 8-zero substitution as the linecode. This is the default. B8ZS uses frames that are grouped into extended superframes.

      Cable Length

      Select the cable length to configure the attenuation

      • short: Set the transmission attenuation for cables that are 660 feet or shorter.

      • long: Attenuate the pulse from the transmitter using pulse equalization and line buildout. You can configure a long cable length for cables longer that 660 feet.

      There is no default length.

      E1

      Description

      Enter a description for the E1 controller.

      Slot*

      Enter the number of the slot in slot/subslot/port format, where the E1 NIM is installed. For example, 0/1/0.

      Framing

      Enter the E1 frame type:

      • crc4: Use cyclic redundancy check 4 (CRC4). This is the default.

      • no-crc4: Do no use CRC4.

      Clock Source

      Select the clock source:

      • line: Use phase-locked loop (PLL) on the interface. This is the default. When both E1 ports use line clocking and neither port is configured as the primary, by default, port 0 is the primary clock source and port 1 is the secondary clock source.

      • internal: Use the controller framer as the primary clock.

      Line Code

      Select the line encoding to use to send E1 frames:

      • ami: Use alternate mark inversion (AMI) as the linecode.

      • hdb3: Use high-density bipolar 3 as the linecode. This is the default.

      Add Channel Group

      Channel Group

      To configure the serial WAN on the interface, enter a channel group number.

      Range: 0 through 30

      Time Slot

      To configure the serial WAN on the interface, enter a value for the timeslot.

      Range: 0 through 31

      Add New A/S Serial Interface

      Interface Name

      Enter the name of the serial interface.

      Description

      Enter a description for the serial interface.

      Bandwidth

      For transmitted traffic, set the bandwidth above which to generate notifications.

      Clock Rate

      Specify a value for the clock rate.

      Range: 1200 through 800000
    3. Enter tunnel information
      Table 3. Tunnel

      Parameter Name

      Description

      Color

      Choose a color for the TLOC.

      Color Description

      Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.18.1

      Enter a description associated to the TLOC color.

      Restrict

      Enable this option to drop packets when a tunnel to the service is unreachable.

      Groups

      Enter the list of groups in the field.

      Border

      From the drop-down list, select Global. Click On to set TLOC as border TLOC.

      Maximum Control Connections

      Specify the maximum number of Cisco SD-WAN Controllers that the WAN tunnel interface can connect to. To have the tunnel establish no control connections, set the number to 0.

      Range: 0 through 8

      Default: 2

      Validator As Stun Server

      Click On to enable Session Traversal Utilities for NAT (STUN) to allow the tunnel interface to discover its public IP address and port number when the router is located behind a NAT.

      Exclude Controller Group List

      Set the Cisco SD-WAN Controllers that the tunnel interface is not allowed to connect to.

      Range: 0 through 100

      Cisco SD-WAN Manager Connection Preference

      Set the preference for using a tunnel interface to exchange control traffic with Cisco SD-WAN Manager.

      Range: 0 through 8

      Default: 5

      Full Port Hop

      Minimum release: Cisco IOS XE Catalyst SD-WAN Release 17.18.1a

      Enable full port hopping at the TLOC level to allow devices to establish connections with controllers by switching to the next port if the current port is blocked or non-functional.

      Default: Disabled

      Port Hop

      From the drop-down list, select Global. Click Off to allow port hopping on tunnel interface.

      Default: On, which disallows port hopping on tunnel interface

      Starting from Cisco IOS XE Catalyst SD-WAN Release 17.18.1a, this field is deprecated. Instead use the Full Port Hop option. See the Full Port Hop field.

      Low-Bandwidth Link

      Click On to set the tunnel interface as a low-bandwidth link.

      Default: Off

      Network Broadcast

      From the drop-down list, select Global. Click On to accept and respond to network-prefix-directed broadcasts. Enable this parameter only if the Directed Broadcast is enabled on the LAN interface feature template.

