To start the policy configuration wizard:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

2. Click Centralized Policy.

3. Click Add Policy.

   The policy configuration wizard appears, and the Create Groups of Interest window is displayed.

In Create groups of interest, create new groups of list types as described in the following sections to use in a centralized policy:

Configure policer

1. In the groups of interest list, click Policer.

2. Click New Policer List.

3. Enter a name for the list.

4. Define the policing parameters:

   1. In the Burst field, enter the maximum traffic burst size, a value from 15,000 to 10,000,000 bytes.

   2. In the Exceed field, select the action to take when the burst size or traffic rate is exceeded. It can be drop, which sets the packet loss priority (PLP) to low.

      You can use the remark action to set the packet loss priority (PLP) to high.

   3. In the Rate field, enter the maximum traffic rate, a value from 0 through 2⁶⁴ – 1 bits per second (bps).

5. Click Add.

Note

For ACL or data policy, even if the same policer object is used in different sequences, each sequence is policed separately. For example, consider that policer rate is 1000000 or 1Mb. If the same policer is set for multiple sequences then each sequence polices 1Mb traffic. If there are different policers configured for difference sequences, then each policer polices traffic based on the respective policing rate.

Configure TLOC

1. In the groups of interest list, click TLOC.

2. Click New TLOC List. The TLOC List popup displays.

3. Enter a name for the list.

4. In the TLOC IP field, enter the system IP address for the TLOC.

5. In the Color field, select the TLOC's color.

6. In the Encap field, select the encapsulation type.

7. In the Preference field, optionally select a preference to associate with the TLOC.

   The range is 0 to 4294967295.

8. Click Add TLOC to add another TLOC to the list.

9. Click Save.

Note	To use the set tloc and set tloc-list commands, you must use the set-vpn command.

For each TLOC, specify its address, color, and encapsulation. Optionally, set a preference value (from 0 to 232 – 1) to associate with the TLOC address. When you apply a TLOC list in an action accept condition, when multiple TLOCs are available and satisfy the match conditions, the TLOC with the highest preference value is used. If two or more TLOCs have the highest preference value, traffic is sent among them in an ECMP fashion.

If IPsec preference is set on the local preferred color for an edge router, the local TLOC and the color does not overlap with the centralized policy configured with local color preference. The edge router with local TLOC preference takes the precedence. In this case, the preferred TLOC configured in centralized policy is not considered.

Cisco SD-WAN Analytics is a cloud-based analytics service for Cisco Catalyst SD-WAN offering comprehensive insights into application and network performance. The analytics service is available with Cisco DNA Advantage and Cisco DNA Premier software subscriptions. Cisco SD-WAN Analytics collects and stores metadata about traffic flows in its cloud storage and produces analytics based on this collected data. Predictive Path Analytics generates recommendations for path based on long term insights. These recommendations need to be converted into policy created manually on Cisco SD-WAN Manager and then applied to the network.

The Predictive Path Recommendations feature allows you to apply active recommendations to the actionable centralized AAR policy to influence the forwarding decisions in the Cisco Catalyst SD-WAN network. The recommendations are applied as a part of the AAR policy and then pushed to Cisco SD-WAN Controller. The Predictive Path Recommendations are applied to the SD-WAN network as TLOC preferences in AAR policies.

For more information about using Predictive Path Recommendations, see Predictive Path Recommendations.

When you first open the Configure Topology and VPN Membership window, the Topology window is displayed by default.

To configure topology and VPN membership:

Hub-and-Spoke

1. In the Add Topology drop-down, select Hub-and-Spoke.

2. Enter a name for the hub-and-spoke policy.

3. Enter a description for the policy.

4. In the VPN List field, select the VPN list for the policy.

5. In the left pane, click Add Hub-and-Spoke. A hub-and-spoke policy component containing the text string My Hub-and-Spoke is added in the left pane.

