Configure centralized policies

Create a list of overlay network sites to which the centralized control policy is to be applied (in the apply-policy command):​

vSmart(config)# policy​
vSmart(config-policy)# lists site-list list-name
vSmart(config-lists-list-name)# site-id site-id

Create lists of IP prefixes, TLOCs, and VPNs as needed:​

vSmart(config)# policy lists    
vSmart(config-lists)# prefix-list list-name     
vSmart(config-lists-list-name)# ip-prefix prefix/length  
vSmart(config)# policy lists    
vSmart(config-lists)# tloc-list list-name    
vSmart(config-lists-list-name)# tloc address 
color color
encap encapsulation 
[preference value]    
vSmart(config)# policy lists    
vSmart(config-lists)# vpn-list list-name    
vSmart(config-lists-list-name)# vpn vpn-id

vsmart(config)# policy lists data-ipv6-prefix-list dest_ip_prefix_list
vsmart(config-data-ipv6-prefix-list-dest_ip_prefix_list)# ipv6-prefix 2001:DB8::/32
vsmart(config-data-ipv6-prefix-list-dest_ip_prefix_list)# commit
Commit complete.

vsmart(config)# policy data-policy data_policy_1 vpn-list vpn_1
vsmart (config-sequence-100)# match destination-data-ipv6-prefix-list dest_ip_prefix_list
vsmart (config-match)# commit
vsmart(config-match)# exit
vsmart(config-sequence-100)# match source-data-ipv6-prefix-list dest_ip_prefix_list
vm9(config-match)# commit
Commit complete.
vm9(config-match)# end

vsmart(config)# policy
vsmart(config-policy)#  data-policy data_policy_1
vsmart(config-data-policy-data_policy_1)# vpn-list vpn_1
vsmart(config-vpn-list-vpn_1)# sequence 101
vsmart(config-sequence-101)# match source-ipv6 2001:DB8::/32
vsmart(config-match)# exit
vsmart(config-sequence-101)# match destination-ipv6 2001:DB8::/32
vsmart(config-match)#

Create a control policy instance:

vSmart(config)# policy control-policy policy-name    
vSmart(config-control-policy-policy-name)#

Create a series of match–action pair sequences:

vSmart(config-control-policy-policy-name)# sequence
number    
vSmart(config-sequence-number)# 

Define match parameters for routes and for TLOCs:

​​vSmart(config-sequence-number)# match route route-parameter    
vSmart(config-sequence-number)# match tloc tloc-parameter

Define actions to take when a match occurs:

vSmart(config-sequence-number)# action reject    
vSmart(config-sequence-number)# action accept export-to (vpn
vpn-id | vpn-list list-name)    
vSmart(config-sequence-number)# action accept set omp-tag
number

vSmart(config-sequence-number)# action accept set
preference value

vSmart(config-sequence-number)# action accept set
service service-name 
(tloc ip-address | 
tloc-list list-name) 
[vpn vpn-id]

vSmart(config-sequence-number)# action accept set tloc
ip-address
color color 
[encap encapsulation]    
vSmart(config-sequence-number)# action accept set tloc-action
action

vSmart(config-sequence-number)# action accept set tloc-list list-name

Create additional numbered sequences of match–action pairs within the control policy, as needed.

If a route does not match any of the conditions in one of the sequences, it is rejected by default. If you want nonmatching routes to be accepted, configure the default action for the policy:

vSmart(config-policy-name)# default-action accept

Apply the policy to one or more sites in the Cisco Catalyst SD-WAN overlay network:

vSmart(config)# apply-policy site-list
list-name
control-policy
policy-name (in | out)

If the action you are configuring is a service, configure the required services on the Cisco IOS XE Catalyst SD-WAN device so that the Cisco Catalyst SD-WAN Controller knows how to reach the services:

vsmart(config)# policy data-policy data_policy_1 vpn-list vpn_1 sequence 100
vsmart(config-sequence-100)# action accept set next-hop-ipv6 2001:DB8::/32
vsmart(config-set)#

Create a list of overlay network sites to which the VPN membership policy is to be applied (in the apply-policy command):

vSmart(config)# policy​ 
vSmart (config-policy)# lists site-list list-name 
vSmart(config-lists-list-name)# site-id site-id

