Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Configure device access policy using the CLI

Updated: September 23, 2026

Want to summarize with AI?

Log in

Configure device access policies to control network access and enhance security by restricting connections based on specified criteria.

Configure device access policies to control and restrict access to network devices based on specified criteria such as IP addresses, ports, and protocols.

Procedure

  1. Configure the SNMP access control list and community settings.

    Example:

    ip access-list standard snmp-acl
 1 permit 10.0.1.12 255.255.255.0
 11 deny any
!
    snmp-server community private view v2 ro snmp-acl

  2. Configure the SSH access control list and apply it to VTY lines.

    Example:

    ip access-list extended ssh-acl
 1 permit tcp host 10.0.1.12 any eq 22
 11 deny tcp any any eq 22
!
    line vty 0 4
 access-class ssh-acl in vrf-also
!

Note

IPv6 prefix match is not supported on Cisco IOS XE Catalyst SD-WAN devices.

The device access policies are now configured and will control access to the network devices based on the specified rules and criteria.

Configure IPv4 device access policy using configuration groups

Configure an IPv4 device access policy to control network access based on IPv4 addresses and sequences within a configuration group.

Use configuration groups to create reusable policy configurations that can be applied across multiple devices in your SD-WAN network.

Before you begin

On the Configuration > Configuration Groups page, choose SD-WAN as the solution type.

Follow these steps to configure an IPv4 device access policy using configuration groups:

Procedure

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

  2. Create and configure IPv4 Device Access Policy in a System profile.

    1. Configure the basic settings.
      Table 1. Basic Settings

      Field

      Description

      Type

      Choose a feature from the drop-down list.

      Feature Name*

      Enter a name for the feature. The name can be up to 128 characters and can contain only alphanumeric characters.

      Description

      Enter a description of the feature. The description can be up to 2048 characters and can contain only alphanumeric characters.
    2. Configure the ACL sequence settings.
      Table 2. ACL Sequence

      Field

      Description

      ACL Sequence Name

      Enter a name for the ACL Sequence.

      Action Type

      Choose one of the following actions for the ACL policy:

      • Accept

      • Drop

      Default Action

      The Default Action in the left pane is to drop the packets. Change the default action by clicking the ellipsis (...) icon.
      Condition

      • Device Access Protocol (required): Choose a carrier from the drop-down list. For example, SNMP, SSH.

      • Source Data Prefix: Select an existing source data prefix or provide a source IP address. For example, 10.0.0.0/12.

      • Source Port: Enter the list of source ports when you have chosen SSH as the device access protocol. The range is 0 through 65535.

      • Destination Data Prefix: Select an existing destination data prefix or provide a destination IP address when you have chosen SSH as the device access protocol. For example, 10.0.0.0/12.

The IPv4 device access policy is configured within the System profile and can be deployed to devices through configuration groups.

What to do next

Also see Deploy a Configuration Group.

Configure IPv6 device access policy using configuration groups

This task enables you to configure IPv6 device access policies using configuration groups, providing centralized management and deployment of security policies across SD-WAN devices.

IPv6 device access policies control which devices can access network resources over IPv6 connections. Configuration groups provide a template-based approach to deploy these policies consistently across multiple devices in your SD-WAN network.

Before you begin

On the Configuration > Configuration Groups page, choose SD-WAN as the solution type.

Follow these steps to configure IPv6 device access policy using configuration groups:

Procedure

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.

  2. Create and configure IPv6 Device Access Policy in a System profile.

    Table 3. IPv6 Device Access Policy

    Field

    Description

    Add ACL Sequence

    ACL Sequence Name

    Enter a name for the ACL Sequence.

    Action Type

    Choose one of the following actions for the ACL policy:

    • Accept

    • Drop

    Default Action

    The Default Action in the left pane is to drop the packets. Change the default action by clicking the ellipsis (...) icon.
    Condition

    • Device Access Protocol (required): Choose a carrier from the drop-down list. For example, SNMP, SSH.

    • Source Data Prefix: Select an existing source data prefix or provide a source IP address. For example, 10.0.0.0/12.