6. Double-click the My Hub-and-Spoke text string, and enter a name for the policy component

7. In the right pane, add hub sites to the network topology:

   1. Click Add Hub Sites.

   2. In the Site List field, select a site list for the policy component.

   3. Click Add.

   4. Repeat these steps to add more hub sites to the policy component.

8. In the right pane, add spoke sites to the network topology:

   1. Click Add Spoke Sites.

   2. In the Site List Field, select a site list for the policy component.

   3. Click Add.

   4. Repeat these steps to add more spoke sites to the policy component.

9. Repeat steps as needed to add more components to the hub-and-spoke policy.

10. Click Save Hub-and-Spoke Policy.

Mesh

1. In the Add Topology drop-down, select Mesh.

2. Enter a name for the mesh region policy component.

3. Enter a description for the mesh region policy component.

4. In the VPN List field, select the VPN list for the policy.

5. Click New Mesh Region.

6. In the Mesh Region Name field, enter a name for the individual mesh region.

7. In the Site List field, select one or more sites to include in the mesh region.

8. Click Add.

9. Repeat these steps to add more mesh regions to the policy.

10. Click Save Mesh Topology.

Custom Control (Route & TLOC): Centralized route control policy (for matching OMP routes)

1. In the Add Topology drop-down, select Custom Control (Route & TLOC).

2. Enter a name for the control policy.

3. Enter a description for the policy.

4. In the left pane, click Sequence Type. The Add Custom Control Policy popup displays.

5. Select Route. A policy component containing the text string Route is added in the left pane.

6. Double-click the Route text string, and enter a name for the policy component.

7. In the right pane, click Sequence Rule. The Match/Actions box opens, and Match is selected by default.

8. From the boxes under the Match box, select the desired policy match type. Then select or enter the value for that match condition. Configure additional match conditions for the sequence rule, as desired.

9. Click Actions. The Reject option is selected by default. To configure actions to perform on accepted packets, click the Accept option. Then select the action or enter a value for the action.

10. Click Save Match and Actions.

11. Click Sequence Rule to configure more sequence rules, as desired. Drag and drop to re-order them.

12. Click Sequence Type to configure more sequences, as desired. Drag and drop to re-order them.

13. Click Save Control Policy.

Custom Control (Route & TLOC): Centralized TLOC control policy (for matching TLOC routes)

1. In the Add Topology drop-down, select Custom Control (Route & TLOC).

2. Enter a name for the control policy.

3. Enter a description for the policy.

4. In the left pane, click Sequence Type. The Add Custom Control Policy popup displays.

5. Select TLOC. A policy component containing the text string TLOC is added in the left pane.

6. Double-click the TLOC text string, and enter a name for the policy component.

7. In the right pane, click Sequence Rule. The Match/Actions box opens, and Match is selected by default.

8. From the boxes under the Match box, select the desired policy match type. Then select or enter the value for that match condition. Configure additional match conditions for the sequence rule, as desired.

9. Click Actions. The Reject option is selected by default. To configure actions to perform on accepted packets, click the Accept option. Then select the action or enter a value for the action.

10. Click Save Match and Actions.

11. Click Sequence Rule to configure more sequence rules, as desired. Drag and drop to re-order them.

12. Click Sequence Type to configure more sequences, as desired. Drag and drop to re-order them.

13. Click Save Control Policy.

A centralized control policy contains sequences of match–action pairs. The sequences are numbered to set the order in which a route or TLOC is analyzed by the match–action pairs in the policy.

Note	Sequence can have either match app-list or dns-app-list configured for a policy, but not both. Configuring both match app-list and dns-app-list for a policy is not supported.

Each sequence in a centralized control policy can contain one match condition (either for a route or for a TLOC​) and one action condition.

Note	The Cisco Catalyst SD-WAN policy supports maximum up to 1024 sequences, including default sequence.

1. In the Add Topology drop-down, click Import Existing Topology. The Import Existing Topology popup appears.

2. Select the type of topology.

3. For Policy Type, choose the name of the topology you want to import.

4. In the Policy drop-down, select a policy to import.

   Note	The policy configuration wizard does not let you import an already configured policy as in other instances of centralized policies (data, control, or application-aware routing). The policy must be configured in its entirety.

5. Click Import.

Click Next to move to Configure Traffic Rules in the wizard.

1. In the Specify your network topology area, click VPN Membership.

2. Click Add VPN Membership Policy.

   Note	You can add only one VPN membership at a time, therefore all site lists and VPN lists must be included in a single policy.

   The Add VPN Membership Policy popup displays.

3. Enter a name and description for the VPN membership policy.

4. In the Site List field, select the site list.

5. In the VPN Lists field, select the VPN list.

6. Click Add List to add another VPN to the VPN membership.

7. Click Save.

8. Click Next to move to Configure Traffic Rules in the wizard.

When you first open the Configure Traffic Rules window, Application-Aware Routing is selected by default.

You can also view already created AAR routing policies listed in the page. It provides various information related to the policies such as the Name of the policy, Type, Mode, Description, Update By, and Last Updated details.

