Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Service insertion configuration workflow for Equinix

Updated: April 24, 2026

Want to summarize with AI?

Lists the workflow steps to configure service insertion for Equinix.

The workflow to configure service insertion for Equinix includes defining and configuring service chains, instantiating service chains, attaching service chains to Cisco SD-WAN devices, and configuring service chain actions for data policies.

Define and configure service chain: Creates a service chain definition. The service chain definition comprises of a service type and the order of the service. After you provide the details in the workflow, Cisco SD-WAN Manager creates a configuration group. You cannot edit the parameters in the configuration group after it's creation.
Instantiate service chain: Instantiates a service chain by deploying an instance of the service in Equinix.
Attach a service chain to the Cisco SD-WAN Device: Attach the service chain to Equinix interconnect gateway.

Detach a service chain instance: Detach the service chain instance from Equinix interconnect gateway
Configure service chain actions for a data policy to route traffic through a service chain. See Configure Service Chain Actions in a Data Policy in Cisco Catalyst SD-WAN Policies Configuration Guide, Cisco IOS XE Catalyst SD-WAN Release 26.x.

Define and configure service chain

Define and configure a service chain to establish network security services using Palo Alto Networks firewall in the Equinix environment.

Service chains enable you to deploy and manage network security services in cloud environments. This task focuses on configuring firewall services within the Equinix platform through the workflows interface.

Before you begin

Follow these steps to define and configure service chain:

Procedure

	1.	In the Cisco SD-WAN Manager menu, click Workflows > Workflows Library > Define and Configure Service Chain.
	2.	Follow the on-screen instructions to complete the service chain definition workflow. Following are some of the parameters in the workflow: In Select Environment page, choose Equinix as the environment for the service chain definition. Choose only firewall as the service type. For each service chain intance you can choose only one Palo Alto Networks firewall. The Size, Flavor, and SW-Version in the workflow refers to the Palo Alto Networks firewall that you choose. The sshPublickey Value is retrieved from the Equinix account that you choose. Enter the management plane bandwidth (Mbps) between the router and the service in the Management Plane field. The name entered in the User Name field is the user name of the Palo Alto Networks firewall credentials. Choose Stateful or Standalone type of HA mode for the service. If you choose Stateful HA mode, ensure that you have the appropriate active licenses to proceed with the instantiation of the service chain.

The service chain definition workflow is completed and the firewall service is configured in the Equinix environment with the specified parameters.

Instantiate service chain

This task enables you to instantiate a service chain through the Cisco SD-WAN Manager Workflows Library, allowing you to deploy and configure network services such as Palo Alto Networks firewall services.

Use this workflow when you need to deploy network service chains in your environment. The workflow provides guided steps to configure service parameters and deploy services through the Equinix platform integration.

Procedure

	1.	In the Cisco SD-WAN Manager menu, click Workflows > Workflows Library > Instantiate Service Chain.
	2.	Follow the on-screen instructions to instantiate the service chain. Following are some of the parameters of the workflow: Ensure that you choose an active Equinix billing account for the service insertion workflow. Ensure that you provide Palo Alto Networks firewall parameters based on your requirements. This workflow only instantiates the Palo Alto Networks firewall service. For any Palo Alto Networks firewall security policies and lifecycle management see the Palo Alto Networks firewall documentation. The Size, Flavor, and SW-Version are retrieved from the Equinix portal based on the selected Equinix account and the Palo Alto Networks firewall you choose in the Instantiate Service Chain workflow.

The service chain is successfully instantiated and deployed in your network environment with the configured parameters.

Attach a service chain to the Cisco SD-WAN device

This task attaches a service chain to a Cisco SD-WAN device to enable service insertion functionality and ensure proper traffic routing through network services.

Service chains enable traffic to be routed through network services before reaching its destination. When attaching service chains to Cisco SD-WAN devices, you can select only one interconnect gateway at a time and should attach the service chain to the appropriate router without needing to attach it to branch routers.

Before you begin

Ensure that you define a tracker. Tracker configuration is critical to avoid blackhauling. Defining a tracker ensures that the service chain is determined to be in the UP state and is used. If the IP address of a service chain firewall is used with an ICMP-based tracker, ensure that the firewall allows ICMP on the appropriate interface.

Follow these steps to attach a service chain to the Cisco SD-WAN device:

Procedure

	1.	In the Cisco SD-WAN Manager menu, click Workflows > Workflows Library > Attach Service Chain to Cisco SD-WAN Router.
	2.	Follow the on-screen instructions to attach the service chain to a Cisco IOS XE Catalyst SD-WAN device. You can select only one interconnect gateway at a time to attach a service chain. Attach the service chain to the appropriate Cisco IOS XE Catalyst SD-WAN device. You dont need to attach the service chain to the branch routers. Note Alternatively, attach the Cisco IOS XE Catalyst SD-WAN device to a service chain using Configuration > Service Insertion > Service Chain Instances. Click ... next to the instance name you wish to attach a device and click Attach. This takes you to the service chain attachment workflow under Workflows > Workflows Library > Attach Service Chain to Cisco SD-WAN Router.

The service chain is successfully attached to the Cisco SD-WAN device, enabling service insertion functionality for traffic routing through network services.

Detach a service chain instance

Detach a device from a service chain instance to remove the service chain configuration and stop applying the configured services to traffic passing through that device.

Use this task when you need to remove a device from a service chain instance, effectively stopping the application of the service chain's configured services on that specific device.

Procedure

	1.	From the Cisco SD-WAN Manager menu, choose Configuration > Service Insertion.
	2.	Click Service Chain Instances to view the list of service chain instances and the devices attached to each instance.
	3.	Click ... adjacent to the instance that you wish to detach the device and choose Detach.
	4.	In the confirmation dialog box, click Detach.

The device is detached from the service chain instance, and the service chain configuration is removed from the device.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.