Cisco Catalyst SD-WAN Multitenancy Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Multitenancy Guide, Releases 26.x and Later

Assign SD-WAN Controllers to tenants during onboarding

Updated: June 21, 2026

Want to summarize with AI?

Log in

Describes how to assign SD-WAN Controllers to tenants during onboarding by configuring tenant details, selecting controller placement options, and provisioning the tenant in SD-WAN Manager.

Before you begin

Each tenant requires a unique Virtual Account (VA) on Plug and Play Connect in Cisco Software Central. The tenant VA must belong to the same Smart Account (SA) as the provider VA. Depending on the deployment type, one of these must be completed:

  • On-premises deployments: Create a Cisco SD-WAN Validator controller profile for the tenant on Plug and Play Connect with these mandatory fields:

    Table 1. Mandatory fields for on-premises validator controller profile
    Field Description
    Profile name Enter a name for the controller profile.
    Multitenancy From the drop-down list, select Yes.
    SP organization name Enter the provider organization name.
    Organization name Enter the tenant organization name in the format <SP Org Name>-<Tenant Org Name>. The organization name can be up to 64 characters.
    Primary controller Enter the host details for the primary SD-WAN Validator.

  • For cloud deployments: SD-WAN Manager automatically creates the Validator Controller profile during tenant creation.

To provision and activate the tenant in SD-WAN Manager with the configured settings, follow these steps.

Procedure

1.

Log in to SD-WAN Manager as the provider admin user.

2.

From the menu, choose Administration > Tenant Management.

3.

Click Add Tenant.

4.

In the Add Tenant slide-in pane, click New Tenant.

5.

Configure tenant details:

Table 2. Tenant Configuration Fields
Field Details

Name

Enter a name for the tenant.

For cloud deployments, the tenant name must match the tenant VA name in Plug and Play Connect.

Description

Enter a description (up to 256 alphanumeric characters).

Organization name

Enter the tenant’s organization name (case-sensitive, up to 64 characters).

Use the format <SP Org Name>-<Tenant Org Name>

Example: managed-sp-customer1

URL subdomain

Enter the tenant’s fully qualified subdomain name. It must include the provider’s domain name.

Example: customer1.managed-sp.com.

See DNS configuration table for deployment-specific steps.

Forecasted devices

Enter the maximum number of WAN edge devices the tenant can add. If this limit is exceeded, SD-WAN Manager blocks device addition.

Select two controllers

  • Automatic placement (default): Ensure the field is set to Autoplacement.

  • Manual placement:

    1. Click the Select two Controllers drop-down list.

      SD-WAN Manager lists the hostnames of the available SD-WAN Controllers.

      For each SD-WAN Controller, SD-WAN Manager shows whether the controller is reachable and reports the utilization details. See utilizations details table for more information.

    2. Select two SD-WAN Controllers to assign to the tenant based on the utilization details.

Table 3. Utilization details

Field

Description
Tenant hosting capacity Each SD-WAN Controller can serve a maximum of 24 tenants. Tenant hosting capacity represents the number of tenants to which the Cisco SD-WAN Controller is assigned in the form of a percentage. This value indicates whether you can assign another tenant to this controller.
Used device capacity Each SD-WAN Controller can support a maximum of 1000 tenant WAN edge devices. Used device capacity represents the number of tenant WAN edge devices connected to the SD-WAN Controller in the form of a percentage of the maximum capacity (1000 WAN edge devices). This value indicates whether the SD-WAN Controller can support the number of devices forecast for the tenant that you are onboarding.
Memory utilized This value represents memory consumption as a percentage.
CPU utilized This value represents CPU usage as a percentage.
Table 4. DNS configuration

Deployment type

DNS configuration steps

On-premises

  • Add the tenant subdomain to DNS and map it to the IPs of the three SD-WAN Manager instances in the cluster.

  • Create a provider DNS A record from the provider’s domain name and cluster ID.

    Example: vmanage123.sdwan.cisco.com.

    Validate: nslookup vmanage123.sdwan.cisco.com.

  • Create tenant DNS CNAME records mapping the tenant FQDN to the provider FQDN.

    Example: customer1.sdwan.cisco.com.

    Validate: nslookup customer1.sdwan.cisco.com.

  • If DNS is misconfigured, an authentication error occurs.

Cloud

  • The tenant subdomain is automatically added to DNS.

  • DNS resolution can take up to one hour after creation.
6.

Save the tenant configuration.

7.

To add another tenant, repeat steps 4 to 6.

When the task completes successfully, you can view the tenant information, including the assigned SD-WAN Controllers and Validators, on Administration > Tenant Management.

After completing the tenant addition steps, SD-WAN Manager performs the Create Tenant Bulk task, which:

  • Creates the tenant.

  • Assigns two SD-WAN Controllers and pushes CLI templates with the tenant information.

  • Sends the tenant and controller details to SD-WAN Validator.