Note	You can refer to the Mode column for the security status details of the policy. The status helps to differentiate whether the policy is used in unified security or not. The mode status is applicable only for security policies and not relevant to any centralized or localized policies.

For more information on configuring traffic rules for the Cisco Catalyst SD-WAN Application Intelligence Engine (SAIE) flow, see Cisco Catalyst SD-WAN Application Intelligence Engine Flow.

Note	In Cisco vManage Release 20.7.1 and earlier releases, the SAIE flow is called the deep packet inspection (DPI) flow.

To configure traffic rules for a centralized data policy:

1. Click Traffic Data.

2. Click the Add Policy drop-down.

3. Click Create New. The Add Data Policy window displays.

4. Enter a name and a description for the data policy.

5. In the right pane, click Sequence Type. The Add Data Policy popup opens.

6. Select the type of data policy you want to create, Application Firewall, QoS, Traffic Engineering, or Custom.

   Note	If you want to configure multiple types of data policies for the same match condition, you need to configure a custom policy.

7. A policy sequence containing the text string Application, Firewall, QoS, Traffic Engineering, or Custom is added in the left pane.

8. Double-click the text string, and enter a name for the policy sequence. The name you type is displayed both in the Sequence Type list in the left pane and in the right pane.

9. In the right pane, click Sequence Rule. The Match/Action box opens, and Match is selected by default. The available policy match conditions are listed below the box.

   Note

   Adding multiple application matches, subnet matches, or combining several match conditions in a single sequence may increase the total filter count beyond the allowed maximum. If this total filter count is reached, an error message Filter count exceeded MAX (64) is displayed when applying a data policy configuration.

   Match Condition	Procedure
   None (match all packets)	Do not specify any match conditions.
   Applications /Application Family List	In the Match conditions, click Applications/Application Family List. In the drop-down, select the application family. To create an application list: Click New Application List. Enter a name for the list. Click Application to create a list of individual applications. Click Application Family to create a list of related applications. In the Select Application drop-down, select the desired applications or application families. Click Save. This match condition is available for IPv6 traffic from Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco vManage Release 20.9.1.
   Destination Data Prefix	In the Match conditions, click Destination Data Prefix. To match a list of destination prefixes, select the list from the drop-down. To match an individual destination prefix, enter the prefix in the Destination: IP Prefix field.
   Destination Port	In the Match conditions, click Destination Port. In the Destination Port field, enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).
   DNS Application List	Add an application list to enable split DNS. In the Match conditions, click DNS Application List. In the drop-down, select the application family. This match condition is available for IPv6 traffic from Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco vManage Release 20.9.1.
   DNS	Add an application list to process split DNS. In the Match conditions, click DNS. In the drop-down, select Request to process DNS requests for the DNS applications, and select Response to process DNS responses for the applications.
   DSCP	In the Match conditions, click DSCP. In the DSCP field, type the DSCP value, a number from 0 through 63.
   Packet Length	In the Match conditions, click Packet Length. In the Packet Length field, type the length, a value from 0 through 65535.
   PLP	In the Match conditions, click PLP to set the Packet Loss Priority. In the PLP drop-down, select Low or High. To set the PLP to High, apply a policer that includes the exceed remark option.
   Protocol	In the Match conditions, click Protocol. In the Protocol field, type the Internet Protocol number, a number from 0 through 255.
   ICMP Message	To match ICMP messages, in the Protocol field, set the Internet Protocol Number to 1, or 58, or both. Note   This field is available from Cisco IOS XE Release 17.4.1, Cisco vManage Release 20.4.1.
   Source Data Prefix	In the Match conditions, click Source Data Prefix. To match a list of source prefixes, select the list from the drop-down. To match an individual source prefix, enter the prefix in the Source field.
   Source Port	In the Match conditions, click Source Port. In the Source field, enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).
   TCP	In the Match conditions, click TCP. In the TCP field, syn is the only option available.

10. For QoS and Traffic Engineering data policies: From the Protocol drop-down list, select IPv4 to apply the policy only to IPv4 address families, IPv6 to apply the policy only to IPv6 address families, or Both to apply the policy to IPv4 and IPv6 address families.

11. To select one or more Match conditions, click its box and set the values as described.

    Note	Not all match conditions are available for all policy sequence types.