      Default: Off

      Tunnel TCP MSS

      TCP MSS affects any packet that contains an initial TCP header that flows through the router. When configured, TCP MSS is examined against the MSS exchanged in the three-way handshake. The MSS in the header is lowered if the configured TCP MSS setting is lower than the MSS in the header. If the MSS header value is already lower than the TCP MSS, the packets flow through unmodified. The host at the end of the tunnel uses the lower setting of the two hosts. To configure TCP MSS, provide a value that is 40 bytes lower than the minimum path MTU.

      Specify the MSS of TPC SYN packets passing through the Cisco IOS XE Catalyst SD-WAN. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented.

      Range: 552 through 1460 bytes
    4. Enter ACL information.
      Table 4. ACL

      Parameter Name

      Description

      Ingress ACL - IPv4

      Enter the name of an IPv4 access list to packets being received on the interface.

      Egress ACL - IPv4

      Enter the name of an IPv4 access list to packets being transmitted on the interface.

      Igress ACL - IPv6

      Enter the name of an IPv6 access list to packets being received on the interface.

      Egress ACL - IPv6

      Enter the name of an IPv6 access list to packets being transmitted on the interface.
    5. Enter advanced information.
      Table 5. Advanced

      Parameter Name

      Description

      Shutdown

      Click No to enable the multilink interface.

      Description

      Enter a description for the multilink interface.

      PPP Authentication Type

      Select the type authentication from one of the following options.:

      • Unidirectional: The server initiates the authentication.

      • Bidirectional: Both the client and the server can initiate the authentication.

      TCP MSS

      Specify the maximum segment size (MSS) of TPC SYN packets passing through the Cisco Catalyst SD-WAN device. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented.

      Range: 500 through 1460 bytes

      Default: 536

      Disable Fragmentation

      Click On to disable fragmentation for PPP Multilink Protocol data units (PDUs).

      Fragment Max Delay

      Configure the delay between the transmission of fragments in a PPP Multilink Protocol link.

      Range: 0 through 1000

      Default: No CLI Command

      Interleaving Fragments

      Enable interleave fragmentation for PPP Multilink Protocol data units (PDUs).

      TLOC Extension

      Enter the name of a physical interface on the same router that connects to the WAN transport. This configuration binds the service-side interface to the WAN transport by enabling a device to access the opposite WAN transport connected to the neighbouring device using a TLOC-extension interface.

      IP MTU

      Specify the maximum MTU size of packets on the interface. MLP encapsulation adds 6 extra bytes (4 header, 2 checksum) to each outbound packet. These overhead bytes reduce the effective bandwidth on the connection; therefore, the throughput for an MLP bundle is slightly less than an equivalent bandwidth connection that is not using MLP.

      Range: 576 through 1804

      Default: 1500 bytes

      IP Directed-Broadcast

      Enable the translation of a directed broadcast to physical broadcasts.

      Shaping Rate (Kbps)

      Configure the aggregate traffic transmission rate on the interface to be less than line rate, in kilobits per second (kbps).

What to do next

Also see Deploy a Configuration Group.

Follow these steps to configure VPN interface multilink using a feature template.

Multilink Point-to-Point Protocol (MLP) is used to combine multiple physical links into a single logical connection, called an MLP bundle.

Procedure

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

  2. Click Feature Templates.

    In Cisco vManage Release 20.7.x and earlier releases, Feature Templates is titled Feature.

    1. Click Add Template.
    2. Choose a Cisco IOS XE Catalyst SD-WAN device from the list.
    3. If you are configuring the multilink interface in the transport VPN (VPN 0), click Transport & Management VPN or scroll to the Transport & Management VPN section.

      Under Additional VPN 0 Templates, located to the right of the screen, click VPN Interface Multilink Controller.

    4. If you are configuring the multilink interface in a service VPN (VPNs other than VPN 0), click Service VPN or scroll to the Service VPN section.

      In the Service VPN drop-down list, enter the number of the service VPN. Under Additional VPN Templates, located to the right of the screen, click VPN Interface Multilink Controller.

    5. From the VPN Interface Multilink Controller drop-down list, click Create Template. The VPN Multilink template form is displayed. This form contains fields for naming the template, and fields for defining multilink Interface parameters.
    6. In Template Name, enter a name for the template. The name can be up to 128 characters and can contain only alphanumeric characters.
    7. In Template Description, enter a description of the template. The description can be up to 2048 characters and can contain only alphanumeric characters.

