Cisco Catalyst SD-WAN Onboarding Guide, Releases 26.x and Later

PDF

Configure the Cisco Catalyst SD-WAN Controller

Updated: July 7, 2026

Want to summarize with AI?

Log in

Configure the Cisco Catalyst SD-WAN Controller to enable authentication, join the overlay network, and establish basic connectivity. Configure essential parameters such as system IP, site ID, and tunnel interfaces to ensure proper operation.

This task enables you to configure the Cisco Catalyst SD-WAN Controller with the required initial settings so it can be authenticated, verified, and participate in the overlay network. You will set up basic features such as system IP, site and domain IDs, and tunnel interfaces.

  • Establishes device identity and connectivity for overlay network participation.

  • Prepares the controller for further configuration using templates in Cisco SD-WAN Manager.

Use this task after deploying the Cisco SD-WAN Controller virtual machines in your overlay network. The devices start with a factory-default configuration and require manual setup to join the overlay network and communicate with other controllers and vEdge devices.

Perform this configuration before attaching configuration templates from Cisco SD-WAN Manager. The initial configuration ensures the device can be managed and participate in control plane operations.

  • All Cisco SD-WAN Controllers must have identical policies for predictable overlay network operation.

Before you begin

Ensure the Cisco SD-WAN Controller virtual machines are deployed and running with factory-default configuration. You must have SSH access to the device CLI and know the default credentials (username: admin, password: admin).

  • Identify the required IP addresses for system IP, site ID, domain ID, and Cisco SD-WAN Validator.

  • Determine the interface in VPN 0 to be used as the tunnel interface, and ensure it connects to a WAN transport network accessible by all vEdge devices.

Follow these steps to configure the Cisco Catalyst SD-WAN Controller for overlay network participation:

Procedure

1.

Open a CLI session to the Cisco vEdge device via SSH.
2.

Log in as the user admin using the default password admin. The CLI prompt is displayed.
3.

Enter configuration mode.

Example:

vSmart#  config
vSmart(config)#
4.

Configure the hostname (optional but recommended).

Example:

Cisco(config)# system host-name hostname

This name appears in the CLI prompt and is used on various Cisco SD-WAN Manager pages to refer to the device.
5.

Configure the system IP address.

In Releases 16.3 and later, the IP address can be IPv4 or IPv6. In earlier releases, only IPv4 is supported. Releases 19.1 and later do not allow configuration of IPv6 unique local addresses; use addresses from the FC00::/7 prefix range.

Note

Starting from Cisco Catalyst SD-WAN Control Components Release 20.9.x release, you can configure unique local IPv6 addresses. Prior to this release, configure IPv6 addresses from the FC00::/7 prefix range.

Example:

vSmart(config-system)#system-ip ip-address

The Cisco SD-WAN Manager uses the system IP address to identify the device for configuration download.
6.

Configure the numeric identifier of the site where the device is located.

Example:

vSmart(config-system)# site-id site-id
7.

Configure the numeric identifier of the domain in which the device is located.

Example:

vSmart(config-system)# domain-id domain-id
8.

Configure the IP address or DNS name of the Cisco Catalyst SD-WAN Validator.

The Cisco Catalyst SD-WAN Validator's IP address must be public to allow all Cisco vEdge devices to reach it.

Example:

vSmart(config-system)# vbond  (dns-name | ip-address)
9.

Configure a time limit for confirming that a software upgrade is successful.

The time can be from 1 through 60 minutes. If confirmation is not received within the configured time, the device reverts to the previous software image.

Example:

vSmart(config-system)# upgrade-confirm minutes
10.

Change the password for the user "admin".

The default password is "admin".

Example:

vSmart(config-system)# user admin password password
11.

Configure an interface in VPN 0 to be used as a tunnel interface.

VPN 0 is the WAN transport VPN. The tunnel interface carries control traffic among devices in the overlay network. The interface name has the format ethnumber. Enable the interface and configure its IP address (static or DHCP). In Releases 16.3 and later, both IPv4 and IPv6 are supported for dual-stack operation.

Note

You must configure a tunnel interface on at least one interface in VPN 0 for the overlay network to come up and for Cisco SD-WAN Controller to participate. This interface must connect to a WAN transport network accessible by all Cisco vEdge devices. VPN 0 carries all control plane traffic among the Cisco vEdge devices in the overlay network.

