Before you begin

Ensure that you have these items:

• An active Cisco Smart Account.

• An active Cisco Virtual Account.

• The SA-Admin role for your Cisco Smart Account. (This role is required to access the Cisco Catalyst SD-WAN Portal and create a fabric.)

• A valid order for control components on Cisco Commerce (formerly CCW).

Create a Cisco SD-WAN Cloud-Pro fabric

1. Go to the URL that you received in the email from Cisco to access the Cisco Catalyst SD-WAN Portal, and log in.

2. From the Cisco Catalyst SD-WAN Portal menu, choose Create Fabric.

   The Create Cisco SD-WAN Fabric page appears.

3. From the Smart Account drop-down list, choose the name of the Cisco Smart Account to which you want to associate the fabric.

   Note	If your Cisco Smart Account is not listed in the drop-down, click to refresh the list and search for your account by its domain ID.

4. From the Virtual Account drop-down list, choose the name of the Cisco Virtual Account to which you want to associate the fabric.

5. Select a Cisco SD-WAN Cloud or Cisco SD-WAN Cloud-Pro Fabric. See the Cisco SD-WAN Cloud Guide to create a Cisco SD-WAN Cloud fabric. If you select Cisco SD-WAN Cloud-Pro, a questionnaire dialog box appears. Provide the required details in the dialog box.

6. Check the appropriate boxes if you intend to use any of the listed features on the fabric. Select “None of the options” if you do not use any additional features. (required)

7. Enter the number of devices you plan to add to the fabric (required).

8. Enter the sales order number for any SD-WAN subscriptions you have (optional).

9. Click Next.

   Based on your responses, you are directed to the Cisco SD-WAN Cloud or Cisco SD-WAN Cloud-Pro fabric creation workflow. See the Cisco SD-WAN Cloud to create a Cisco SD-WAN Cloud fabric. The remaining instructions apply to creating a Cisco SD-WAN Cloud-Pro fabric.

10. Click Assign Control Components and perform these actions in the Assign Control Components area:

    1. Configure the options for the number of control component types in a Cisco SD-WAN Cloud-Pro fabric.

       Option	Description
       Assign (for the SD-WAN Manager control component type)	Enter the number of Cisco SD-WAN Manager control components in your deployment. Valid values are 1, 3, or 6.
       Assign (for the SD-WAN Validator control component type)	Enter the number of Cisco SD-WAN Validators in your deployment. The minimum value is 2.
       Assign (for the SD-WAN Controller control component type)	Enter the number of Cisco SD-WAN control components in your deployment. The minimum value is 2.
       Enable Cluster	Applies only if you choose a value of 3 or 6 for the number of Cisco SD-WAN Manager controllers. Turn on this option to create a Cisco SD-WAN Manager cluster.
       Cluster Type	Applies only if you turn on the Enable Cluster option. Choose Single Tenant Cluster to enable a single tenant cluster.

    2. Click Assign.

11. In the Fabric field, enter a name for your fabric.

12. Under Cloud Provider, choose AWS or Azure as the cloud provider at which you want the control components for your fabric to be hosted. Government sites use only Amazon Web Services (AWS).

    Note	IPv6 provisioning is only supported for Single Tenant fabrics hosted on AWS.

13. From the SD-WAN Version drop-down list, choose the version of Cisco Catalyst SD-WAN that you want to use on your control components.

    Use the recommended version unless you require features that are offered only in another version. To see recommended versions, visit Cisco Software Central.

    Cisco Catalyst SD-WAN releases are described in the Cisco Catalyst SD-WAN Release Notes in the Release Information area in User Documentation for Cisco IOS XE (SD-WAN) Release 17.

14. Under Locations, perform these actions:

    1. From the Primary Location drop-down list, choose the geographical location where the Cisco SD-WAN Manager is provisioned.

       We recommend that you choose a location that is relatively close to your network.

    2. From the Secondary Location drop-down list, choose the geographical location for backed up data storage and load balancing. If you choose the same region for both primary and secondary, then the Cisco Catalyst SD-WAN Portal automatically places the instances in two different Zones within the same region.

       We recommend that you choose the location that is closest to the primary location.

    3. From the Data Location drop-down list, choose the geographical location for Cisco SD-WAN Analytics data storage.

       We recommend that you choose the location that is closest to the primary location.

15. Enter this information under Contacts:

    • In the Fabric Admins field, enter one or more comma-separated email addresses or mailing list names to which the Cisco Catalyst SD-WAN Portal sends notifications about the fabric.

    • In the Cisco Contact Email field, enter the email address of a contact at Cisco that can be reached if there is an urgent issue and the administrator of the fabric cannot be reached.

    • In the Enter Contract Number of Service field, enter the number of your Cisco Catalyst SD-WAN Portal service contract.

    • In the Enter CCO ID of Service Requester field, enter the Cisco Connection Online (CCO) ID of the person who created the ticket for your Cisco Catalyst SD-WAN Portal.

    Alert Notifications: The Cisco Catalyst SD-WAN Portal generates alert notifications for various events, such as expiring subscriptions, maintenance windows, and feature changes. Notifications are sent to the registered Overlay Admin contact email addresses configured under Overlay Details. Keep your email addresses updated. You can register multiple email addresses. To update your registered email addresses, perform these steps:

    1. Log in to Cisco Catalyst SD-WAN Portal at https://ssp.sdwan.cisco.com for commercial sites or https:ssp-gov.sdwangov.fedramp.cisco for government sites. You must have PNP Smart Account Administrator role to be able to log in.

       Alternatively, if your Smart Account Administrator has already set up an identity provider (IdP) on the Cisco Catalyst SD-WAN Portal, then you can log in with the role provided by your Administrator.

