Outlines the limitations and restrictions that apply when configuring and deploying security policies.
IPv6 rules or rulesets
IPv6 rules or rulesets do not support identity.
IPv4 rules with rulesets
Only IPv4 rules with an NGFW policy support Identity. IPv4 rules with rulesets are not supported.
Matching traffic, custom application in a custom-defined application list
From Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1, security policy supports matching traffic using a custom application in a custom-defined application list. In earlier releases, this is not supported.
VPNs or interfaces not present on the target device
When a security policy was deployed with zones configured to include specific VPNs or interfaces, the system would gracefully handle situations where some of these VPNs or interfaces were not present on the target device. SD-WAN Manager automatically filters out the non-existent VPNs or interfaces before pushing the configuration, allowing the policy to deploy successfully to the device for the available elements.
For policy groups, this behavior has changed. The system now strictly mandates the presence of all VPNs and interfaces specified within a zone configuration on the target device. If any configured VPN or interface is missing on the device, the security policy deployment will fail, requiring the user to ensure all referenced VPNs and interfaces exist on the device before deployment.
Example:
Consider a zone named zoneA configured to include vlan10, gigabitethernet20, and vlan1.
For security policy: If the target device only had vlan10 configured, SD-WAN Manager would filter out gigabitethernet20 and vlan1, and the policy would successfully deploy for vlan10.
For policy groups: If the target device only has vlan10, the deployment of the security policy will now fail because gigabitethernet20 and vlan1 are mandated but not present on the device.
Replacing a SIG or SSE feature policy
Replacing a SIG or SSE feature policy within the same policy group is not supported.
Data policy redirecting DNS traffic
Data policy does not support both of these conditions together:
-
Data policy redirecting DNS traffic to Umbrella
-
Secure Internet Gateway (SIG) configured
NGFW configurations using CLI add-on template
Ensure proper NGFW block configuration:
-
Ensure that the NGFW block is moved to the end of the CLI template.
-
Ensure the NGFW block is closed using the exit command instead of ! .
Discontiguous subnet masks in IPv4 network object-group
A discontiguous subnet mask is used to identify which bits of an IPv4 address must be matched. A bit value of 0 indicates that the corresponding address bit is ignored, and a bit value of 1 indicates that the corresponding address bit must match.
-
Discontiguous subnet mask support is applicable only to NGFW policies.
-
Discontiguous subnet mask support is limited to IPv4 data prefixes and IPv4 network object groups.
-
Discontiguous subnet mask support is not applicable to app-route policies or data policies.
-
SD-WAN Manager supports a maximum of five discontiguous entries in an IPv4 data prefix or IPv4 network object group configured through policy objects.
This limit is not enforced by the device. Therefore, you can use CLI add-on template to configure more than five discontiguous entries. Cisco recommends using no more than five discontiguous entries to ensure consistent behavior across SD-WAN Manager workflows.
During policy download, attach and edit operations, the device also enforces a maximum of five discontiguous entries per IPv4 network object-group.