Configure RBAC for policy groups

Ensure that the granular role-based access control (RBAC) for policy groups is specified by expanding it. With specific permissions to the usergroup, ensure that you are able to access policy groups from Configuration > Policy Groups.

1. From the Cisco SD-WAN Manager menu, choose Administration > Manage Users > User Groups.

2. Click Add User Group.

3. Enter User Group Name.

4. Select the Read or Write check box against the Policy Group and Device feature that you want to assign to a user group.

5. Click Add.

Configure RBAC for Application Priority Policy

Ensure that the granular RBAC for the application priority policy is specified by expanding it. With the set permissions to the usergroup, ensure that you are able to access the application priority policy from Configuration > Policy Groups.

1. From the Cisco SD-WAN Manager menu, choose Administration > Manage Users > User Groups.

2. Click Add User Group.

3. Enter User Group Name.

4. Select the Read or Write check box against the following features that you want to assign to a user group:

   • Feature Profile > Application Priority > Qos Policy

   • Feature Profile > Application Priority > Traffic Policy

   • Feature Profile > Policy Object > App List

   • Feature Profile > Policy Object > SLA Class

   • Feature Profile > Policy Object > TLOC

   • Feature Profile > Policy Object > App Probe

   • Feature Profile > Policy Object > Preferred Color Group

   • Feature Profile > Policy Object > Class

   • Feature Profile > Policy Object > Data Prefix

   • Feature Profile > Policy Object > Data Ipv6

   • Feature Profile > Policy Object > Policer

5. Click Add.

Application

1. Click Application.

2. Click Add Application .

3. From the Application/Application family list drop-down, choose the required applications or application families.

4. Click Save.

A few application lists are preconfigured. You cannot edit or delete these lists.

Microsoft_Apps: Includes Microsoft applications, such as Excel, Skype, and Xbox. To display a full list of Microsoft applications, click the list in the Entries column.

Google_Apps: Includes Google applications, such as Gmail, Google Maps, and YouTube. To display a full list of Google applications, click the list in the Entries column.

App Probe Class

1. Click Add App Probe Class.

2. In the App Probe dialog box, specify the following:

   Field	Description
   Probe Class Name	Enter a name for the probe class.
   Forwarding Class	Choose the forwarding class from the drop-down list.
   Color	Choose the color from the drop-down list.
   DSCP	Enter the DSCP value.

3. You can add more entries if needed by clicking on + icon.

4. Click Save.

Color

1. Click Color.

2. Click New Color List and specify the following:

   Field	Description
   Color List Name	Enter a name for the list.
   Select Color	Choose one or more color lists types from the drop-down list.

3. Click Add.

To configure multiple colors in a single list, you can choose multiple colors from the drop-down list.

Community List

A community list is used to create groups of communities to use in a match clause of a route map. A community list can be used to control which routes are accepted, preferred, distributed, or advertised. You can also use a community list to set, append, or modify the communities of a route.

1. Click Community List.

2. Click Add Community List and specify the following:

   Field	Description
   Community List Name	Enter a name of the community list.
   Add Community	Enter one or more communities separated by commas. aa:nn: Autonomous System (AS) number and network number. Each number is a 2-byte value with a range from 1 to 65535. For example, 65526. internet: Routes in this community are advertised to the internet community. This community comprises all BGP-speaking networking devices. local-as: Routes in this community are not advertised outside the local AS number. no-advertise: Attaches the NO_ADVERTISE community to routes. Routes in this community are not advertised to other BGP peers. no-export: Attaches the NO_EXPORT community to routes. Routes in this community are not advertised outside the local AS or outside a BGP confederation boundary. To configure multiple BGP communities in a single list, include multiple community options, specifying one community in each option.

3. Click Save.

Data Prefix

1. Click Data Prefix.

2. Click Add Data Prefix.

3. In the Data Prefix list dialog box, specify the following:

   Field	Description
   Data Prefix List Name	Enter a name for the data prefix list.
   Add Data Prefix	Enter one or more data prefixes separated by commas.

4. Click Save.

Data Prefix IPv6

1. Click Data Prefix IPv6.

2. Click Add Data Prefix IPv6.

3. In the Data Prefix List dialog box, specify the following:

   Field	Description
   Data Prefix List Name	Enter a name for the IPv6 data prefix list.
   Add Data Prefix	Enter one or more IPv6 data prefixes separated by commas.

4. Click Save.

Expanded Community List

1. Click Expanded Community List.

2. Click Add Expanded Community List and specify the fiollowing:

   Field	Description
   Community List Name	Enter a name for the community list.
   Add Community	Specify details of the expanded community list that is used to filter communities using a regular expression.

Forwarding Class

1. Click Add Forwarding Class and specify the following:

   Field	Description
   Forwarding Class	Enter a name for the forwarding class.
   Queue	Choose a value for the queue from the drop-down list.

