For details on supported models for each of these device families, refer to Cisco SD-WAN Device Compatibility page.

• Only data-prefix-lists, data-ipv6-prefix-lists, and app-lists tag members are supported.

• Configuration of both direction and direction-less tags within the same TAG is not supported.

• Configuration of tags using only Cisco SD-WAN Controller CLI templates is supported.

• Multi-tenancy is not supported.

• Configuration of number of tags is limited to maximum of 255.

• Configuration of objects per tag is limited to 64.

The policy configuration tagging feature allows you to group policy objects and to assign tag values to various traffic flows by defining a policy. You can name the tags based on the functionality of the policy objects used to achieve the intent-based network configurations. These tags that are provisioned through the Cisco SD-WAN Controller are used in the policy rules for traffic classification.

You can assign unique tag IDs while creating each of the tags.

You can define members under a tag name, which are referenced directly under tag objects. The members can be directional or directionless. Supported tag member types are:

• Data-prefix-list

• Data-ipv6-prefix-list

• App-list

Data-prefix-list and data-ipv6-prefix-list are directional attributes, which are matched as source or destination keywords in the data-policy match statements. App-list is a directionless attribute. You can use directionless keyword such as application id in the app-list policy match statements. Directional and directionless attributes cannot be grouped under the same tag.

You can apply the configured tags in a match criterion under localized and centralized policies. Devices process the tag configurations and apply the configurations to the data plane when the tag is referenced in the policy.

You can use the configuration type feature to tag objects in a configuration. The configuration tags are used in Cisco Catalyst SD-WAN centralized policy such as data policy, and app-aware routing policy and localized access-list policy. The following tag attributes are used in a policy match sequence statement:

• Source-tag-instance

• Destination-tag-instance

• Tag-instance

As shown in the figure, at the Cisco SD-WAN Controller you can configure the tags using the policy objects with unique tag IDs. Once the tag IDs are assigned these tags are pushed to the Cisco IOS XE Catalyst SD-WAN devices in the network, which reference these tags. The devices then extract the policy list objects from the tags, which are used in the policy rules.

Tag Workflow

1. In Cisco SD-WAN Controller, create a tag that is based on the network intent.

2. Add the following policy list object members:

   • Data-prefix for each location

   • App-lists for applications

   The policy list objects can be defined anytime in the workflow, even after adding them in the tag instances.

3. Push these tags to the Cisco IOS XE Catalyst SD-WAN devices in the network.

4. Create a policy with multiple match sequences and include the tag objects in the Cisco Catalyst SD-WAN data-policy, app-aware-routing policy, and access-list policy.

5. If you add or remove a tag, the status is automatically reflected in the policy.

6. Update the policy to include new tag objects.

The benefits of using policy configuration tagging are:

• Enables reusability of policy objects.

• Enables faster policy download on a device with reduced configuration size and sequences.

• Tag sharing across different policies is supported.

• Enables visibility or corelation across the network in a user-defined intent.

• Controls the policy configuration download speed between the Cisco SD-WAN Controller and the Cisco IOS XE Catalyst SD-WAN devices.

• Improves management of the defined lists in the controller.

• Better organization of the configurations for the intent-based network.

The following is a sample output from the show sdwan tag-instances from-vsmart command displaying the downloaded tags from Cisco SD-WAN Controller on Cisco IOS XE Catalyst SD-WAN device:

Device# show sdwan tag-instances from-vsmart
tag-instances-from-vsmart
 tag-instance APP_facebook_TAG9
  id       60000
  app-list apps_facebook
 tag-instance APP_office_TAG10
  id       70000
  app-list apps_ms apps_zoom
 tag-instance APP_webex_TAG8
  id       50000
  app-list apps_webex
 lists data-prefix-list multicast_pfx
  ip-prefix 10.10.20.30/8
 lists data-prefix-list pfx1
  ip-prefix 10.20.24.0/24
 lists data-prefix-list pfx21
  ip-prefix 172.16.10.10/8
 lists data-prefix-list pfx22
  ip-prefix 172.16.20.20/16
  ip-prefix 192.168.10.20/8
 lists data-ipv6-prefix-list v6_pfx1
  ipv6-prefix 2001::/64
 lists data-ipv6-prefix-list v6_pfx21
  ipv6-prefix 2001::1/128
  ipv6-prefix 2001::/64
 lists app-list apps_facebook
  app dns
  app facebook
 lists app-list apps_ms
  app ms-office-365
  app ms-office-web-apps
  app ms-services
  app ms-teams
  app pop3
 lists app-list apps_webex
  app sip
  app webex-audio
  app webex-control
  app webex-media
  app webex-meeting
  app webex-video
 lists app-list apps_zoom
  app zoom-meetings

