Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Configure policies using a configuration group

Updated: April 24, 2026

Want to summarize with AI?

Log in

Provisions localized policies, including Access Control Lists, Quality of Service, and Route Policies, on Cisco IOS XE Catalyst SD-WAN devices using a centralized configuration group. It outlines the procedures for configuring objects, forwarding classes, ACLs, and route policies, and deploying the final configuration to target devices.

Use this task to provision localized policies, such as Access Control Lists (ACLs), Quality of Service (QoS), and Route Policies, on Cisco IOS XE Catalyst SD-WAN devices using a centralized configuration group approach.

Before you begin

  • A configuration group must be created.

  • A Transport & Management profile must be configured.

Follow these steps to configure policies using a configuration group:

Procedure

1.

Configure Objects and Policies using a configuration group. For more information, refer to Configure objects and policies using a configuration group.
2.

Configure Forwarding Classes and QoS using a configuration group. For more information, refer to Configure Forwarding Classes and QoS using a policy group.
3.

Configure ACLs using a configuration group. For more information, refer to Configure ACLs using a configuration group.
4.

Configure route policy using a configuration group. For more information, refer to create-route-policy-cg.

The localized policy is saved to the configuration group and is ready to be applied to the target devices.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Forwarding Classes and QoS using a policy group

Use this task to define forwarding classes and Quality of Service (QoS) maps within a policy group to prioritize network traffic and ensure efficient bandwidth utilization on your Cisco IOS XE Catalyst SD-WAN devices.

Before you begin

A policy group must be created.

Follow these steps to configure forwarding classes and QoS using a policy group:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Policy Groups.
2.

Select the desired policy group and click Edit.
3.

Click Application Priority and SLA.
4.

Click Add Traffic Policy or select an existing policy to edit.
5.

Click Advanced Layout to switch to the advanced view.
6.

Click QoS Queue.
7.

Click Add QoS Policy to define the QoS queue parameters.

Table 1. QoS Queue

Field

Description

Queuing Model

Choose a value from the drop-down list for the queuing model.

Policy Name

Provide a name for the policy.

Interface

Specify a value for the interface.

Forwarding class

Choose a value for the forwarding class from the drop-down list.

Bandwidth %

Specify the maximum bandwidth. The range is 1–99.

Drops

Choose a value for the drop type from the following options:

  • Random Early

  • Tail

Scheduling type

Specify how to prioritize data packets for transmission to the destination by configuring the schedule type. The default is Weighted Round Robin (WRR).
8.

Click Save.

The forwarding classes and QoS maps are saved to the policy group and are ready to be applied to the target devices.

What to do next

Deploy the policy group to the target devices to push the QoS settings to the network. For more information, Deploy Policy Group Workflow.

Configure objects and policies using a configuration group

Use this task to define reusable policy objects, such as AS Path lists, community lists, and prefix lists, within a configuration group. These objects serve as the building blocks for your localized policies.

Before you begin

Follow these steps to configure policy objects within a configuration group:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Select the desired configuration group and click Edit
3.

Click Objects and Profiles.
4.

Perform one of the following tasks based on your requirements:

The policy objects are saved to the configuration group and are available to be referenced in your policy sequences.

What to do next

After defining your policy objects, you can reference them while configuring policies such as Access Control Lists (ACLs) or Route Policies. For more information, refer to Configure policies using a configuration group.

Configure an AS Path list using a configuration group

Use this task to create a list of BGP AS paths that you can reference in route policies to control route acceptance, preference, or advertisement.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured.

Follow these steps to configure an AS Path list:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles
3.

Select the AS Path policy object.
4.

Click Add AS Path.
5.

Enter a Name and Description for the AS Path list.
6.

Enter the AS path number in the AS path list ID field. The range is 1 to 65535.
7.

Enter the AS path in the AS path list field, separating AS numbers with a comma. You can write each AS as a single number or as a regular expression.
8.

Click Save.

The AS Path list is saved to the configuration group and is ready to be referenced in route policy configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Standard Community using a configuration group

Use this task to create a list of standard or expanded BGP communities that you can reference in route policies to control route acceptance or advertisement.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured.

Follow these steps to configure a community list:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles.
3.

Select the Standard Community policy object.
4.

Click Add Standard Community.
5.

Enter a Name and Description for the Standard Community.
6.

In the Standard Community field, enter one or more communities separated by commas. You can use formats such as aa:nn (AS number and network number), internet, local-as, no-advertise, or no-export.