  3. Configure the following parameters in the VPN interface multilink template.

    1. Configure a multilink interface.

      If you are creating a VPN Interface Multilink template, you do not need to create a T1/E1 Controller template or a VPN Interface T1/E1 template.

      Table 6.

      Parameter Name

      Description

      Shutdown*

      Click No to enable the multilink interface.

      Interface Name*

      Enter the number of the MLP interface. It can be a number from 1 through 65,535.

      Description

      Enter a description for the multilink interface.

      Multilink Group Number*

      Enter the number of the multilink group. It can be a number from 1 through 65,535 but it must be the same as the number you enter in the Multilink Interface Name parameter.

      IPv4 Address*

      To configure a static address, click Static and enter an IPv4 address.

      To set the interface as a DHCP client so that the interface to receive its IP address from a DHCP server, click Dynamic. You can optionally set the DHCP distance to specify the administrative distance of routes learned from a DHCP server. The default DHCP distance is 1.

      IPv6 Address*

      To configure a static address for an interface in VPN 0, click Static and enter an IPv6 address.

      To set the interface as a DHCP client so that the interface to receive its IP address from a DHCP server, click Dynamic. You can optionally set the DHCP distance to specify the administrative distance of routes learned from a DHCP server. The default DHCP distance is 1. You can optionally enable DHCP rapid commit, to speed up the assignment of IP addresses.

      Bandwidth Upstream

      For transmitted traffic, set the bandwidth above which to generate notifications.

      Range: 1 through (232 / 2) – 1 kbps

      Bandwidth Downstream

      For received traffic, set the bandwidth above which to generate notifications.

      Range: 1 through (232 / 2) – 1 kbps

      IP MTU

      Specify the maximum MTU size of packets on the interface. MLP encapsulation adds 6 extra bytes (4 header, 2 checksum) to each outbound packet. These overhead bytes reduce the effective bandwidth on the connection; therefore, the throughput for an MLP bundle is slightly less than an equivalent bandwidth connection that is not using MLP.

      Range: 576 through 1804

      Default: 1500 bytes
    2. Configure the PPP authentication protocol.
      Table 7.

      Parameter Name

      Description

      Authentication Protocol

      Select the authentication protocol used by the MLP:

      • CHAP—Enter the hostname and password provided by your Internet Service Provider (ISP). hostname can be up to 254 characters.

      • PAP—Enter the username and password provided by your ISP. username can be up to 254 characters.

      • PAP and CHAP—Configure both authentication protocols. Enter the login credentials for each protocol. To use the same username and password for both, click Same Credentials for PAP and CHAP.
    3. Configure a tunnel interface for the multilink interface.
      Table 8.

      Parameter Name

      Description

      Tunnel Interface

      Click On to create a tunnel interface.

      Color

      Select a color for the TLOC.

      Color Description

      Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.18.1

      Enter a description associated to the TLOC color.

      Control Connection

      By default, Control Conection is set to On, which establishes a control connection for the TLOC. If the router has multiple TLOCs, click No to have the tunnel not establish control connection for the TLOC.

      Note

      We recommend a minimum of 650-700 Kbps bandwidth with default 1 sec hello-interval and 12 sec hello-tolerance parameters configured to avoid any data/packet loss in connection traffic.

      For each BFD session, an additional average sized BFD packet of 175 Bytes consumes 1.4 Kbps of bandwidth.

      A sample calculation of the required bandwidth for bidirectional BFD packet flow is given below:

      • 650 – 700 Kbps per device for control connections.

      • 175 Bytes (or 1.4 Kbps) per BFD session on the device (request)

      • 175 Bytes (or 1.4 Kbps) per BFD session on the device (response)

      If the path MTU discovery (PMTUD) is enabled, bandwidth for send/receive BFD packets per tunnel for every 30 secs:

      A 1500 Bytes BFD request packet is sent per tunnel every 30 secs:

      1500 Bytes * 8 bits/1 byte * 1 packet / 30 secs = 400 bps (request)

      A 147 Bytes BFD packet is sent in response:

      147 Bytes * 8 bits/1 byte * 1 packet / 30 secs = 40 bps (response)

      Therefore, a device with 775 BFD sessions (for example) requires a bandwidth of:

      700k + (1.4k*775) + (400 *775) + (1.4k*775) + (40 *775) = ~3,5 MBps

      Maximum Control Connections

      Specify the maximum number of Cisco SD-WAN Controller that the WAN tunnel interface can connect to. To have the tunnel establish no control connections, set the number to 0.

