Configure on-demand tunnels

Configure a control policy, as described in Configure a centralized control policy for on-demand tunnels.

Enable on-demand tunnels n spoke devices, as described in Enable on-demand tunnels on a spoke device using a template and Enable on-demand tunnels using a CLI template.

From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

1. Select Centralized Policy.

2. Click Add Policy.

3. In the left pane, click Site.

4. Click Next.

5. Click Add Topology and select Custom Control (Route & TLOC).

6. Enter a name and description for the topology.

7. Click Sequence Type.

8. In the Add Control Policy pop-up window, choose Route.

9. Click Sequence Rule to create a sequence.

Click Match.

1. Among the match conditions, click Site.

2. In the Match Conditions area, click the Site List menu and choose a site list.

3. Click Actions, and then Accept.

Among the actions, click TLOC Action.

1. In the Actions area, click the TLOC Action menu and choose Backup.

2. Among the actions, click TLOC.

3. In the Actions area, click the TLOC List menu and choose or create a TLOC list.

4. Click Save Match and Actions.

Click Default Action.

1. In the Default Action area, click the pencil icon to edit.

2. Near the Actions label, click Accept.

3. Click Save Control Policy.

4. Click Next twice.

5. In the Topology tab, click New Site/WAN Region List.

6. Click Outbound Site List and choose a site list that defines the sites at which you are enabling on-demand tunnels.

7. Adjacent to the site list, click Add.

8. Enter a name and description for the policy.

9. Click Save Policy.

From the Cisco SD-WAN Manager menu, choose Configuration > Classic > Policies.

Open Centralized Policy.

From Custom Options, choose Centralized Policy > CLI Policy.

Click Add Policy.

Enter the CLI commands for the policy.

control-policy Dynamic-Tunnel-Control-Policy
    sequence 100
     match route
      site-list Branches
     !
     action accept
      set
       tloc-action backup
       tloc-list Hub-TLOCs
      !
     !
     sequence 200
      match tloc 
     !
     action accept 
    !
  default-action accept
 !
 lists
  site-list Branches
   site-id 200 
   site-id 300
  !
  tloc-list Hub-TLOCs
   tloc 10.0.0.1 color mpls encap ipsec
   tloc 10.0.0.1 color public-internet encap ipsec 
!
!
apply-policy
 site-list Branches
  control-policy Dynamic-Tunnel-Control-Policy out
 !
!

Enable transport gateway functionality on a router serving as the hub, providing a backup route between spokes, as described in the Transport Gateway section of the Cisco Catalyst SD-WAN Routing Configuration Guide.

Enable on-demand tunnels and configure the idle timeout on spoke devices as described in Enable on-demand tunnels on a spoke device using a template.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

Do one of these:

• Edit a profile directly:

  In the System Profile tab, create (Add New) or edit a System profile.

• Edit a profile in a configuration group:

  Open a configuration group and edit the System profile.

In the System profile, create (Add New) or edit a Basic feature.

In the Advanced section, use the On Demand Tunnel control to enable on-demand tunnels.

From the Cisco SD-WAN Manager menu, choose Configuration > Templates

Click Feature Templates.

Click Add Template.

Select a device.

From Basic Information, select Cisco System.

Click Advanced.

Enable On-demand Tunnel.

(optional) Configure the On-demand Tunnel Idle Timeout time. The default idle timeout value is 10 minutes. Range: 1 to 65535 minutes

Attach the System feature template to the device template for the spoke device.

On the spoke devices, enable on-demand tunnels at the system level. In the case of multi-homed sites, enable on-demand on all systems in the site.

system 
     on-demand enable
     on-demand idle-timeout 10