The format example is given in the field.

Field

Description

Standard Community

  • aa:nn: Autonomous System (AS) number and network number. Each number is a 2-byte value with a range from 1 to 65535.

  • internet: Routes in this community are advertised to the Internet community. This community comprises all BGP-speaking networking devices.

  • local-as: Routes in this community are not advertised outside the local AS number.

  • no-advertise: Attaches the NO_ADVERTISE community to routes. Routes in this community are not advertised to other BGP peers.

  • no-export: Attaches the NO_EXPORT community to routes. Routes in this community are not advertised outside the local AS or outside a BGP confederation boundary. To configure multiple BGP communities in a single list, include multiple community options, specifying one community in each option.
7.

Click Save.

The community list is saved to the configuration group and is ready to be referenced in route policy configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Data Prefix using a configuration group

Use this task to create a list of IP prefixes that you can reference in data policies to permit or restrict traffic based on source or destination addresses.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured.

Follow these steps to configure a data prefix list:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles.
3.

Select the Data Prefix policy object.
4.

Click Add Data Prefix.
5.

Enter a Name and Description for Data Prefix.
6.

In the Data Prefix field, enter one or more IP prefixes separated by commas. You can enter IP prefixes for IPv4 or IPv6.
7.

Click Save.

The data prefix list is saved to the configuration group and is ready to be referenced in data policy configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Extended Community using a configuration group

Use this task to create a list of BGP extended communities that you can reference in route policies for advanced route control.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured.

Follow these steps to configure an extended community list:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles.
3.

Select the Extended Community policy object.
4.

Click Add Extended Community.
5.

Enter a Name and Description for Extended Community.
6.

In the Extended Community field, enter the community details.

The format example is given in the field.

Field

Description

Extended Community

  • rt (aa:nn | ip-address)​: Route target community, which is one or more routers that can receive a set of routes carried by BGP. Specify this as the AS number and network number, where each number is a 2-byte value with a range from 1 to 65535, or as an IP address.

  • soo (aa:nn | ip-address)​: Route origin community, which is one or more routers that can inject a set of routes into BGP. Specify this as the AS number and network number, where each number is a 2-byte value with a range from 1 to 65535, or as an IP address. To configure multiple extended BGP communities in a single list, include multiple community options, specifying one community in each option.

The extended community list is saved to the configuration group and is ready to be referenced in route policy configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Class Map using a configuration group

Use this task to create a class map within a configuration group to define forwarding classes and map them to specific queues for Quality of Service (QoS) management.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured.

Follow these steps to configure a class map:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles.
3.

Select the Class Map policy object.
4.

Click Add Class Map.
5.

Enter a Name and Description for Class Map.
6.

Select the required Queue from the drop-down list..
7.

Click Save.

The class map is saved to the configuration group and is ready to be referenced in QoS policy configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Mirror using a configuration group

Use this task to specify source and destination IP addresses for traffic mirroring to facilitate network troubleshooting and traffic analysis.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured.

Follow these steps to configure a mirror list:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles.
3.

Select the Mirror policy object.
4.

Click Add Mirror.
5.

Enter a Name and Description for Mirror.
6.

In the Remote Destination IP field, enter the IP address of the destination for which to mirror the packets.
7.

In the Source IP field, enter the IP address of the source of the packets to mirror.
8.

Click Save.

To configure mirroring parameters, define the remote destination to which to mirror the packets, and define the source of the packets. Mirroring applies to unicast traffic only. It does not apply to multicast traffic.

The mirror list is saved to the configuration group and is ready to be referenced in localized data policy configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Policer using a configuration group

Use this task to define policing parameters, such as rate and burst size, to control traffic flow and prevent network congestion.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured

Follow these steps to configure a policer:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles.
3.

Select the Policer policy object.
4.

Click Add Policer.
5.

Enter a Name and Description for Policer.
6.

In the Burst (bytes) field, enter the maximum traffic burst size in bytes.
7.

In the Exceed drop-down list, choose the action Drop or Remark.
8.

In the Rate (bps), enter the maximum traffic rate in bits per second (bps).

The following table describe the options for configuring the policer.

Field

Description

Burst (bytes)

Specifies the maximum traffic burst size. Range is from 15000 to 10000000.

Exceed

Specifies an action to take when the burst size or traffic rate is exceeded. The options are:

Drop—Sets the packet loss priority (PLP) to low.