    • Source Port: Enter the list of source ports when you have chosen SSH as the device access protocol. The range is 0 through 65535.

    • Destination Data Prefix: Select an existing destination data prefix or provide a destination IP address when you have chosen SSH as the device access protocol. For example, 10.0.0.0/12.

The IPv6 device access policy is configured within the configuration group and ready for deployment to SD-WAN devices.

What to do next

Also see Deploy a Configuration Group.

Configure device access policy using localized policy

Configure device access policy to handle SNMP and SSH traffic directed towards the control plane on s using destination ports based on the device access policy.

Cisco IOS XE Catalyst SD-WAN devices support device access policy configuration to handle SNMP and SSH traffic directed towards the control plane. Use Cisco SD-WAN Manager to configure destination ports based on the device access policy.

Note

In order to allow connections to devices from Tools > SSH Terminal in Cisco SD-WAN Manager, create a rule to accept Device Access Protocol as SSH and Source Data Prefix as 192.168.1.5/32.

Before you begin

Configure specific or all components depending on the specific policy you are creating. To skip a component, click the Next button. To return to a component, click the Back button at the bottom of the screen.

Follow these steps to configure device access policy using localized policy:

Procedure

  1. From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

  2. Click Localized Policy and from the Custom Options drop-down, under Localized Policy, select Access Control Lists.

  3. From the Add Device Access Policy drop-down list, select Add IPv4 Device Access Policy or Add IPv6 Device Access Policy option to add a device.

    Note

    From Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco SD-WAN Release 20.9.1, if you configure an IPv4 or an IPv6 device access policy with no policy sequences and only a default action of Accept or Drop, the device access policy creates an SSH and an SNMP configuration. You can now create a device access policy with only a default action and with no policy sequences to create a device configuration or a Cisco SD-WAN Manager configuration for both SSH and SNMP.

    If you do not create an SNMP server configuration, the SNMP configuration created by the device access policy is unused.

    Prior to Cisco IOS XE Catalyst SD-WAN Release 17.9.1a and Cisco SD-WAN Release 20.9.1, if you configured a device access policy with only a default action of Accept or Drop and with no policy sequences, the device access policy would not create a device configuration or a Cisco SD-WAN Manager configuration.

  4. Select Add IPv4 Device Access Policy from the drop-down list to add an IPv4 ACL PolicyThe edit Device IPv4 ACL Policy page appears.

  5. Enter the name and the description for the new policy.

  6. Click Add ACL Sequence to add a sequence.The Device Access Control List page is displayed.

  7. Click Sequence Rule. Match and Actions options are displayed.

  8. Click Match, select and configure the following conditions for your ACL policy:

    Match Condition

    Description

    Device Access Protocol

    Select a carrier from the drop-down list. For example SNMP, SSH.

    Source Data Prefix

    		 Enter the source IP address. For example, 10.0.0.0/12.

    Source Port

    Enter the list of source ports. The range is 0-65535.

    Destination Data Prefix

    Enter the destination IP address. For example, 10.0.0.0/12.

    VPN

    Enter the VPN ID. Range: 1 to 65525, excluding 512. For details see the VRF range behavior change described here.

  9. Click Actions to configure the action conditions.

  10. Click Accept or Drop to accept or drop packets, respectively.

  11. Click Counter if you want to count the packets that match the ACL policy criteria.

    By default, the counter is incremented when a packet matches all the conditions of the match criteria. From the Counter Name drop-down list, select the name of the counter, or click Global to choose from a list of already configured counters.

  12. Click Log to enable logging of packets that match the ACL policy criteria.

  13. Click Save Match And Actions to save all the conditions for the ACL policy.

  14. Click Save Device Access Control List Policy to apply the selected match conditions to an action.

  15. If no packets match, then any of the route policy sequence rules. The Default Action in the left pane is to drop the packets.

Note
IPv6 prefix match is not supported on Cisco IOS XE Catalyst SD-WAN devices. When you try to configure IPv6 prefix matches on these devices, Cisco SD-WAN Manager fails to generate device configuration.