Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Apply policies to sites and VPNs

Updated: April 24, 2026

Want to summarize with AI?

Describes the available methods to apply policies to sites and VPNs.

Use one of these methods to apply policies to sites and VPNs.

Policy groups: Add the application priority & SLA policy to a policy group, associate the required devices, and activate the policy group. For more information, refer to Deploy Policy Group Workflow in Policy Groups Configuration Guide.
CLI commands
Classic policies

Restrictions for policy application

Site ID requirement

For all app-route-policy policies applied using apply-policy commands, site IDs across all site lists must be unique.
Site lists must not contain overlapping site IDs.

Example of overlap:
- site-list 1: site-id 1–100
- site-list 2: site-id 70–130
- Sites 70–100 exist in both lists. If these two site lists are applied to different app-route-policy policies, committing the configuration on the target will fail.
The same non-overlapping site ID requirement applies to:
- Centralized control policy (control-policy)
- Centralized data policy (data-policy)
- Centralized data policy used for cflowd flow monitoring (data-policy that includes a cflowd action and an apply-policy containing a cflowd-template command)

Allowed overlaps between different policy types

Site lists can contain overlapping site IDs only when they are applied to different policy types.
Example:
- site-list 1 (1–100) applied to a control policy
- site-list 2 (70–130) applied to a data policy.
This configuration is allowed.

Apply policies to sites and VPNs using classic policies

Use these steps to apply policy blocks to sites and VPNs in the overlay network to enforce application-aware routing and centralized policies.

Before you begin

Ensure you have created the required policy blocks in the previous steps of the policy configuration wizard.

Have lists of sites and VPNs ready for association with policy blocks.

Procedure

	1.	From the Cisco SD-WAN Manager menu, choose Configuration > Policies. Centralized Policy is selected and displayed by default.
	2.	Click Add Policy. The Create Applications or Groups of Interest page is displayed.
	3.	Click Next. The Network Topology window opens, and in the Topology bar, Topology is selected by default.
	4.	Click Next. The Configure Traffic Rules window opens, and in the Application-Aware Routing bar, Application-Aware Routing is selected by default.
	5.	Click Next. The Apply Policies to Sites and VPNs window opens.
	6.	In the Policy Name field, enter a name for the policy. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.
	7.	In the Policy Description field, enter a description of the policy. It can contain up to 2048 characters. This field is mandatory, and it can contain any characters and spaces.
	8.	From the Topology bar, select the type of policy block. The table then lists policies that you have created for that type of policy block.
	9.	Click Add New Site List and VPN list. Select one or more site lists and select one or more VPN lists. Click Add.
	10.	Click Preview to view the configured policy. The policy is displayed in CLI format.
	11.	Click Save Policy. The Configuration > Policies page appears, and the policies table includes the newly created policy. As soon as you successfully activate the configuration on the Cisco Catalyst SD-WAN Controller by issuing a commit command, the controller pushes the application-aware routing policy to the Cisco IOS XE Catalyst SD-WAN devices at the specified sites.

Apply policies to sites and VPNs using CLI commands

To apply an application-aware route policy to a list of sites in the overlay network, use this CLI command:

device(config)# apply-policy site-list list-name app-route-policy policy-name

Verify applied policy

Use these commands to verify and monitor policies configured on the controller and pushed to routers.

To view the policy configured on the Cisco Catalyst SD-WAN Controller, use the show running-config command on the controller.
To view the policy that the Cisco Catalyst SD-WAN Controller has pushed to the device, issue the show policy from-vsmart command on the router.
To display flow information for the application-aware applications running on the device, issue the show app dpi flows command on the router.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.