Create lists of IP prefixes and VPNs, as needed:

vSmart(config)# policy lists 
vSmart(config-lists)# data-prefix-list list-name
vSmart(config-lists-list-name)# ip-prefix prefix/length

vSmart(config)# policy lists
vSmart(config-lists)# vpn-list list-name
vSmart(config-lists-list-name)# vpn vpn-id

vsmart(config)# policy lists data-ipv6-prefix-list dest_ip_prefix_list
vsmart(config-data-ipv6-prefix-list-dest_ip_prefix_list)# ipv6-prefix 2001:DB8:19::1
vsmart(config-data-ipv6-prefix-list-dest_ip_prefix_list)# commit
Commit complete.

vsmart(config)# policy data-policy data_policy_1 vpn-list vpn_1
vsmart (config-sequence-100)# match destination-data-ipv6-prefix-list dest_ip_prefix_list
vsmart (config-match)# commit
vsmart(config-match)# exit
vsmart(config-sequence-100)# match source-data-ipv6-prefix-list dest_ip_prefix_list
vm9(config-match)# commit
Commit complete.
vm9(config-match)# end

vsmart(config)# policy
vsmart(config-policy)# data-policy data_policy_1
vsmart(config-data-policy-data_policy_1)# vpn-list vpn_1
vsmart(config-vpn-list-vpn_1)# sequence 101
vsmart(config-sequence-101)# match source-ipv6 2001:DB8:19::1
vsmart(config-match)# exit
vsmart(config-sequence-101)# match destination-ipv6 2001:DB8:19::1
vsmart(config-match)#

Create lists of TLOCs, as needed.

vSmart(config)# policy​
vSmart(config-policy)# lists tloc-list list-name
vSmart(config-lists-list-name)# tloc ip-address color color encap encapsulation [preference number}

Define policing parameters, as needed:

vSmart(config-policy)# policer policer-name
vSmart(config-policer)# rate bandwidth
vSmart(config-policer)# burst bytes
vSmart(config-policer)# exceed action

Create a data policy instance and associate it with a list of VPNs:

vSmart(config)# policy data-policy policy-name
vSmart(config-data-policy-policy-name)# vpn-list list-name

Create a series of match–pair sequences:

vSmart(config-vpn-list)# sequence number
vSmart(config-sequence-number)# 

Define match parameters for packets:

​​vSmart(config-sequence-number)# match parameters

Define actions to take when a match occurs:

vSmart(config-sequence-number)# action (accept | drop) [count counter-name] [log] [tcp-optimization]
vSmart(config-sequence-number)# action acccept nat [pool number] [use-vpn 0]
vSmart(config-sequence-number)# action accept redirect-dns (host | ip-address)
vSmart(config-sequence-number)# action accept set parameters

vsmart(config)# policy data-policy data_policy_1 vpn-list vpn_1 sequence 100
vsmart(config-sequence-100)# action accept set next-hop-ipv6 2001:DB8:19::1
vsmart(config-set)#

Create additional numbered sequences of match–action pairs within the data policy, as needed.

If a route does not match any of the conditions in one of the sequences, it is rejected by default. To accept nonmatching prefixed, configure the default action for the policy:

vSmart(config-policy-name)# default-action accept

Apply the policy to one or more sites in the overlay network:

vSmart(config)# apply-policy site-list list-name data-policy policy-name (all |from-service | from-tunnel)

From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

Click Centralized Policy.

Click Add Policy.

Configure application:

1. In the groups of interest list, click Application list type.

2. Click New Application List.

3. Enter a name for the list.

4. Choose either Application or Application Family.

   Application can be the names of one or more applications, such as Third Party Control, ABC News, Mircosoft Teams, and so on. The Cisco IOS XE Catalyst SD-WAN devices support about 2300 different applications. To list the supported applications, use the ? in the CLI.

   Application Family can be one or more of the following: antivirus, application-service, audio_video, authentication, behavioral, compression, database, encrypted, erp, file-server, file-transfer, forum, game, instant-messaging, mail, microsoft-office, middleware, network-management, network-service, peer-to-peer, printer, routing, security-service, standard, telephony, terminal, thin-client, tunneling, wap, web, and webmail.

   Note

   A single app-list can hold either app names or application families. It cannot hold more than 10 application families. When you try to put an application in atmost one app-list. When you have to reuse the application, keep the number of shared applications less than or equal to 10. Keep the number of lists in an applictaion less than or equal to five. Do not keep more than one shared app in the same list.

5. In the Select drop-down, in the 'Search' filter, select the required applications or application families.

   A few application lists are preconfigured. You cannot edit or delete these lists.