      Range: 0 through 8

      Default: 2

      vBond As STUN Server

      Click On to enable Session Traversal Utilities for NAT (STUN) to allow the tunnel interface to discover its public IP address and port number when the device is located behind a NAT.

      Exclude Controller Group List

      Set the Cisco SD-WAN Controller that the tunnel interface is not allowed to connect to.

      Range: 0 through 100

      vManage Connection Preference

      Set the preference for using a tunnel interface to exchange control traffic with Cisco SD-WAN Manager.

      Range: 0 through 8

      Default: 5

      Full Port Hop

      Minimum release: Cisco Catalyst SD-WAN Manager Release 20.18.1

      Enable full port hopping at the TLOC level to allow devices to establish connections with controllers by switching to the next port if the current port is blocked or non-functional.

      Default: Disabled

      Port Hop

      Click On to enable port hopping, or click Off to disable it. When a router is behind a NAT, port hopping rotates through a pool of preselected OMP port numbers (called base ports) to establish DTLS connections with other routers when a connection attempt is unsuccessful. The default base ports are 12346, 12366, 12386, 12406, and 12426. To modify the base ports, set a port offset value.

      Default: Enabled

      Starting from Cisco Catalyst SD-WAN Manager Release 20.18.1, this field is deprecated. Instead use the Full Port Hop option. See the Full Port Hop field.

      Low-Bandwidth Link

      Select to characterize the tunnel interface as a low-bandwidth link.

      Tunnel TCP MSS

      TCP MSS affects any packet that contains an initial TCP header that flows through the router. When configured, TCP MSS is examined against the MSS exchanged in the three-way handshake. The MSS in the header is lowered if the configured TCP MSS setting is lower than the MSS in the header. If the MSS header value is already lower than the TCP MSS, the packets flow through unmodified. The host at the end of the tunnel uses the lower setting of the two hosts. If the TCP MSS is to be configured, it should be set at 40 bytes lower than the minimum path MTU.

      Specify the MSS of TPC SYN packets passing through the Cisco IOS XE Catalyst SD-WAN device. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented.

      Range: 552 to 1460 bytes

      Default: None

      Clear-Dont-Fragment

      Configure Clear-Dont-Fragment for packets that arrive at an interface that has Don't Fragment configured. If these packets are larger than what MTU allows, they are dropped. If you clear the Don't Fragment bit, the packets are fragmented and sent.

      Click On to clear the Dont Fragment bit in the IPv4 packet header for packets being transmitted out of the interface. When the Dont Fragment bit is cleared, packets larger than the MTU of the interface are fragmented before being sent.

      Note

      Clear-Dont-Fragment clears the Dont Fragment bit and the Dont Fragment bit is set. For packets not requiring fragmentation, the Dont Fragment bit is not affected.

      Allow Service

      Select On or Off for each service to allow or disallow the service on the interface.

      To configure additional tunnel interface parameters, click Advanced Options and configure the following parameters:

      Table 9.

      Parameter Name

      Description

      GRE

      Use GRE encapsulation on the tunnel interface. By default, GRE is disabled.

      If you select both IPsec and GRE encapsulations, two TLOCs are created for the tunnel interface that have the same IP addresses and colors, but that differ by their encapsulation.

      IPsec

      Use IPsec encapsulation on the tunnel interface. By default, IPsec is enabled.

      If you select both IPsec and GRE encapsulations, two TLOCs are created for the tunnel interface that have the same IP addresses and colors, but that differ by their encapsulation.

      IPsec Preference

      Specify a preference value for directing traffic to the tunnel. A higher value is preferred over a lower value.

      Range: 0 through 4294967295.

      Default: 0

      IPsec Weight

      Enter a weight to use to balance traffic across multiple TLOCs. A higher value sends more traffic to the tunnel.