    2. Go to Overlay Details > Description > Overlay Admin

    3. Click on the pencil icon to edit.

    4. Type in your email address and hit Tab.

    5. Click on the check mark icon to save.

16. Configure the Advanced Options as needed.

    For detailed information about these options, refer to Configure Advanced Options for a Cisco SD-WAN Cloud-Pro Fabric.

    • Custom Subnets: Configure private IP addresses for control component interfaces.

    • Custom Domain Settings: Configure custom domains for accessing Cisco SD-WAN Validator and Cisco SD-WAN Manager.

    • Snapshot Settings: Configure how often the system takes a snapshot of Cisco SD-WAN Manager instances in your deployment.

    • Custom Organization Name: Configure a unique organization name to identify your network.

    • Compliance: Select certification compliances for the fabric. Compliance is on by default in the government version of the Cisco Catalyst SD-WAN Portal.

    • Dual Stack: Enable IPv6 dual stack.

17. Click Click here to review and agree to Terms and Conditions before proceeding. In the Terms and Conditions dialog box, review the displayed information and click I Agree.

18. Click Create Fabric.

    Your request is submitted. Manual approval for a Cisco SD-WAN Cloud-Pro fabric can take up to 24 hours (1 day). You can view the progress of your request in the Requests area.

    In addition, a password appears in the Cisco Catalyst SD-WAN Portal Notification page. Use this password to access the fabric for the first time.

    After logging in, change this password immediately to secure your environment.

    Note	The system-provided control component password is no longer visible in the Cisco Catalyst SD-WAN Portal after seven days. We recommend that you keep a copy of the password if you want to retain it.

19. Once you receive a notification that your fabric is ready, follow these steps:

    • Install control component certificates on your devices. For more details about certificate installation, refer to Use Case: Cisco-Hosted Cloud Overlays with Software Version 19.x and Above.

    • Install web server certificates. For information about installing web server certificates, refer to Web Server Certificates.

Custom Subnets

The Custom Subnets area includes options for configuring private IP addresses to be used for control component interface IP addresses.

For use cases such as connecting to an enterprise TACACS+, connecting to an authentication, authorization, and accounting (AAA) server, sending messages to a syslog server, or enabling management access to instances over the fabric, you may want to deploy the control components with private IP addresses in specific prefixes which are unique and are not used elsewhere within your fabric.

Custom Domain Settings

The Custom Domain Settings area includes options for configuring custom domains for accessing Cisco SD-WAN Validator and Cisco SD-WAN Manager.

Note	For government deployments, the default domain is sdwangov.fedramp.cisco and cannot be changed.

By default, the domain name for commercial deployments is cisco.com. You can specify another domain, if needed.

If you specify a custom domain, you must create your own domain name systems for the Cisco SD-WAN Validator and Cisco SD-WAN Manager because we do not have access to your domains.

After you configure a custom domain, make these mappings to allow control component certificates to come up:

• Map the Cisco SD-WAN Validator DNS to all VPN 0 IP addresses.

• Map the Cisco SD-WAN Manager DNS to all VPN 512 IP addresses.

Snapshot Settings

The Snapshot Settings area includes an option for configuring how often the system takes a snapshot of Cisco SD-WAN Manager instances in your deployment.

By default, the network overlay configuration is backed up once a day and seven snapshots are stored.

For more detailed information about snapshots, see Information About Snapshots.

Custom Organization Name

The Custom Organization Name area includes an option for configuring a unique organization name to identify your network.

Certification Compliance Modes

The Compliance Configuration area includes certification compliance options for the fabric in commercial deployments only. These compliance modes are available:

Dual Stack

The Dual Stack area includes an option for enabling IPv6 for control components on AWS hosted fabrics. IPv6 provisioning is only supported for Single Tenant fabrics hosted on AWS.

Enabling this option is required if your enterprise network is configured with IPv6. After this option is enabled, the fabric subnets are configured with both IPv4 and IPv6. IPv6 addresses are assigned by your cloud service provider.

Note	After this option is enabled for a fabric, it cannot be disabled.

Information About Predefined Inbound Rules

With this feature you can create inbound rules, each of which specifies trusted IP addresses. These IP addresses are applied to any new overlay that you create under the Smart Account for which you configure this feature. These IP addresses can also be applied to existing overlays under the Smart Account for which you configure this feature.

An inbound rule includes the rule name, protocol and port range to which the rule applies, and source IP address or prefix information. You can create up to 200 inbound rules.

Use Cases for Predefined Inbound Rules

Predefined inbound rules provide a convenient way to add the same group of trusted IP addresses to existing and new overlays. By creating predefined inbound rules, you avoid having to configure trusted IP address for each overlay manually.

Configure Predefined Inbound Rules

1. From the Cisco Catalyst SD-WAN Portal menu, choose Admin Settings.

2. Click … adjacent to the Smart Account for which you want to configure a predefined inbound rule and click Manage Predefined Inbound Rules.

   A list of the inbound rules that have been configured appears.

3. Click Add Predefined Inbound Rules.

4. In the Add Inbound Rule area, perform these actions:

   1. In the Name field, enter a unique name for the rule.

   2. From the Rule Type drop-down list, choose the type of protocol to which the rule applies (All, SSH, HTTPS, Custom TCP rule, or Custom UDP rule).

   3. If you choose a rule type of Custom TCP rule or Custom UDP rule, in the Port Range field, enter a port range to which the rule applies.

   4. In the Source field, enter an IP address or IP address prefix.

   5. In the Description field, enter a descriptions of the predefined inbound rule.

   6. (Optional) Click Automatically add this rule to ALL overlays to add this new rule to existing overlays under this Smart Account, in addition to future overlays that are created under this Smart Account.

      If you do not click this option, this rule is added to future overlays only.

   7. Click Add.