   Microsoft_Apps—Includes Microsoft applications, such as Excel, Skype, and Xbox. To display a full list of Microsoft applications, click the list in the Entries column.

   Google_Apps—Includes Google applications, such as Gmail, Google maps, and YouTube. To display a full list of Google applications, click the list in the Entries column.

Configure color:

1. In the groups of interest list, click Color.

2. Click New Color List.

3. Enter a name for the list.

4. In the Select Color drop-down, in the 'Search' filter select the required colors.

   Colors can be: 3g, biz-internet, blue, bronze, custom1 through custom3, default, gold, green, lte, metro-ethernet, mpls, private1 through private6, public-internet, red, and silver.

5. Click Add.

   To configure multiple colors in a single list, you can select multiple colors from the drop-down.

Configure community:

1. In the group of interest list, click Community.

2. Click New Community List.

3. Enter a name for the community list.

4. Choose either Standard or Expanded.

   • Standard community lists are used to specify communities and community numbers.

   • Expanded community lists are used to filter communities using a regular expression. Regular expressions are used to specify patterns to match community attributes.

5. In the Add Community field, enter one or more data prefixes separated by commas in any of the following formats:

   • aa:nn: Autonomous System (AS) number and network number. Each number is a 2-byte value with a range from 1 to 65535.

   • internet: Routes in this community are advertised to the internet community. This community comprises all BGP-speaking networking devices.

   • local-as: Routes in this community are not advertised outside the local AS number.

   • no-advertise: Attaches the NO_ADVERTISE community to routes. Routes in this community are not advertised to other BGP peers.

   • no-export: Attaches the NO_EXPORT community to routes. Routes in this community are not advertised outside the local AS or outside a BGP confederation boundary. To configure multiple BGP communities in a single list, include multiple community options, specifying one community in each option.

6. Click Add.

Configure data prefix:

1. In the Groups of Interest list, click Data Prefix.

2. Click New Data Prefix List.

3. Enter a name for the list.

4. Choose either IPv4 or IPv6.

5. In the Add Data Prefix field, enter one or more data prefixes separated by commas.

6. Click Add.

Configure policer:

1. In the groups of interest list, click Policer.

2. Click New Policer List.

3. Enter a name for the list.

4. Define the policing parameters:

   1. In the Burst field, enter the maximum traffic burst size, a value from 15,000 to 10,000,000 bytes.

   2. In the Exceed field, select the action to take when the burst size or traffic rate is exceeded. It can be drop, which sets the packet loss priority (PLP) to low.

      You can use the remark action to set the packet loss priority (PLP) to high.

   3. In the Rate field, enter the maximum traffic rate, a value from 0 through 2⁶⁴ – 1 bits per second (bps).

5. Click Add.

   Note

   For ACL or data policy, even if the same policer object is used in different sequences, each sequence is policed separately. For example, consider that policer rate is 1000000 or 1Mb. If the same policer is set for multiple sequences then each sequence polices 1Mb traffic. If there are different policers configured for difference sequences, then each policer polices traffic based on the respective policing rate.

Configure prefix:

1. In the groups of interest list, click Prefix.

2. Click New Prefix List.

3. Enter a name for the list.

4. In the Add Prefix field, enter one or more data prefixes separated by commas.

5. Click Add.

Configure site:

1. In the groups of interest list, click Site.

2. Click New Site List.

3. Enter a name for the list.

4. In the Add Site field, enter one or more site IDs separated by commas.

   For example, 100 or 200 separated by commas or in the range, 0 - 4294967295.

5. Click Add.

Configure app probe class:

1. In the groups of interest list, click App Probe Class.

2. Click New App Probe Class.

3. Enter the probe class name in the Probe Class Name field.

4. Select the required forwarding class from the Forwarding Class drop-down list.

5. In the Entries pane, select the appropriate color from the Color drop-down list and enter the DSCP value.

   You can add more entries if needed by clicking on the + symbol.

6. Click Save.

Configure SLA class:

1. In the groups of interest list, click SLA Class.

2. Click New SLA Class List.

3. Enter a name for the list.

4. Define the SLA class parameters:

   1. In the Loss field, enter the maximum packet loss on the connection, a value from 0 through 100 percent.

   2. In the Latency field, enter the maximum packet latency on the connection, a value from 0 through 1,000 milliseconds.

   3. In the Jitter field, enter the maximum jitter on the connection, a value from 1 through 1,000 milliseconds.

   4. Select the required app probe class from the App Probe Class drop-down list.

5. (Optional) Select the Fallback Best Tunnel checkbox to enable the best tunnel criteria.

