Cisco Catalyst SD-WAN Policies Configuration Guide, Releases 26.x and Later

Service insertion configuration methods

Updated: September 23, 2026

Want to summarize with AI?

Lists the available methods for configuring service insertion.

Use one of these methods to configure service insertion:

Configure service insertion using a CLI template

This task configures service insertion using CLI templates to create service chains that define the sequence of services through which traffic is processed.

For more information about using CLI templates, see CLI Add-On Feature Templates and CLI Templates.

Note
By default, CLI templates execute commands in global config mode.

Procedure

Create a service chain:
Example:
```
service-chain chain-number 
```
Configure a description for the service chain:
Example:
```
service-chain-description description 
```
Specify the services that are in the service chain and configure related options:
Example:
```
service service-type service-parameters 
```
(Optional, from Cisco Catalyst SD-WAN Manager Release 20.14.1) Configure the trust posture for the services that are in the service chain:
Example:
```
service service-type service-transport-ha-pair value attribute trust-posture {trusted | untrusted} 
```
(Optional) Configure all Cisco Catalyst SD-WAN bidirectional forwarding (BFD) sessions to be brought down:
Example:
```
service-chain-affect-bfd 
```
Specify the name of the VPN that hosts all services in the service chain:
Example:
```
service-chain-vrf vrf 
```
(Optional, enabled by default) Enable endpoint tracking for services in the service chain:
Example:
```
track-enable 
```
(Optional, enabled by default) Enable the service chain, which makes it active on devices:
Example:
```
service-chain-enable 
```

The service insertion is configured using the CLI template with the specified service chain parameters and settings.

Configure service insertion using the workflow library

Service insertion allows you to configure network services in a specific order to process traffic before it reaches its destination. Using the workflow library provides a guided approach to create and manage service chains effectively.

Beginning with Cisco Catalyst SD-WAN Manager Release 20.13.1, you can configure service insertion by using the Workflow Library. From the Workflow Library, you can create a new service chain or modify an existing one. A service chain can contain UP to four service types.

The workflow guides you through configuring several steps, including:

Configuring the name and description of the service chain
Specifying the services in the service chain and the order of the services in the chain
Provide attachment parameters for the services in the chain, which are used when you attach the service chain to routers
For each service type, specify the VPN and configure options such as load balancing, high availability and tracking

Procedure

From the Cisco SD-WAN Manager menu, choose Workflows > Workflow Library.
Click Define and Configure Service Chain.
Follow the prompts in the workflow.

Ensure that you define a tacker. Tracker configuration is critical to avoid blackhauling. Defining a tracker ensures that the service chain is determined to be in the UP state and is used. If the IP address of a service chain firewall is used with an ICMP-based tracker, ensure that the firewall allows ICMP on the appropriate interface.

Ensure that the service chain can route returning traffic back into the Cisco Catalyst SD-WAN fabric. To do so, use dynamic routing protocols between the service chain and Cisco Catalyst SD-WAN router (service chain hub) or use static routes.

Attach the service chain to the appropriate Cisco Catalyst SD-WAN SC-Hub router. The service chain does not need to be attached to branch routers.

The service chain is configured and ready to be used with data policies and traffic steering configurations.

What to do next

After you configure service insertion, perform the following actions as needed:

Configure service chain actions for a data policy to route traffic through a service chain. See Configure Service Chain Actions in a Data Policy.
Use a control policy, data policy, or interface access control list to direct traffic to a service chain. See Traffic Steering to a Service Chain.
Configure TLOC preference or affinity preference to choose the preferred path for traffic to a service chain. See Path Preference.
Configure separate interfaces for transmitted and received traffic. See Separate Interfaces for Transmitted and Received Traffic.
Configure trusted traffic to flow to a trusted high availability pair. See Service Chaining Trusted and Untrusted Traffic.
Configure fall back or restrict behavior for traffic that travels through a service chain. See Configure Fall Back and Restrict Behavior for Traffic Through a Service Chain.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Service insertion configuration methods

Configure service insertion using a CLI template

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure service insertion using the workflow library

Procedure

What to do next