Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Configure application-aware routing policies

Updated: April 24, 2026

Want to summarize with AI?

Log in

Describes the available methods to configure application-aware routing policies.

Use one of these steps to configure application-aware routing policies:

Configure application-aware routing using CLI commands

Use these steps to control how application traffic is routed across overlay networks, ensuring that traffic meets specific SLA criteria such as latency, jitter, and loss.

Procedure

1.

Create lists of overlay network sites to which the policy will be applied.

Example:

vSmart(config)# policy
vSmart(config-policy)# lists site-list list-name
vSmart(config-site-list)# site-id site-id

  1. Include one site-id command for each site.

  2. For contiguous site IDs, specify a range using a dash (–).

  3. Create additional site lists as needed.
2.

Define SLA classes with traffic characteristics to apply to matching application data traffic.

Example:

vSmart(config)# policy sla-class sla-class-name
vSmart(config-sla-class)# jitter milliseconds
vSmart(config-sla-class)# latency milliseconds
vSmart(config-sla-class)# loss percentage
vSmart(config-sla-class)# app-probe-class app-probe-class
vSmart(config-sla-class)# fallback-best-tunnelcriterialatencylossjitter
3.

Create Lists of Applications, IP Prefixes, and VPNs.

Example:

vSmart(config)# policy lists
vSmart(config-lists)# app-list list-name
vSmart(config-app-list)# (app application-name | app-family family-name)

vSmart(config-lists)# prefix-list list-name 
vSmart(config-prefix-list)# ip-prefix prefix/length

vSmart(config-lists)# vpn-list  list-name
vSmart(config-vpn-list)# vpn vpn-id
4.

Create an application-aware routing policy instance and associate it with a list of VPNs.

Example:

vSmart(config)# policy app-route-policy policy-name
vSmart(config-app-route-policy)# vpn-list list-name
5.

Create match-action sequences: Define one or more numbered sequences that match data traffic and apply SLA classes.

  1. Create a sequence.

    Example:

    vSmart(config-app-route-policy)# sequence number

  2. Define match parameters for data packets.

    Example:

    ​​vSmart(config-sequence)# match  parameters

  3. Define the action to take if a match occurs.

    Example:

    vSmart(config-sequence)# action sla-class sla-class-name [strict]
vSmart(config-sequence)# action sla-class sla-class-name [strict] preferred-color colors
vSmart(config-sequence)# <userinput>action backup-sla-preferred-color</userinput> <varname>colors</varname>
6.

Configure action options for SLA classes:

  1. Configure basic SLA Class

    sla-class sla-class-name

    Forwards matching traffic as long as one tunnel meets the SLA.

    • If one tunnel matches, traffic goes through it.

    • If multiple tunnels match, traffic is distributed among them.

    • If no tunnel matches, traffic uses any available tunnel.

  2. Configure preferred tunnel color.

    sla-class sla-class-name
          preferred-color color
    Traffic prefers a tunnel of the specified color.

    • If no tunnel matches the SLA, data traffic is sent through any available tunnel. In this sense, color preference is considered to be a loose matching, not a strict matching, because data traffic is always forwarded, whether a tunnel of the preferred color is available or not.

    • When no tunnel matches the SLA, you can choose how to handle the data traffic:

      • strict—Drop the data traffic.

      • backup-sla-preferred-color color —Direct the data traffic to a specific tunnel. Data traffic is sent out the configured tunnel if that tunnel interface is available; if that tunnel is unavailable, traffic is sent out another available tunnel. You can specify one or more colors. As with the preferred-color option, the backup SLA preferred color is loose matching. In a single action configuration, you cannot include both the strict and backup-sla-preferred-color options.

  3. Count matching packets/bytes:

    vSmart(config-sequence)# action count counter-name

  4. Place a sampled set of packets into syslog: 

    vSmart(config-sequence)# action log

    Match–action pairs are evaluated in numerical order. If no match occurs, the default action applies. For application-aware routing, the default is to accept nonmatching traffic. To apply SLA parameters to nonmatching packets:
7.

If a packet does not match any of the conditions in one of the sequences, configure the default action.

Example:

vSmart(config-policy-name)# default-action sla-class sla-class-name

For application-aware routing policy, the default action is to accept nonmatching traffic and forward it with no consideration of SLA. You can configure the default action so that SLA parameters are applied to nonmatching packets.
8.

Apply the policy to a site list.

Example:

vSmart(config)# apply-policy site-list list-name app-route-policy policy-name

Configure application-aware routing policies using classic policies

This section describes how to configure application-aware routing policies using classic policies, including the sequence of steps and requirements for policy activation.