   This optional field is available from Cisco IOS XE Catalyst SD-WAN Release 17.5.1a to pick the best path or color from the available colors when SLA is not met. When this option is selected, you can choose the required criteria from the drop-down. The criteria are a combination of one or more of losses, latency, and, jitter values.

6. Select the Criteria from the drop-down list. The available criteria are:

   • Latency

   • Loss

   • Jitter

   • Latency, Loss

   • Latency, Jitter

   • Loss, Latency

   • Loss, Jitter

   • Jitter, Latency

   • Jitter, Loss

   • Latency, Loss, Jitter

   • Latency, Jitter, Loss

   • Loss, Latency, Jitter

   • Loss, Jitter, Latency

   • Jitter, Latency, Loss

   • Jitter, Loss, Latency

7. Enter the Loss Variance (%), Latency Variance (ms), and the Jitter Variance (ms) for the selected criteria.

8. Click Add.

Configure TLOC:

1. In the groups of interest list, click TLOC.

2. Click New TLOC List. The TLOC List popup displays.

3. Enter a name for the list.

4. In the TLOC IP field, enter the system IP address for the TLOC.

5. In the Color field, select the TLOC's color.

6. In the Encap field, select the encapsulation type.

7. In the Preference field, optionally select a preference to associate with the TLOC.

   The range is 0 to 4294967295.

8. Click Add TLOC to add another TLOC to the list.

9. Click Save.

   Note

   To use the set tloc and set tloc-list commands, you must use the set-vpn command.

   For each TLOC, specify its address, color, and encapsulation. Optionally, set a preference value (from 0 to 232 – 1) to associate with the TLOC address. When you apply a TLOC list in an action accept condition, when multiple TLOCs are available and satisfy the match conditions, the TLOC with the highest preference value is used. If two or more TLOCs have the highest preference value, traffic is sent among them in an ECMP fashion.

   If IPsec preference is set on the local preferred color for an edge router, the local TLOC and the color does not overlap with the centralized policy configured with local color preference. The edge router with local TLOC preference takes the precedence. In this case, the preferred TLOC configured in centralized policy is not considered.

Configure VPN:

1. In the groups of interest list, click VPN.

2. Click New VPN List.

3. Enter a name for the list.

4. In the Add VPN field, enter one or more VPN IDs separated by commas.

   For example, 100 and 200 separated by commas. Range: 1 to 65525, excluding 512. For details see the VRF range behavior change described here.

   Click Add.

Configure region:

1. In the groups of interest list, click Region.

2. Click New Region List.

3. In the Region List Name field, enter a name for the region list.

4. In the Add Region field, enter one or more regions, separated by commas, or enter a range.

   For example, specify regions 1, 3 with commas, or a range 1-4.

5. Click Add.

   Click Next to move to Configure Topology and VPN Membership in the wizard.

Configure preferred color group:

1. In the groups of interest list, click Preferred Color Group.

2. Click New Preferred Color Group.

3. In the Preferred Color Group Name field, enter a name for the preferred color group.

4. In the Primary Colors pane, do the following:

   1. Choose the color preference from the Color Preference drop-down list.

   2. Choose the path preference from the Path Preference drop-down list.

   Field	Description
   Preferred Color Group Name	Enter a name of the preferred color group.
   Color Preference	Choose the color preference from the drop-down list. The options are: default 3g biz-internet blue bronze custom1 custom2, and so on You can select multiple colors.
   Path Preference	Choose the path preference from the drop-down list. The options are: Direct Path: Use only a direct path between the source and the destination devices. Multi Hop Path: In a Multi-Region Fabric network, use a multi-hop path, which includes the core region, between the source and destination devices, even if a direct path is available. All Paths: Use any path between the source and destination devices. Note This option is equivalent to not configuring path preference at all. If you are applying the policy to a non-Multi-Region Fabric network, use this option.

5. In the Secondary Colors pane, do the following:

   1. Choose the color preference in the Color Preference drop-down list.

   2. Choose the path preference from the Path Preference drop-down list.

6. In the Tertiary Colors pane, do the following:

   1. Choose the color preference from the Color Preference drop-down list.

   2. Choose the path preference from the Path Preference drop-down list.

7. Click Add.

   The following guidelines are helpful when configuring the ranking for colors:

   • Primary preference is mandatory, and at each priority level, at least one preference path or color is mandatory. Both can also be configured.