The following is a sample output from the show sdwan policy from-vsmart command displaying the policy that is downloaded from the Cisco SD-WAN Controller on Cisco IOS XE Catalyst SD-WAN device:

Device# show sdwan policy from-vsmart
from-vsmart sla-class SLA1
 latency 100
from-vsmart data-policy DATA_POLICY
 direction from-service
 vpn-list vpn_1
  sequence 11
   match
    destination-port         5060
    protocol                 17
    source-tag-instance      DP_V4_TAG1
    destination-tag-instance DP_V4_TAG3
   action accept
    count src_dst_legacy_v4
  sequence 21
   match
    source-tag-instance DP_V4_TAG1
   action drop
    count src_v4
  sequence 31
   match
    source-tag-instance      DP_V4_TAG2
    destination-tag-instance DP_V4_TAG3
    tag-instance             APP_webex_TAG8
   action drop
    count src_dst_app_v4
  sequence 41
   match
    source-tag-instance      DP_V4_TAG1
    destination-tag-instance DP_V4_TAG3
    tag-instance             APP_facebook_TAG9
   action accept
    count src_dst_app2_v4

The following is a sample output from the show platform software common-classification command displaying the tag information from a forwarding manager on a forwarding plane (FMAN-FP):

Device# show platform software common-classification F0 tag all
Total Number of TAGs: 9
tag id       tag name              tag type     num clients  num sets     num member types  total members
---------------------------------------------------------------------------------------------------------
900          special_TAG7          Per Type OR  0            2            1                 2
10000        DP_V4_TAG1            Per Type OR  1            1            1                 1
11000        DP_V4_TAG2            Per Type OR  1            2            1                 2
12000        DP_V4_TAG3            Per Type OR  1            6            1                 6
20000        DP_V6_TAG4            Per Type OR  1            1            1                 1
21000        DP_V6_TAG5            Per Type OR  1            2            1                 2
50000        APP_webex_TAG8        Per Type OR  1            1            1                 1
60000        APP_facebook_TAG9     Per Type OR  1            1            1                 1
70000        APP_office_TAG10      Per Type OR  1            2            1                 2

Device# show platform software common-classification f0 tag 1 summary
TAG ID: 1
TAG TYPE: Per Type OR
TAG Name: net1
Is Dummy: F

client data:
  client id     client name           
  ----------------------------------
  166           SDWAN                 

member data:
  Prefix List           6             
  App List              3             

Device# show platform software common-classification f0 tag 1 prefixList 
 member details:
  member detail type    member id     member data 
  ------------------------------------------------
  IPv4 Prefix List      65537         100           
  IPv6 Prefix List      65538         101           
  IPv4 Prefix List      65540         103           
  IPv6 Prefix List      65541         104           
  IPv6 Prefix List      65544         107           
  IPv4 Prefix List      65546         109           

Device# show platform software common-classification f0 tag 1 appList 
 member details:
  member detail type    member id     member data   
  ------------------------------------------------
  App List              65539         102           
  App List              65542         105           
  App List              65545         108           

Device# show platform software common-classification f0 tag 1 set 
Total Number of SETs: 18
  Set ID        member detail type    member id     member data   
  --------------------------------------------------------------
  1             IPv4 Prefix List      65537         100           
  1             App List              65539         102           
  2             IPv4 Prefix List      65537         100           
  2             App List              65542         105           
  3             IPv4 Prefix List      65537         100           
  3             App List              65545         108           
  4             IPv6 Prefix List      65538         101           
  4             App List              65539         102           
  5             IPv6 Prefix List      65538         101