To configure application-aware routing policy, use the Cisco SD-WAN Manager policy configuration wizard. For Centralized Policy configuration details, refer to Configure Centralized Policies.

The wizard consists of four sequential windows that guide you through the process of creating and editing policy components:

Procedure

1.

Create applications or groups of interest.

Create lists that group related items and reference them in the match or action components of a policy. For configuration details, see Configure Groups of Interest.

2.

Configure traffic rules.

Define the match and action conditions of the policy.
3.

Apply policies to sites and VPN.

Associate the created policy blocks with sites and VPNs in the overlay network.

In the first three policy configuration wizard windows, you create the policy components or blocks. In the final window, you apply these policy blocks to sites and VPNs
4.

Activate the policy, to make an application-aware routing policy effective.

Configure an application-aware routing policy using CLI

This task enables you to configure application-aware routing policy on a Cisco Catalyst SD-WAN Controller. The policy directs ICMP traffic to links with latency of 50 milliseconds or less.

You configure application-aware routing policy on a Cisco Catalyst SD-WAN Controller.

The order in which you configure these components is immaterial from the point of view of the CLI. However, from an architectural design point of view, a logical order is to first define all the parameters that are invoked in the application-aware routing policy itself or that are used to apply the policy to various sites in the overlay network. Then, you specify the application-aware routing policy itself and the network sites to which you want to apply the policy.

Procedure

1.

Define the SLA parameters to apply to matching ICMP traffic.

Example:

​vSmart# config
vSmart(config)# policy sla-class test_sla_class latency 50
vSmart(config-sla-class-test_sla_class)#

This example directs ICMP traffic to links with latency of 50 milliseconds or less.
2.

Define the site and VPN lists to which you want to apply the application-aware routing policy.

Example:

vSmart(config-sla-class-test_sla_class)# exit
vSmart(config-sla-class-test_sla_class)# lists vpn-list vpn_1_list vpn 1
vSmart(config-vpn-list-vpn_1_list)# exit
vSmart(config-lists)# site-list site_500 site-id 500
vSmart(config-site-list-site_500)#
3.

Configure the application-aware routing policy and specify the protocol numbers for ICMP, TCP, and UDP.

Example:

vSmart(config-site-list-site_500)# exit
vSmart(config-lists)# exit
vSmart(config-policy)# app-route-policy test_app_route_policy
vSmart(config-app-route-policy-test_app_route_policy)# vpn-list vpn_1_list
vSmart(config-vpn-list-vpn_1_list)# sequence 1 match protocol 6
vSmart(config-match)# exit
vSmart(config-sequence-1)# action sla-class test_sla_class strict
vSmart(config-sequence-1)# exit
vSmart(config-vpn-list-vpn_1_list)# sequence 2 match protocol 17
vSmart(config-match)# exit
vSmart(config-sequence-2)# action sla-class test_sla_class
vSmart(config-sequence-2)# exit
vSmart(config-vpn-list-vpn_1_list)# sequence 3 match protocol 1
vSmart(config-match)# exit
vSmart(config-sequence-3)# action sla-class test_sla_class strict
vSmart(config-sequence-3)# exit
vSmart(config-sequence-4)#

In this example, protocol 1 is ICMP, protocol 6 is TCP, and protocol 17 is UDP.
4.

Apply the policy to the desired sites in the Cisco IOS XE Catalyst SD-WAN overlay network.

Example:

vSmart(config-sequence-4)# top
vSmart(config)# apply-policy site-list site_500 app-route-policy test_app_route_policy
5.

Display the configuration changes.

Example:

vSmart(config-site-list-site_500)# top
vSmart(config)# show config
6.

Validate that the configuration contains no errors.

Example:

vSmart(config)# validate
Validation complete
7.

Activate the configuration.

Example:

vSmart(config)# commit
Commit complete.
8.

Exit from configuration mode.

Example:

vSmart(config)# exit
vSmart#

Complete configuration example:

vSmart# show running-config policy
policy
 sla-class test_sla_class
  latency 50
 !
 app-route-policy test_app_route_policy
  vpn-list vpn_1_list
   sequence 1
    match
     protocol 6
    !
    action sla-class test_sla_class strict
   !
   sequence 2
    match
     protocol 17
    !
    action sla-class test_sla_class
   !
   sequence 3
    match
     protocol 1
    !
    action sla-class test_sla_class strict
   !
  !
 !
 lists
  vpn-list vpn_1_list
   vpn 1
  !
  site-list site_500
   site-id 500
  !
  site-list site_600
   site-id 600
  !
 !
!
apply-policy
 site-list site_500
  app-route-policy test_app_route_policy
 !
!