Example:

​vSmart(config)# vpn 0
​vSmart(config-vpn-0)# interface interface-name
vSmart(config-interface)# ( ip dhcp-client | ip address prefix/length)
vSmart(config-interface)# (ipv6 address ipv6-prefix/length​​​​​​​ | ipv6 dhcp-client [​​​​​​​dhcp-distance ​​​​​​​number | ​​​​​​​dhcp-rapid-commit​​​​​​​])
vSmart(config-interface)# no shutdown
vSmart(config-interface)# tunnel-interface
​​vSmart(config-tunnel-interface)# allow-service netconf
12.

Configure a color for the tunnel to identify the type of WAN transport.

You can use the default color (default), or configure a more appropriate color such as mpls or metro-ethernet depending on the WAN transport.

Example:

vSmart(config-tunnel-interface)# color color
13.

Configure a default route to the WAN transport network.

Example:

vSmart(config-vpn-0)# ip route 0.0.0.0/0 next-hop
14.

Commit the configuration.

Example:

vSmart(config)# commit and-quit
vSmart#
15.

Verify that the configuration is correct and complete.

Example:

vSmart# show running-config
16.

After the overlay network is operational, create a Cisco SD-WAN Controller configuration template on Cisco SD-WAN Manager containing the initial configuration parameters.

  • System feature template: configure hostname, system IP, and Cisco SD-WAN Validator functionality.

  • AAA feature template: configure password for the "admin" user.

  • VPN Interface Ethernet feature template: configure interface, default route, and DNS server in VPN 0.

It is also recommended to configure the following general system parameters:

  • From the Cisco SD-WAN Manager menu, select Administration > Settings and configure Organization name.

  • From the Cisco SD-WAN Manager menu, select Configuration > Templates and configure the following:

  • For NTP and System feature configuration template, configure Timezone, NTP servers, and device physical location.

    Time Synchronize Cisco IOS XE Catalyst SD-WAN devices with Cisco SD-WAN Manager. Otherwise, NTP issue occurs causing scheduled upgrade failure or certificate expiry.

  • For Banner feature template, configure Login banner.

  • For Logging feature configuration template, configure Logging parameters.

  • For AAA feature configuration template, configure AAA, and RADIUS and TACACS+ servers.

  • For SNMP feature configuration template, configure SNMP.

After completing these steps, the Cisco SD-WAN Controller is configured with the required initial parameters, can participate in the overlay network, and is ready for further configuration using templates in Cisco SD-WAN Manager.

Below is an example of a simple configuration on a Cisco SD-WAN Controller. This configuration includes several settings from the factory-default configuration and shows default values.

vSmart# show running-config 
system
 host-name         vSmart
 gps-location latitude 40.7127837
 gps-location longitude -74.00594130000002
 system-ip         172.16.240.172
 site-id           200
 organization-name "Cisco"
 clock timezone America/Los_Angeles
 upgrade-confirm   15
 vbond 184.122.2.2
 aaa
  auth-order local radius tacacs
  usergroup basic
   task system read write
   task interface read write
  !
  usergroup netadmin
  !
  usergroup operator
   task system read
   task interface read
   task policy read
   task routing read
   task security read
  !
  user admin
   password encrypted-password
  !
 !
 logging
  disk
   enable
  !
  server 192.168.48.11
   vpn      512
   priority warm
  exit
 !
!
omp
 no shutdown
 graceful-restart
!
snmp
 no shutdown
 view v2
  oid 1.3.6.1
 !
 community private
  view          v2
  authorization read-only
 !
 trap target vpn 0 10.0.1.1 16662
  group-name     Cisco
  community-name private
 !
 trap group test
  all
   level critical major minor
  exit
 exit
!
vpn 0
 interface eth1
  ip address 10.0.12.22/24
  tunnel-interface
   color public-internet
   allow-service dhcp
   allow-service dns
   allow-service icmp
   no allow-service sshd
   allow-service netconf
   no allow-service ntp
   no allow-service stun
 !
  no shutdown
 !
vpn 512
 interface eth0
  ip dhcp-client
  no shutdown
 !
!

What to do next

For next steps, see Add the Cisco SD-WAN Controller to the Overlay Network.