Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

SAIE flow configuration using Cisco SD-WAN Manager

Updated: April 24, 2026

Want to summarize with AI?

Log in

Describes the sequential wizard screens that guide you through creating and editing SAIE flow policy components.

A SAIE flow configuration using Cisco SD-WAN Manager is a policy configuration process that

  • guides you through creating and editing SD-WAN Application Intelligence Engine (SAIE) flow policy components,

  • uses the Cisco SD-WAN Manager policy configuration wizard with sequential screens, and

  • applies policies to sites and VPNs in the overlay network.

Configuration wizard screens

The wizard consists of the following sequential screens:

  • Create applications or groups of interest—Create lists that group together related items and that you call in the match or action components of a policy. For configuration details, see Configure Groups of Interest.

  • Configure traffic rules—Create the match and action conditions of a policy. For configuration details, see Configure Traffic Rules.

  • Apply policies to sites and VPNs—Associate policy with sites and VPNs in the overlay network.

Apply centralized policy for SAIE flow

Apply a centralized data policy for the SAIE flow to ensure it takes effect across specified sites in the overlay network.

A centralized data policy for the SAIE flow must be applied to a list of sites in the overlay network to ensure proper enforcement. The policy can be applied using either Cisco SD-WAN Manager or the CLI interface.

Procedure

1.

Choose your preferred method to apply the centralized policy.

  • To apply a centralized policy in Cisco SD-WAN Manager, see Configure Centralized Policy Using Cisco SD-WAN Manager.
  • To apply a centralized policy using the CLI, continue with the next step.
2.

Apply the data policy using the CLI command.

Example:

vSmart(config)# apply-policy site-list list-name data-policy policy-name (all | from-service | from-tunnel)

By default, data policy applies to all data traffic passing through the Cisco Catalyst SD-WAN Controller: the policy evaluates all data traffic going from the local site (that is, from the service side of the router) into the tunnel interface, and it evaluates all traffic entering to the local site through the tunnel interface. You can explicitly configure this behavior by including the all option. To have the data policy apply only to policy exiting from the local site, include the from-service option. To have the policy apply only to incoming traffic, include the from-tunnel option.

You cannot apply the same type of policy to site lists that contain overlapping site IDs. That is, all data policies cannot have overlapping site lists among themselves. If you accidentally misconfigure overlapping site lists, the attempt to commit the configuration on the Cisco Catalyst SD-WAN Controller fails.

The centralized data policy for the SAIE flow is successfully applied to the specified sites and is actively enforcing policy rules on data traffic passing through the network.

Monitor running applications

Enable the SAIE infrastructure to gain visibility into application traffic and monitor running applications on your network devices.

Application visibility is required to enable the Service Assurance and Insights Engine (SAIE) infrastructure on Cisco vEdge devices for monitoring network applications.

Note

In Cisco Cisco SD-WAN Release 20.7.x and earlier releases, the SAIE flow is called the deep packet inspection (DPI) flow.

Before you begin

Follow these steps to monitor running applications:

Procedure

1.

Enable application visibility on the device.

Example:

vEdge(config)# policy app-visibility
2.

Display information about the running applications using the appropriate show commands.

Use the show app DPI supported-applications, show app DPI applications, and show app DPI flows commands on the device.

Application visibility is enabled on the device, and you can view information about supported applications, active applications, and application flows using the show commands.

View SAIE applications

This task allows you to view the list of all application-aware applications supported by the Cisco SD-WAN Manager software on the router.

Use this task to monitor and review SAIE applications running on your SD-WAN devices through the Cisco SD-WAN Manager interface.

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Monitor > Devices.

Cisco vManage Release 20.6.x and earlier: From the Cisco SD-WAN Manager menu, choose Monitor > Network.
2.

Click WAN-Edge, select the Device that supports the SD-WAN Application Intelligence Engine (SAIE) flow.

The Cisco SD-WAN Manager Control Connections page is displayed.
3.

In the left pane, select Real Time to view the device details.
4.

From the Device Options drop-down, choose SAIE Applications to view the list of applications running on the device.
5.

From the Device Options drop-down, choose SAIE Supported Applications to view the list of applications that are supported on the device.

You can now view the SAIE applications running on the selected device and the list of supported applications.

Action parameters for configuring SAIE flow

When data traffic matches the conditions in the match portion of a centralized data policy, the packet can be accepted or dropped, and it can be counted. Then, you can associate parameters with accepted packets.

Configuration access

From the Cisco SD-WAN Manager menu, you can configure match parameters from:

  • Configuration > Policies > Centralized Policy > Add Policy > Configure Traffic Rules > (Application-Aware Routing | Traffic Data | Cflowd) > Sequence Type > Sequence Rule > Action

  • Configuration > Policies > Custom Options > Centralized Policy > Traffic Policy > (Application-Aware Routing | Traffic Data | Cflowd) > Sequence Type > Sequence Rule > Action.

In the CLI, you configure the action parameters under the policy data-policy VPN-list sequence action command.

Each sequence in a centralized data policy can contain one action condition.

Basic action parameters

In the action, you first specify whether to accept or drop a matching data packet, and whether to count it:

Description Cisco SD-WAN Manager

CLI command

 Value or Range
Accept the packet. An accepted packet is eligible to be modified by the additional parameters configured in the action portion of the policy configuration.

Click Accept.

accept

—
Count the accepted or dropped packets.

Action Counter

Click Accept, then action Counter

count counter-name

Name of a counter. Use the show policy access-lists counters command on the Cisco device.
Discard the packet. This is the default action.

Click Drop

drop

—

To view the packet logs, use the show app log flow and show log commands.

Parameters for accepted packets

Then, for a packet that is accepted, the following parameters can be configured.

Description Cisco SD-WAN Manager CLI Command Value or Range
DSCP value.

Click Accept, then action DSCP.

set DSCP value

0 through 63
Forwarding class.

Click Accept, then action Forwarding Class.

set forwarding-class name

Text
Next hop. Specify the IP address of the next-hop router for traffic that matches the match criteria. The next-hop router must be directly connected to the local router.

Click Accept, then action Next Hop.

set next-hop IP-address

IP address
Policer. Limit the bandwidth used by the traffic flow.

Click Accept, then action Policer.

set policer name

Name of a policer configured using the policy policer command
Traffic-engineering path. Specify a path for the traffic to follow. The traffic is placed in a traffic-engineering tunnel.

Click Accept, then action Traffic Engineering.

set traffic-engineering path name

Name of a traffic-engineering path configured with the policy traffic-engineering path command
VPN. Redirect matching traffic to a specific VPN. The redirected traffic is routed to the VPN based on the VPN's route table.

Click Accept, then action VPN.

set VPN VPN-id

0 through 65530

If a data packet being evaluated does not match any of the match conditions in a data policy, a default action is applied to the packet. By default, the data packet is dropped.

From the Cisco SD-WAN Manager menu, you modify the default action from Configuration > Policies > Centralized Policy > Add Policy > Configure Traffic Rules > Application-Aware Routing > Sequence Type > Sequence Rule > Default Action.

In the CLI, you modify the default action with the policy data-policy VPN-list default-action accept command.