      Range: 1 through 255.

      Default: 1

      Carrier

      Select the carrier name or private network identifier to associate with the tunnel.

      Values: carrier1, carrier2, carrier3, carrier4, carrier5, carrier6, carrier7, carrier8, default.

      Default: default

      Bind Loopback Tunnel

      Enter the name of a physical interface to bind to a loopback interface.

      Last-Resort Circuit

      Select to use the tunnel interface as the circuit of last resort.

      Note

      An interface configured as a circuit of last resort is expected to be down and is skipped while calculating the number of control connections, the cellular modem becomes dormant, and no traffic is sent over the circuit.

      When the configurations are activated on the edge device with cellular interfaces, then all the interfaces begin the process of establishing control and BFD connections. When one or more of the primary interfaces establishes a BFD connection, the circuit of last resort shuts itself down.

      Only when all the primary interfaces lose their connections to remote edges, then the circuit of last resort activates itself triggering a BFD TLOC Down alarm and a Control TLOC Down alarm on the edge device. The last resort interfaces are used as backup circuit on edge device and are activated when all other transport links BFD sessions fail. In this mode the radio interface is turned off, and no control or data connections exist over the cellular interface.

      NAT Refresh Interval

      Enter the interval between NAT refresh packets sent on a DTLS or TLS WAN transport connection.

      Range: 1 through 60 seconds.

      Default: 5 seconds

      Hello Interval

      Enter the interval between Hello packets sent on a DTLS or TLS WAN transport connection.

      Range: 100 through 10000 milliseconds.

      Default: 1000 milliseconds (1 second)

      Hello Tolerance

      Enter the time to wait for a Hello packet on a DTLS or TLS WAN transport connection before declaring that transport tunnel to be down.

      Range: 12 through 60 seconds.

      Default: 12 seconds
    4. Apply a rewrite rule, access lists, and policers to a router interface.
      Table 10.

      Parameter Name

      Description

      Shaping rate

      Configure the aggreate traffic transmission rate on the interface to be less than line rate, in kilobits per second (kbps).

      QoS map

      Specify the name of the QoS map to apply to packets being transmitted out the interface.

      Rewrite Rule

      Click On, and specify the name of the rewrite rule to apply on the interface.

      Ingress ACL – IPv4

      Click On, and specify the name of the access list to apply to IPv4 packets being received on the interface.

      Egress ACL – IPv4

      Click On, and specify the name of the access list to apply to IPv4 packets being transmitted on the interface.

      Ingress ACL – IPv6

      Click On, and specify the name of the access list to apply to IPv6 packets being received on the interface.

      Egress ACL – IPv6

      Click On, and specify the name of the access list to apply to IPv6 packets being transmitted on the interface.

      Ingress Policer

      Click On, and specify the name of the policer to apply to packets being received on the interface.

      Egress Policer

      Click On, and specify the name of the policer to apply to packets being transmitted on the interface.
    5. Configure other interface properties.
      Table 11.

      Parameter Name

      Description

      PMTU Discovery

      Click On to enable path MTU discovery on the interface, to allow the router to determine the largest MTU size supported without requiring packet fragmentation.

      TCP MSS

      Specify the maximum segment size (MSS) of TPC SYN packets passing through the Cisco Catalyst SD-WAN device. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented.

      Range: 552 to 1460 bytes.

      Default: None

      Clear Dont Fragment

      Click On to clear the Don't Fragment bit in the IPv4 packet header for packets being transmitted out the interface. When the DF bit is cleared, packets larger than that interface's MTU are fragmented before being sent.

      Static Ingress QoS

      Select a queue number to use for incoming traffic.

      Range: 0 through 7

      Auto negotiate

      Click Off to turn off autonegotiation. By default, an interface runs in autonegotiation mode.

      TLOC Extension

      Enter the name of the physical interface on the same router that connects to the WAN transport circuit. This configuration then binds this service-side interface to the WAN transport. A second Cisco Catalyst SD-WAN device at the same site that itself has no direct connection to the WAN (generally because the site has only a single WAN connection) and that connects to this service-side interface is then provided with a connection to the WAN.