Remark—Sets the PLP to high.

The default option is Drop.

Rate

Specifies the maximum traffic rate. It can be a value from 8 through 264 bps (8 through 100000000000).
9.

Click Save.

The policer is saved to the configuration group and is ready to be referenced in data policy or ACL configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure Prefix using a configuration group

Use this task to create a list of IP prefixes that you can reference in policies to match specific network traffic or routes.

Before you begin

  • A configuration group must be created.

  • A Transport and Management profile must be configured.

Follow these steps to configure a prefix list:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Click Objects and Profiles.
3.

Select the Prefix policy object.
4.

Click Add Prefix.
5.

Enter a Name and Description for Prefix.
6.

In the Prefix field, enter one or more IP prefixes separated by commas. You can enter IP prefixes for IPv4 or IPv6.
7.

Under Add Prefix, enter the prefix for the list. Optionally, click the Choose a file link to import a prefix list.
8.

Click Save.

The prefix list is saved to the configuration group and is ready to be referenced in control or data policy configurations.

What to do next

Deploy the configuration group to the target devices to push the localized policy settings to the network. For more information, Deploy a Configuration Group.

Configure ACLs using a configuration group

This task allows you to configure access control lists (ACLs) for both IPv4 and IPv6 traffic using configuration groups, providing granular control over network traffic filtering and management.

ACLs in configuration groups enable centralized management of traffic filtering policies across multiple devices in your SD-WAN deployment.

Before you begin

On the Configuration > Configuration Groups page, choose SD-WAN as the solution type.

Follow these steps to configure ACLs using a configuration group:

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Configuration Groups.
2.

Create and configure an Ethernet Interface feature in a Transport & Management profile.
3.

Click the plus (+) adjacent to the Ethernet Interface feature to display the Add Feature pane.
4.

Add a ACL IPv4 or ACL IPv6 feature to the Ethernet Interface feature.

The following table describe the options for configuring the ACL IPv4 feature.

Table 2. ACL IPv4

Field

Description

ACL Sequence Name

Specifies the name of the ACL sequence.

Condition

Specifies the ACL condition. The options are:

  • DSCP

  • Packet Length

  • Protocol

  • Source Data Prefix

  • Source Port

  • Destination Data Prefix

  • Destination Port

  • TCP

  • ICMP Message (Only in Cisco Catalyst SD-WAN Manager Release 20.15.1)

Action Type

Specifies the action type. The options are: Accept or Reject.

Accept Condition

Specifies the accept condition type. The options are:

  • Counter

  • DSCP

  • Log

  • Next Hop

  • Service Chain

  • Policer

The following table describe the options for configuring the ACL IPv6 feature.

Table 3. ACL IPv6

Field

Description

ACL Sequence Name

Specifies the name of the ACL sequence.

Condition

Specifies the ACL condition. The options are:

  • Next Header

  • Packet Length

  • Source Data Prefix

  • Source Port

  • Destination Data Prefix

  • Destination Port

  • TCP

  • Traffic Class

  • ICMP Message (Only in Cisco Catalyst SD-WAN Manager Release 20.15.1)

Action Type

Specifies the action type. The options are: Accept or Reject.

Accept Condition

Specifies the accept condition type. The options are:

  • Counter

  • Log

  • Next Hop

  • Traffic Class

  • Service Chain

  • Policer
Table 4. Match parameters

Match Condition

Description

Class

Name of a class defined with a policy class-map command.

Destination Data Prefix

Name of a data-prefix-list list.

Destination Port

Specifies a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]). The range is 0 through 65535.

DSCP

Specifies the DSCP value. The range is 0 through 63.

Protocol

Specifies the internet protocol number. The range is 0 through 255.

ICMP Message

When you select a Protocol value as 1 the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

When you select a Next Header value as 58 the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

Note

This field is available from Cisco IOS XE Release 17.4.1, Cisco vManage Release 20.4.1.

For ICMP-msg and icmp6-msg message types, refer to the ICMP Message Types/Codes and Corresponding Enumeration Values table in the Centralized chapter.

Packet Length

Specifies the length of the packet. The range can be from 0 through 65535. Specify a single length, a list of lengths (with numbers separated by a space), or a range of lengths (with the two numbers separated with a hyphen [-]).

Source Data Prefix

Specifies the name of a data-prefix-list list.

PLP

Specifies the Packet Loss Priority (PLP) (high | low). By default, packets have a PLP value of low. To set the PLP value to high, apply a policer that includes the exceed remark option.

