Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Service insertion

Updated: April 24, 2026

Want to summarize with AI?

Log in

Describes placing network or security services into the path of specific data traffic within the Cisco Catalyst SD-WAN overlay fabric.

Service insertion, also known as service chaining, is a network capability that

  • places one or more network or security services into the path of specific data traffic within the Cisco Catalyst SD-WAN overlay fabric

  • routes traffic through services defined in a service chain according to service chain actions configured for a data policy, and

  • can be deployed in any device and topology, including full mesh, HUB-spoke, and Cisco Catalyst SD-WAN Multi-Region Fabric (MRF).

Service insertion capabilities

Cisco Catalyst SD-WAN service chaining is flexible, fully automated, and can be deployed on a per VPN basis. Service chaining includes the following key features:

  • Service chaining can be used for overlay, local ingress and egress, inter- and intra-VPN, transit, branch-to-branch, branch-to-internet, branch-to-cloud, and cloud-to-cloud traffic

  • Automatic forwarding of traffic through all services in a chain

  • Services attachment methods of IPv4, IPv6, dual stack, and tunneled

  • Configurable high availability across instances of a single service

  • Built-in load balancing across instances of a single service, which supports equal cost multipath routing (ECMP) across high availability pairs

  • Advanced service tracking

  • Service chain sharing across multiple user VPNS, which can be different or the same as user traffic VPNS

  • Traffic steering methods using control policy, data policy, interface ACL, and supported match conditions

  • Fall back and restrict behavior

  • Path preference and symmetric routing

  • Security services to and from service transports

  • Trusted and untrusted high availability pairs and traffic marking (from Cisco Catalyst SD-WAN Manager Release 20.14.1)

  • Periodic on demand state notifications for serviceability

  • Cisco Catalyst SD-WAN Manager orchestration: Workflow based service chaining and traffic policy configuration

The following table provides information about the capabilities of the service chaining feature in releases before and after Cisco Catalyst SD-WAN Manager Release 20.13.1.

Table 1. Service insertion capabilities

Capability

Releases before Cisco Cisco Catalyst SD-WAN Manager Release 20.13.1

Releases from Cisco Cisco Catalyst SD-WAN Manager Release 20.13.1

Multiple services in a chain

No native support

Native support

Traffic steering

Control policy

Control policy, data policy, interface ACL

Policy binding

Remote

Remote and local

Traffic type

IPv4

IPv4, IPv6, dual stack, tunnel

Load balancing

Across 4 IP addresses that serve as service endpoints

Across 4 instances of active-backup pairs for every traffic type

High availability

As provided by load balancing

Active and backup pairs

Supported deployments

  • Single-arm deployment

  • Single-arm deployment with multiple interfaces

  • Bump-in-the-wire deployment

  • Single-arm deployment

  • Single-arm deployment with multiple interfaces

  • Bump-in-the-wire deployment

The following figure illustrates the key elements in service insertion. In this figure, SC-HUB1 is the router to which the service chain is attached.

In the hairpin model, traffic is sent by SC-HUB1 to a service in the service chain, and the service returns the traffic to SC-HUB1. SC-HUB1 then either forwards the traffic to the next service in the service chain or to the destination if the traffic is returning from the last service in the service chain.

In the exit Model, traffic is sent by SC-HUB1 to a service in a service chain, and the service forwards the traffic to the destination. Traffic may return from the destination to the service, which returns it to SC-HUB1.

Figure 1. Service insertion key elements