Multicast protocol example:


policy
!
 sla-class SLA_BEST_EFFORT
  jitter 900
 !
 sla-class SLA_BUSINESS_CRITICAL
  loss    1
  latency 250
  jitter  300
 !
 sla-class SLA_BUSINESS_DATA
  loss    3
  latency 400
  jitter  500
 !
 sla-class SLA_REALTIME
  loss    2
  latency 300
  jitter  60
 !
 app-route-policy policy_multicast
  vpn-list multicast-vpn-list
   sequence 10
    match
     source-ip      10.0.0.0/8
     destination-ip 10.255.255.254/8
    !
    action
     count mc-counter-10
     sla-class SLA_BUSINESS_CRITICAL
    !
   !
   sequence 15
    match
     source-ip      172.16.0.0/12
     destination-ip 172.31.255.254/12
    !
    action
     count mc-counter-15
     sla-class SLA_BEST_EFFORT
    !
   !
   sequence 20
    match
     destination-ip 192.168.0.1
    !
    action
     count mc-counter-20
     sla-class SLA_BUSINESS_CRITICAL
    !
   !
   sequence 25
    match
     protocol       17
    !
    action
     count mc-counter-25
     sla-class SLA_REALTIME
    !
   !
   sequence 30
    match
     source-ip      192.168.0.0/16
     destination-ip 192.168.255.254
     protocol       17
    !
    action
     count mc-counter-30
     sla-class SLA_BUSINESS_DATA preferred-color lte    
    !
   !
   default-action sla-class SLA_BEST_EFFORT
   !
   sequence 35
    match
     source-ip      10.0.0.0/8
     destination-ip 10.255.255.254/8
     protocol       17
    !
    action
     count mc-counter-35
     sla-class SLA_BUSINESS_DATA preferred-color lte
     backup-sla-preferred-color 3g
    !
   !
 lists
  vpn-list multicast-vpn-list
   vpn 1
   vpn 60
   vpn 4001-4010
   vpn 65501-65510
  !
  site-list multicast-site-list
   site-id 1100
   site-id 500
   site-id 600
  !
 !
!
apply-policy
 site-list multicast-site-list
  app-route-policy policy_multicast
 !
!

Remote color preference example:


vSmart# show running-config policy
policy
 sla-class SLA1
  latency 100
 !
app-route-policy AAR1
  vpn-list vpn1
   sequence 1
    match
     destination-ip 10.1.1.0/24
    !
    action
     sla-class SLA1 preferred-color mpls lte
     sla-class remote-preference
      remote-color          mpls lte
      remote-color-restrict

Ranking color preference example:

app-route-policy SAMPLE _AAR
 vpn-list ONE
  sequence 10
   match
    dscp 46
   !
   action
    sla VOICE_SLA strict preferred-color-group GROUP2_COLORS
   !
  !
  sequence 20
   match
    dscp 34
   !
   action
    sla VOICE_SLA preferred-color-group GROUP1_COLORS
   !
  !
  sequence 30
   match
    dscp 28
   !
   action
    sla VOICE_SLA preferred-color-group GROUP3_COLORS
   !
  !
 !
policy lists
  preferred-color-group GROUP1_COLORS
   primary-preference
    color-preference biz-internet
    path-preference direct-tunnel
   ! 
   secondary-preference
    color-preference mpls
    path-preference multi-hop-path
   !
   tertiary-preference
    color-preference lte
   !
  !
  preferred-color-group GROUP2_COLORS
   primary-preference
    color-preference mpls 
   !
   secondary-preference
    color-preference biz-internet
   !
  !
  preferred-color-group GROUP3_COLORS
   primary-preference
    color-preference mpls biz-internet lte
   !
Note

You can configure path-preference option only if you enable the Multi-Region Fabric option in Cisco SD-WAN Manager.

AAR policy for IPv6 applications example:

policy
  sla-class Default
   jitter 100
   latency 300
   loss 25
  !
 app-route-policy _VPN1_AAR-Policy-for-IPv6-Traffic
  vpn-list VPN1
    sequence 1
     match
      app-list Msft-0365
     !
     action
      sla-class Default  preferred-color public-internet
     !
    !
 !
 lists
  app-list Msft-0365
   app ms-office-web-apps 
  !
  site-list SITE-100
   site-id 100 
  !
  vpn-list VPN1
   vpn 1 
  !
 !
!
apply-policy
 site-list SITE-100
  app-route-policy _VPN1_AAR-Policy-for-IPv6-Traffic
 !
!