12. To select actions to take on matching data traffic, click the Actions box.

13. To drop matching traffic, click Drop. The available policy actions are listed in the right side.

14. To accept matching traffic, click Accept. The available policy actions are listed in the right side.

15. Set the policy action as described.

    Note	Not all actions are available for all match conditions.

    Note

    If IPv4 packet contains non-initial fragment of UDP or TCP datagram, it has no L4 ports information available because there is no UDP or TCP header. For such fragments destination-port or source-port match is ignored. In the following example, all the UDP packets to destination port 161 and any other IPv4 packets having protocol ID field in IPv4 header set to 17 with IPv4 header having fragment-offset set will be dropped. policy app-visibility access-list SDWAN_101 sequence 100 match destination-port 161 protocol 17 ! action drop ! !

    Action Condition	Description	Procedure
    Counter	Count matching data packets.	In the Action conditions, click Counter. In the Counter Name field, enter the name of the file in which to store packet counters.
    DSCP	Assign a DSCP value to matching data packets.	In the Action conditions, click DSCP. In the DSCP field, type the DSCP value, a number from 0 through 63.
    Forwarding Class	Assign a forwarding class to matching data packets.	In the Match conditions, click Forwarding Class. In the Forwarding Class field, type the class value, which can be up to 32 characters long.
    Log	Minimum release: Cisco vManage Release 20.11.1 and Cisco IOS XE Release 17.11.1a Click Log to enable logging. When (DP, AAR or ACL) data policy packets are configured with log action, logs generated and logged to syslog. Due to the global log-rate-limit, not all logs are logged. A syslog message is generated the first time a packet header is logged and then every 5 minutes thereafter, as long as the flow is active.	In the Action conditions, click Log to enable logging.
    Policer	Apply a policer to matching data packets.	In the Match conditions, click Policer. In the Policer drop-down field, select the name of a policer.
    Loss Correction	Apply loss correction to matching data packets. Forward Error Correction (FEC) recovers lost packets on a link by sending redundant data, enabling the receiver to correct errors without the need to request retransmission of data. FEC is supported only for IPSEC tunnels, it is not supported for GRE tunnels. FEC Adaptive – Corresponding packets are subjected to FEC only if the tunnels that they go through have been deemed unreliable based on measured loss. If you choose FEC Adaptive, an additional field, Loss Threshold, displays that allows you to specify the packet loss threshold for automatically enabling FEC. Adaptive FEC starts to work at 2% packet loss; this value is configurable. You can specify a loss threshold of 1 to 5%. The default packet loss threshold is 2%. FEC Always – Corresponding packets are always subjected to FEC. Packet Duplication – Sends duplicate packets over a single tunnel. If more than one tunnel is available, duplicated packets will be sent over the tunnel with the best parameters.	In the Match conditions, click Loss Correction. In the Loss Correction field, select FEC Adaptive, FEC Always, or Packet Duplication.
    Click Save Match and Actions.

16. Create additional sequence rules as desired. Drag and drop to re-arrange them.

17. Click Save Data Policy.

18. Click Next to move to Apply Policies to Sites and VPNs in the wizard.

For OMP and TLOC routes , you can match the following attributes:

In the CLI, you configure the OMP route attributes to match with the policy control-policy sequence match route command, and you configure the TLOC attributes to match with the policy control-policy sequence match tloc command.

A centralized data policy can match IP prefixes and fields in the IP headers, as well as applications. You can also enable split DNS.

Each sequence in a policy can contain one or more match conditions.

Note

If IPv4 packet contains non-initial fragment of UDP or TCP datagram, it has no L4 ports information available because there is no UDP or TCP header. For such fragments destination-port or source-port match is ignored. In the following example, all the UDP packets to destination port 161 and any other IPv4 packets having protocol ID field in IPv4 header set to 17 with IPv4 header having fragment-offset set will be dropped. policy app-visibility access-list SDWAN_101 sequence 100 match destination-port 161 protocol 17 ! action drop ! !

For each match condition, you configure a corresponding action to take if the route or TLOC matches for a control policy.

In the CLI, you configure actions with the policy control-policy action command.

Each sequence in a centralized control policy can contain one action condition.

In the action, you first specify whether to accept or reject a matching route or TLOC:

Then, for a route or TLOC that is accepted, you can configure the following actions:

Note

The preference command controls the preference for directing inbound and outbound traffic to a tunnel. The preference can be a value from 0 through 4294967295 (232 – 1), and the default value is 0. A higher value is preferred over a lower value. When a Cisco vEdge device has two or more tunnels, if all the TLOCs have the same preference and no policy is applied that affects traffic flow, all the TLOCs are advertised into OMP. When the router transmits or receives traffic, it distributes traffic flows evenly among the tunnels, using ECMP.