   • More than one color can be configured as a preference.

   • If path preference is not configured, all paths are constrained by the preferred colors that are available.

   • If color preference is not configured within the constraint of the path preference, then all the colors are available.

   • The preferences apply in order of priority to determine the path or color for forwarding traffic.

   When the primary, secondary, and tertiary colors are down, packets are not dropped. The traffic falls back to the usual routing preference to choose if any other colors are up.

Configure a hub-and-spoke topology.

Configure a mesh topology.

Configure a custom control policy for route control.

Configure a custom control policy for TLOC control.

In the Add Topology drop-down, click Import Existing Topology.

Select the type of topology.

For Policy Type, choose the name of the topology you want to import.

In the Policy drop-down, select a policy to import.

Click Import.

Click Next to move to Configure Traffic Rules in the wizard.

In the Specify your network topology area, click VPN Membership.

Click Add VPN Membership Policy.

Enter a name and description for the VPN membership policy.

In the Site List field, select the site list.

In the VPN Lists field, select the VPN list.

Click Add List to add another VPN to the VPN membership.

Click Save.

Click Next to move to Configure Traffic Rules in the wizard.

Click Traffic Data.

Click the Add Policy drop-down.

Click Create New. The Add Data Policy window displays.

Enter a name and a description for the data policy.

In the right pane, click Sequence Type. The Add Data Policy popup opens.

Select the type of data policy you want to create, Application Firewall, QoS, Traffic Engineering, or Custom.

A policy sequence containing the text string Application, Firewall, QoS, Traffic Engineering, or Custom is added in the left pane.

Double-click the text string, and enter a name for the policy sequence. The name you type is displayed both in the Sequence Type list in the left pane and in the right pane.

In the right pane, click Sequence Rule. The Match/Action box opens, and Match is selected by default. The available policy match conditions are listed below the box.

For QoS and Traffic Engineering data policies: From the Protocol drop-down list, select IPv4 to apply the policy only to IPv4 address families, IPv6 to apply the policy only to IPv6 address families, or Both to apply the policy to IPv4 and IPv6 address families.

To select one or more Match conditions, click its box and set the values as described.

To select actions to take on matching data traffic, click the Actions box.

To drop matching traffic, click Drop. The available policy actions are listed in the right side.

To accept matching traffic, click Accept. The available policy actions are listed in the right side.

Set the policy action as described.

Create additional sequence rules as desired. Drag and drop to re-arrange them.

Click Save Data Policy.

Click Next to move to Apply Policies to Sites and VPNs in the wizard.

In the Policy Name field, enter a name for the policy.

In the Policy Description field, enter a description of the policy.

Associate the policy with VPNs and sites.

Click Preview to view the configured policy.

Click Save Policy.

From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

From the Custom options drop-down, under Centralized Policy, select Traffic Policy.

Click Traffic Data.

From the Add Policy drop-down, click Create New.

Click Sequence Type and select Custom.

Click (+) Sequence Rule to create a new sequence rule.

After adding match conditions, click Actions and click Accept.

Click NAT VPN and select the Fallback checkbox.

Click Save and Match Actions.

Click Save Data Policy.

Click Centralized Policy and for the required centralized policy, click ... and select Edit.

Click Traffic Rules and select Traffic Data.

From the Add Policy drop-down, select Import Existing.

Select the NAT policy that you created from the Policy drop-down.

Click Policy Application and select Traffic Data.

Click + New Site List and VPN List.

Select the direction, VPN, and site as required.

Click Add.

Click Save Policy Changes.

Click to select VPN, and Site from the drop-down.

From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

For the required policy, click ... and select Activate.

Click Activate.

To view centralized policies, select a policy from the Centralized Policy list.

For a policy created using the UI policy builder or using the CLI, click ... and select View.

For a policy created using Cisco SD-WAN Manager policy configuration wizard, click ... and select Preview.

To copy a policy, select a policy from the Centralized Policy list and click ... and select Copy.

In the Policy Copy popup window, enter the policy name and a description of the policy.

Click Copy.

To edit policies created using the Cisco SD-WAN Manager policy configuration wizard, click ... and select Edit.

Edit the policy as needed and click Save Policy Changes.

To edit polices created using the CLI method, in the Custom Options drop-down, click CLI Policy.

For the desired policy, click ... and select Edit.

Edit the policy as needed and click Update.

To delete policies, select a policy from the Centralized Policy list and click ... and select Delete.

Click OK to confirm deletion of the policy.