Source Port

Specifies a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]). The range is 0 through 65535.

TCP

syn
Table 5. Action parameters

Action Condition

Description

Accept

Accepts the packet. An accepted packet is eligible to be modified by the additional parameters configured in the action portion of the access list.

Counter

Name of a counter. To display counter information, use the show policy access-lists counters command on the Cisco IOS XE Catalyst SD-WAN device.

Drop

Discards the packet. This is the default action.

Description

Value or Range

Class

Specifies the name of a QoS class. It can also be defined with a policy class-map command.

Mirror List

Specifies the name of mirror . It is defined with a policy mirror command.

Policer

Specifies the name of a policer defined with a policy policer command.

DSCP

Specifies the packet's DSCP value. The range is 0 through 63.

Next Hop

Specifies the IPv4 address. It sets the next hop IP address to which the packet should be forwarded.

Note

Starting from Cisco vManage Release 20.5.1 and Cisco IOS XE Catalyst SD-WAN Release 17.5.1a, Use Default Route when Next Hop is not available field is available next to Next Hop action parameter.

The ACL IPv4 or ACL IPv6 feature is successfully added to the Ethernet Interface feature within the configuration group, enabling traffic filtering based on the configured match and action parameters.

What to do next

Also see Deploy a configuration group.

Match parameters

Access lists can match IP prefixes and fields in the IP headers. Route policies can match various routing parameters including BGP attributes and OSPF tags.

Access list parameters

In the CLI, you configure the match parameters with the policy access-list sequence match command.

Each sequence in an access-list must contain one match condition.

Match class in ACL is not supported. You can use rewrite policy to configure DSCP values.

For access lists, you can match these parameters:

Match Condition

Description

Class

Name of a class defined with a policy class-map command.

Destination Data Prefix

Name of a data-prefix-list list.

Destination Port

Specifies a single port number, a list of port numbers (with numbers separated by a space), OR a range of port numbers (with the two numbers separated with a hyphen [-]). The range is 0 through 65535.

DSCP

Specifies the DSCP value. The range is 0 through 63.

Protocol

Specifies the internet protocol number. The range is 0 through 255.

ICMP Message

When you select a Protocol value AS 1 the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

When you select a Next Header value AS 58 the ICMP Message field displays where you can select an ICMP message to apply to the data policy.

Note

This field is available from Cisco IOS XE Release 17.4.1, Cisco vManage Release 20.4.1.

For ICMP-msg and icmp6-msg message types, refer to the ICMP Message Types/Codes and Corresponding Enumeration Values table in the Centralized chapter.

Packet Length

Specifies the length of the packet. The range can be from 0 through 65535. Specify a single length, a list of lengths (with numbers separated by a space), OR a range of lengths (with the two numbers separated with a hyphen [-]).

Source Data Prefix

Specifies the name of a data-prefix-list list.

PLP

Specifies the Packet Loss Priority (PLP) (high | low). By default, packets have a PLP value of low. To set the PLP value to high, apply a policer that includes the exceed remark option.

Source Port

Specifies a single port number, a list of port numbers (with numbers separated by a space), OR a range of port numbers (with the two numbers separated with a hyphen [-]). The range is 0 through 65535.

TCP

syn

Route policy parameters

For route policies, you can match these parameters:

Match Condition

Description

Address

Specifies the name of a Prefix-List list.

AS Path List

Specifies one OR more BGP AS path lists. You can write each AS AS a single number OR AS a regular expression. To specify more than one AS number in a single path, include the list in quotation marks (" "). To configure multiple AS numbers in a single list, include multiple AS Path options, specifying one AS path in each option.

Community List

List of one of more BGP communities. In Community List, you can specify:

• aa:nn: AS number and network number. Each number is a 2-byte value with a range from 1 to 65535.

• internet: Routes in this community are advertised to the Internet community. This community comprises all BGP-speaking networking devices.

• local-AS: Routes in this community are not advertised outside the local AS.

• NO-ADVERTISE: Attach the NO_ADVERTISE community to routes. Routes in this community are not advertised to other BGP peers.

• NO-EXPORT: Attach the NO_EXPORT community to routes. Routes in this community are not advertised outside the local AS OR outside a BGP confederation boundary. To configure multiple BGP communities in a single list, include multiple community options, specifying one community in each option.

