Lists the available methods for configuring service insertion.
Use one of these methods to configure service insertion:
Configure service insertion using a CLI template
This task configures service insertion using CLI templates to create service chains that define the sequence of services through which traffic is processed.
For more information about using CLI templates, see CLI Add-On Feature Templates and CLI Templates.
By default, CLI templates execute commands in global config mode.
Procedure
| 1. | Create a service chain: Example: |
|
| 2. | Configure a description for the service chain: Example: |
|
| 3. | Specify the services that are in the service chain and configure related options: Example: |
|
| 4. | (Optional, from Cisco Catalyst SD-WAN Manager Release 20.14.1) Configure the trust posture for the services that are in the service chain: Example: |
|
| 5. | (Optional) Configure all Cisco Catalyst SD-WAN bidirectional forwarding (BFD) sessions to be brought down: Example: |
|
| 6. | Specify the name of the VPN that hosts all services in the service chain: Example: |
|
| 7. | (Optional, enabled by default) Enable endpoint tracking for services in the service chain: Example: |
|
| 8. | (Optional, enabled by default) Enable the service chain, which makes it active on devices: Example: |
The service insertion is configured using the CLI template with the specified service chain parameters and settings.
Configure service insertion using the workflow library
Service insertion allows you to configure network services in a specific order to process traffic before it reaches its destination. Using the workflow library provides a guided approach to create and manage service chains effectively.
Beginning with Cisco Catalyst SD-WAN Manager Release 20.13.1, you can configure service insertion by using the Workflow Library. From the Workflow Library, you can create a new service chain or modify an existing one. A service chain can contain UP to four service types.
The workflow guides you through configuring several steps, including:
-
Configuring the name and description of the service chain
-
Specifying the services in the service chain and the order of the services in the chain
-
Provide attachment parameters for the services in the chain, which are used when you attach the service chain to routers
-
For each service type, specify the VPN and configure options such as load balancing, high availability and tracking
Procedure
| 1. | From the Cisco SD-WAN Manager menu, choose . |
|
| 2. | Click Define and Configure Service Chain. |
|
| 3. | Follow the prompts in the workflow. Ensure that you define a tacker. Tracker configuration is critical to avoid blackhauling. Defining a tracker ensures that the service chain is determined to be in the UP state and is used. If the IP address of a service chain firewall is used with an ICMP-based tracker, ensure that the firewall allows ICMP on the appropriate interface. Ensure that the service chain can route returning traffic back into the Cisco Catalyst SD-WAN fabric. To do so, use dynamic routing protocols between the service chain and Cisco Catalyst SD-WAN router (service chain hub) or use static routes. Attach the service chain to the appropriate Cisco Catalyst SD-WAN SC-Hub router. The service chain does not need to be attached to branch routers. |
The service chain is configured and ready to be used with data policies and traffic steering configurations.
What to do next
After you configure service insertion, perform the following actions as needed:
-
Configure service chain actions for a data policy to route traffic through a service chain. See Configure Service Chain Actions in a Data Policy.
-
Use a control policy, data policy, or interface access control list to direct traffic to a service chain. See Traffic Steering to a Service Chain.
-
Configure TLOC preference or affinity preference to choose the preferred path for traffic to a service chain. See Path Preference.
-
Configure separate interfaces for transmitted and received traffic. See Separate Interfaces for Transmitted and Received Traffic.
-
Configure trusted traffic to flow to a trusted high availability pair. See Service Chaining Trusted and Untrusted Traffic.
-
Configure fall back or restrict behavior for traffic that travels through a service chain. See Configure Fall Back and Restrict Behavior for Traffic Through a Service Chain.