When data traffic matches the conditions in the match portion of a centralized data policy, the packet can be accepted or dropped. Then, you can associate parameters with accepted packets.

In the CLI, you configure the action parameters with the policy data-policy vpn-list sequence action command.

Each sequence in a centralized data policy can contain one action condition.

In the action, you first specify whether to accept or drop a matching data packet, and whether to count it:

Note	On Cisco IOS XE Catalyst SD-WAN devices, all the ongoing optimized flows are dropped when the TCP Optimization is removed.

Then, for a packet that is accepted, the following parameters can be configured:

Note

Data policies are applicable on locally generated packets, including routing protocol packets, when the match conditions are generic. Example configuration: sequence 21 match source-ip 10.0.0.0/8 action accept In such situations, it may be necessary to add a sequence in the data policy to escape the routing protocol packets. For example to skip OSPF, use the following configuration: sequence 20 match source-ip 10.0.0.0/8 protocol 89 action accept sequence 21 match source-ip 10.0.0.0/8 action accept

The following table describes the IPv4 and IPv6 actions.

In the Apply Policies to Sites and VPNs page, apply a policy to sites and VPNs:

1. In the Policy Name field, enter a name for the policy. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.

2. In the Policy Description field, enter a description of the policy. It can contain up to 2048 characters. This field is mandatory, and it can contain any characters and spaces.

3. Associate the policy with VPNs and sites. The choice of VPNs and sites depends on the type of policy block:

   1. For a Topology policy block, click New Site List, Inbound Site List, Outbound Site List, or VPN List. Some topology blocks might have no Add buttons. Choose one or more site lists, and choose one or more VPN lists. Click Add.

   2. For an Application-Aware Routing policy block, click New Site List and VPN list. Choose one or more site lists, and choose one or more VPN lists. Click Add.

   3. For a Traffic Data policy block, click New Site List and VPN List. Choose the direction for applying the policy (From Service, From Tunnel, or All), choose one or more site lists, and choose one or more VPN lists. Click Add.

   4. For a cflowd policy block, click New Site List. Choose one or more site lists, and click Add.

4. Click Preview to view the configured policy. The policy appears in CLI format.

5. Click Save Policy. The Configuration > Policies page appears, and the policies table includes the newly created policy.

Note	To use Cisco SD-WAN Manager to configure NAT DIA fallback, Cisco SD-WAN Manager must manage your Cisco Catalyst SD-WAN Controller.

To enable NAT fallback using Cisco SD-WAN Manager, create and configure a data policy by doing the following:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

2. From the Custom options drop-down, under Centralized Policy, select Traffic Policy.

3. Click Traffic Data.

4. From the Add Policy drop-down, clickCreate New.

5. Click Sequence Type and select Custom.

6. Click (+) Sequence Rule to create a new sequence rule.

7. After adding match conditions, click Actions and click Accept.

8. Click NAT VPN and select the Fallback checkbox.

9. Click Save and Match Actions.

10. Click Save Data Policy.

Edit your existing centralized policy and import the policy:

1. Click Centralized Policy and for the required centralized policy, click ... and select Edit.

2. Click Traffic Rules and select Traffic Data.

3. From the Add Policy drop-down, select Import Existing.

4. Select the NAT policy that you created from the Policy drop-down.

5. Click Policy Application and select Traffic Data.

6. Click + New Site List and VPN List.

7. Select the direction, VPN, and site as required.

8. Click Add.

9. Click Save Policy Changes.

10. Click to select VPN, and Site from the drop-down.

Note	Policy configured for the from-tunnel traffic is also applied to the return DIA (Underlay) traffic apart from the return traffic coming over the tunnel. If none of the sequences in that policy match, it matches the default sequence in that policy.

Note	The following NAT fallback actions/commands are now supported: Action: nat fallback When applying a policy: direction from-tunnel

Activating a centralized policy sends that policy to all connected Cisco SD-WAN Controllers. To activate a centralized policy:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Policies. Centralized Policy is selected and displayed by default.

2. For the required policy, click ... and select Activate. The Activate Policy popup appears. It lists the IP addresses of the reachable Cisco SD-WAN Controllers to which the policy must be applied.

3. Click Activate.