Extended Community List

Specifies the list of one OR more BGP extended communities. In community, you can specify:

• rt (aa:nn | IP-address)​: Route target community, which is one OR more routers that can receive a set of routes carried by BGP. Specify this AS the AS number and network number, where each number is a 2-byte value with a range from 1 to 65535, OR AS an IP address.

• soo (aa:nn | IP-address)​: Route origin community, which is one OR more routers that can inject a set of routes into BGP. Specify this AS the AS number and network number, where each number is a 2-byte value with a range from 1 to 65535, OR AS an IP address. To configure multiple extended BGP communities in a single list, include multiple community options, specifying one community in each option.

BGP Local Preference

Specifies the BGP local preference number. The range is 0 through 4294967295.

Metric

Specifies the route metric value. The range is 0 through 4294967295.

Next Hop

Specifies the name of an IP prefix list.

OMP Tag

Specifies the OMP tag number. The range is 0 through 4294967295.

Origin

Specifies the BGP origin code. The optionss are: EGP (default), IGP, Incomplete.

Note

Match origin is available only for Cisco vEdge devices not on Cisco IOS XE Catalyst SD-WAN devices.

OSPF Tag

Specifies the OSPF tag number. The range is 0 through 4294967295.

Peer

Specifies the peer IP address.

Action parameters

Action parameters define how packets are processed when they match conditions in access lists or route policies. For access lists, packets can be accepted or dropped, counted, classified, mirrored, or policed. For route policies, routes can be accepted or rejected with various attribute modifications.

Access list parameters

When a packet matches the conditions in the match portion of an access list, the packet can be accepted or dropped, and it can be counted. Then, you can classify, mirror, or police accepted packets.

In the CLI, you configure the action parameters with the policy access-list sequence action command.

Each sequence in an access list can contain one action condition.

In the action, you first specify whether to accept or drop a matching data packet, and whether to count it:

Action Condition

Description

Accept

Accepts the packet. An accepted packet is eligible to be modified by the additional parameters configured in the action portion of the access list.

Counter

Name of a counter. To display counter information, use the show policy access-lists counters command on the Cisco IOS XE Catalyst SD-WAN device.

Drop

Discards the packet. This is the default action.

For a packet that is accepted, these actions can be configured:

Description

Value or Range

Class

Specifies the name of a QoS class. It can also be defined with a policy class-map command.

Mirror List

Specifies the name of mirror . It is defined with a policy mirror command.

Policer

Specifies the name of a policer defined with a policy policer command.

DSCP

Specifies the packet's DSCP value. The range is 0 through 63.

Next Hop

Specifies the IPv4 address. It sets the next hop IP address to which the packet should be forwarded.

Note

Starting from Cisco vManage Release 20.5.1 and Cisco IOS XE Catalyst SD-WAN Release 17.5.1a, Use Default Route when Next Hop is not available field is available next to Next Hop action parameter.

Route policy parameters

Each sequence in a localized control policy can contain one action condition.

When a route matches the conditions in the match portion of a route policy, the route can be accepted or rejected:

For a packet that is accepted, these actions can be configured:

Description

Value or Range

Aggregator

Sets the AS number in which a BGP route aggregator is located and the IP address of the route aggregator. The range is 1 through 65535.

AS Path

Sets an AS number or a series of AS numbers to exclude from the AS path or to prepend to the AS path. The range is 1 through 65535.

Atomic Aggregate

Sets the BGP atomic aggregate attribute.

Community

Sets the BGP community value.

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.5.1a, the Community Additive option field is available. Additive option appends the communities to the existing communities of the route.

Local Preference

Sets the BGP local preference. The range is 0 through 4294967295.

Metric

Sets the metric value. The range is 0 through 4294967295.

Metric Type

Sets the metric type. The options are type1 or type2.

Next Hop

Sets the IPv4 address. It sets the next hop IP address to which the packet should be forwarded.

Note

Starting from Cisco vManage Release 20.5.1 and Cisco IOS XE Catalyst SD-WAN Release 17.5.1a, Use Default Route when Next Hop is not available field is available next to Next Hop action parameter.

OMP Tag

Sets the OMP tag for OSPF to use. The range is 0 through 4294967295.

Origin

Sets the BGP origin code. The options are: EGP (default), IGP, Incomplete.

Originator

Sets the IP address from which the route was learned.

OSPF Tag

 Sets the OSPF tag value. The range is 0 through 4294967295.

Weight

Sets the BGP weight. The range is 0 through 4294967295.