2. Click Save.

Policer

1. Click Policer.

2. Click Add Policer and specify the following:

   Field	Description
   Policer List Name	Enter a name for the policer list.
   Burst (bytes)	Enter the maximum traffic burst size. The range is from 15,000 to 10,000,000 bytes.
   Exceed	Choose the action to take when the burst size or traffic rate is exceeded. The options are: Drop: sets the packet loss priority (PLP) to low Remark: sets the packet loss priority (PLP) to high
   Rate	Enter the maximum traffic rate, a value from 8 through 10^11 bits per second (bps).

3. Click Save.

Preferred Color Group

1. Click Add Preferred Color Group.

2. In the Preferred Color Group Name field, enter a name for the preferred color group.

3. Choose the color preference and path prefernce for the primary, secondary, and tertiary colors from the Color Preference and the Path Preference drop-down lists.

   Field	Description
   Preferred Color Group Name	Enter a name for the preferred color group.
   Color Preference	Choose the color preference from the drop-down list. You can choose multiple colors.
   Path Preference	Choose the path preference from the drop-down list. The options are: Direct Path Multi Hop Path All Paths

4. Click Save.

Prefix List

1. Click Prefix List.

2. Click Add Prefix List and specify the following:

   Field	Description
   Prefix List Name	Enter a name for the IPv4 prefix list.
   Add Prefix	Enter one or more IPv4 prefixes separated by commas.

3. Click Save.

Prefix List IPv6

1. Click Prefix List IPv6.

2. Click Add Prefix List and specify the following:

   Field	Description
   Prefix List Name	Enter a name for the IPv6 prefix list.
   Add Prefix	Enter one or more IPv6 prefixes separated by commas.

3. Click Save.

SLA Class

1. Click SLA Class.

2. Click Add SLA Class and specify the following:

   Field	Description
   SLA Class List Name	Enter a name of the SLA class list.
   Loss (%)	Enter the maximum packet loss on the connection, a value from 0 through 100.
   Latency	Enter the maximum packet latency on the connection, a value from 1 through 1,000 milliseconds.
   Jitter	Enter the maximum jitter on the connection, a value from 1 through 1,000 milliseconds.
   App Probe Class	Choose the app probe class from the drop-down list or click Create New to create one.
   Fallback Best Tunnel	Choose this option to enable the best tunnel criteria.

3. Click Save.

TLOC List

1. Click TLOC List.

2. Click Add TLOC List and specify the following:

   Field	Description
   List Name	Enter a name for the TLOC list.
   TLOC IP	Specify the IP address for TLOC.
   Color	Choose the color from the drop-down list.
   Encapsulation	Choose the value from the drop-down list. The options are: IPSec GRE
   Preference	Choose a preference to associate with the TLOC. The range is 0 to 4294967295.

3. Click Save.

Create an Application Priority and SLA Policy

Click + Application priority & SLA policy to create a policy and configure the values. To edit an existing policy, click the ellipsis icon (...) next to the application priority and SLA policy under Action and click Edit.

Choose one of the following options and configure the values that are based on the likely business relevance of the applications, and to give higher priority to business-relevant applications:

• Gold (Business-relevant): Likely to be important for business operations, for example, WebEx software.

• Silver (Default): No determination of relevance to business operations.

• Bronze (Business-irrelevant): Unlikely to be important for business operations, for example, gaming software.

Within each of the business-relevance categories, the workflow groups the applications into application lists, such as broadcast video, multimedia conferencing, VoIP telephony, and so on.

Advanced Layout

The advanced view provides further options to configure the traffic policy along with rules, service level agreement (SLA) class, and QoS Map. Click the Advanced button on the top-right corner of the window to swtich to the advanced view.

Note	If you make changes to the application priority and SLA policies and switch to the advanced layout, the changes are retained. You cannot switch back to the default view.

Based on the values you configure in the workflow, a policy profile and the relevant policy objects are created in the back-end when the workflow is completed. Similarly, you can configure traffic filtering and rules by creating the match and action conditions of a policy. You can also configure the app route policy SLA class and create customized QoS queues.

To rearrange match–action pairs in the route policy, drag them to the desired position and click Save Match and Actions.

For more information about SLA class and its components, see the section SLA Classes in Application-Aware Routing.

For more information about QoS, see the section Cisco Catalyst SD-WAN Forwarding and QoS Overview in Forwarding and QoS.

Monitor traffic flow

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.13.1a, Cisco Catalyst SD-WAN Manager Release 20.13.1.

You can configure collectors by clicking the Additional Settings tab, which provide options to monitor traffic flow on incoming packets in the LAN for application and flow visibility over IPv4, IPv6, or both network addresses.

Before you begin, ensure that you have configured Cflowd collector details in the Cisco SD-WAN Manager menu from Configuration > Network Hierarchy > Collectors > Cflowd.

Note

The Cflowd configuration applies to the global level and not the site level. The additional settings that you configure are applied to the Cisco SD-WAN Controllers while deploying the application priority and SLA policy. For more information about configuring Cflowd, see the section Configure Cflowd in Configure Collectors in a Network Hierarchy.

Enable traffic flow monitoring

To enable traffic flow monitoring while configuring an application priority & SLA policy, click the Additional Settings tab in the top-right corner and configure the following values: