Cisco Catalyst SD-WAN Onboarding Guide, Releases 26.x and Later

PDF

Configure Cisco SD-WAN manager

Updated: July 7, 2026

Want to summarize with AI?

Log in

Configure Cisco SD-WAN Manager to enable device authentication and participation in the overlay network. This task ensures that each vManage instance is properly set up using CLI mode and required features are configured for network operation.

Once you have set up and started the virtual machines (VMs) for Cisco SD-WAN Manager, they come up with a factory-default configuration. You then configure each Cisco SD-WAN Manager instance directly from the Cisco SD-WAN Manager server itself using CLI mode or ESXi console so that each Cisco SD-WAN Manager can be authenticated and verified and can join the overlay network. At a minimum, you must configure the IP address of your network's Cisco SD-WAN Validator, the device's system IP address, and a tunnel interface in VPN 0 to use for exchanging control traffic among the network controller devices (the Cisco SD-WAN Validator, Cisco SD-WAN Manager, and Cisco SD-WAN Controller devices).

For the overlay network to be operational and for Cisco SD-WAN Manager instances to participate in the overlay network, you must do the following:

  • Configure a tunnel interface on at least one interface in VPN 0. This interface must connect to a WAN transport network that is accessible by all Cisco vEdge devices. VPN 0 carries all control plane traffic among the Cisco vEdge devices in the overlay network.

  • Ensure that the Overlay Management Protocol (OMP) is enabled. OMP is the protocol responsible for establishing and maintaining the Cisco Catalyst SD-WAN control plane. OMP is enabled by default, and you cannot disable it. If you edit the configuration from the CLI, do not remove the omp configuration command.

Note

For a Cisco SD-WAN Manager cluster, you must configure each Cisco SD-WAN Manager instance in the cluster individually, from the Cisco SD-WAN Manager server itself using CLI mode or ESXi console.

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Workflows > Workflow Library.

2.

Launch the Add Controller and Validator Components workflow.
3.

Choose Validator, and proceed according to the instructions in the workflow.

For the authentication certificate assigned to the new SD-WAN Control Component, you can do one of these:

  • Handle certificate signing within the workflow:

    • Renewal type: Manual

      Choose the option to generate a certificate signing request (CSR). This facilitates getting the certificate signed and ready for use during the workflow. This option provides you with a CSR to download, to get the certificate signed. After getting the certificate signed, you upload the certificate within this workflow.

    • Renewal type: Automatic

      This option is available if two conditions are met:

      • Administration > Settings > Certificate setttings > Control Components set to Cisco, and

      • Smart Account credentials (Administration > Settings > Smart Account Credentials) are configured.

  • Handle certificate signing later:

    You can leave the Generate CSR… option unselected, and get the certificate signed later. Until the certificate is signed, the new SD-WAN Control Component cannot establish control connections in the network.

After completing these steps, each Cisco SD-WAN Manager instance is authenticated and able to join the overlay network. The required features are configured for Cisco SD-WAN Manager operation.

Sample CLI configuration

This section provides sample CLI configurations to configure Cisco SD-WAN Manager using CLI.

Note

This configuration includes a number of settings from the factory-default configuration and shows a number of default configuration values.

vManage# show running-config 
system
 host-name         vManage
 gps-location latitude 40.7127837
 gps-location longitude -74.00594130000002
 system-ip         172.16.255.22
 site-id           200
 organization-name "Cisco"
 clock timezone America/Los_Angeles
 vbond 10.1.14.14
 aaa
  auth-order local radius tacacs
  usergroup basic
   task system read write
   task interface read write
  !
  usergroup netadmin
  !
  usergroup operator
   task system read
   task interface read
   task policy read
   task routing read
   task security read
  !
  user admin
   password encrypted-password
  !
 !
 logging
  disk
   enable
  !
 !
!
snmp
 no shutdown
 view v2
  oid 1.3.6.1
 !
 community private
  view          v2
  authorization read-only
 !
 trap target vpn 0 10.0.1.1 16662
  group-name     Cisco
  community-name private
 !
 trap group test
  all
   level critical major minor
  exit
 exit
!
vpn 0
 interface eth1
  ip address 10.0.12.22/24
  tunnel-interface
   color public-internet
   allow-service dhcp
   allow-service dns
   allow-service icmp
   no allow-service sshd
   allow-service netconf
   no allow-service ntp
   no allow-service stun
   allow-service https
  !
  no shutdown
 !
 ip route 0.0.0.0/0 10.0.12.13
!
vpn 512
 interface eth0
  ip 172.16.14.145/23
  no shutdown
 !
 ip route 0.0.0.0/0 172.16.14.1
!
Note

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.18.1a and Cisco Catalyst SD-WAN Manager Release 20.18.1, port 830, which is used for NETCONF, is closed by default. When the port is open, the configuration under the system-level hierarchy will show the allow-service netconf CLI command. If the port is closed, this command will either not appear in the configuration or will be displayed as no allow-service netconf within that same system-level hierarchy.