Cisco vAnalytics is a cloud-based analytics service for Cisco SD-WAN offering comprehensive insights into application and network performance. The analytics service is available with Cisco DNA Advantage and Cisco DNA Premier software subscriptions. Cisco vAnalytics collects and stores metadata about traffic flows in its cloud storage and produces analytics based on this collected data.

Some of the key benefits of Cisco vAnalytics service are:

• Network Visibility: Gain visibility into key network performance metrics, such as loss, latency, jitter, and availability.

• Application Experience: Assess Quality of Experience (QoE) for applications deployed in data centres and on cloud.

• Operational Insights: Establish historical benchmarks, identify trends, and correlate application experience with the underlying network behavior.

• Path Recommendations: Gain insights into the quality of the current network paths your applications are taking, and the quality of the alternate recommended paths for better application experience.

• Faster Resolution: Lower the mean time to identification (MTTI) of issues with faster root cause isolation.

• Application Flows: Gain insights into application traffic flows over various network paths.

• Top Talkers: Identify top consumers of network bandwidth.

• Reporting: Generate analysis reports for offline review by CIO/CTO/COO and network teams.

You can manage user access and operational privileges through Cisco Software Central. Each overlay is associated with a Virtual Account. To allow a user to access Cisco vAnalytics for a particular overlay, add the user to the Virtual Account in one of the following capacities:

• Virtual Account Administrator: The user can access all Cisco vAnalytics screens for the overlay. In addition, the user can configure the IdP to be used for user authentication for the overlay.

• Virtual Account User: The user can access all Cisco vAnalytics screens for the overlay.

Alternatively, you can add a user to a Smart Account. Doing so allows the user to access Cisco vAnalytics for all Virtual Accounts belonging to the Smart Account. This option of adding a user at the Smart Account level is especially useful for managed service providers (MSPs) and enterprises managing multiple overlays. You can add a user to a Smart Account in one of the following capacities:

• Smart Account Administrator: The user can access all Cisco vAnalytics screens for all the overlays. In addition, the user can view the reports tab and generate reports for anlysis. This user can also configure the IdP to be used for all the overlays or configure the use of an organization IdP for a particular overlay.

• Smart Account User: The user can access all the Cisco vAnalytics screens for the overlay.

  Note	A Smart Account Approver has the same privileges as a Smart Account User.

When authenticated by their organization's IdP, users are granted access to overlays and operations based on the default role assigned to them while defining organization IdP on Cisco vAnalytics. Alternatively, user role can be updated by using the authzCiscovAnalytics attribute on the organization IdP.

Use the following syntax to specify the default role or a value for the authzCiscovAnalytics attribute:

<syntax-version>;<overlay-1>:<role1>[,<role2>][;<overlay-2>:<role1>[,<role2>]]...

Currently, only one version of the syntax is supported and you must specify the syntax version as v1.

You can specify an overlay name and the user privileges for the overlay in the format: <overlay-1>:<role1>[,<role2>].

• To assign the same privileges to the user for all the overlays, specify the overlay name as *. Further, if a set of overlays share a part of their name, you can specify the set of the overlays using a combination of the shared part of the name and the wildcard character *.

  If you're configuring the IdP for a single overlay, specify the overlay name as *.

The Cisco Smart Account or Virtual Account administrator must first login to Cisco vAnalytics service using the Cisco CCO ID. After login, the administrator can view a list of Smart Accounts or Virtual Accounts that they have access to. The administrator will then be able to define organization IDP against Cisco vAnalytics for subsequent access through organization ID by users.

If the administrator belongs to more than one Virtual Account, Smart Account, or both, the administrator sees the Smart Accounts screen. The Smart Accounts screen lists the Smart Accounts and Virtual Accounts to which the administrator is subscribed. Each Virtual Account represents an overlay network.

The administrator sees the Overview Dashboard page if the administrator belongs to only one Virtual Account and Smart Account, and therefore, has access to only one overlay. From the Overview Dashboard, you can access the Smart Accounts screen by clicking View all overlays.

For an overlay, if Cisco vAnalytics has been onboarded, the entry under vAnalytics Status reads Active; if Cisco vAnalytics is not onboarded, the entry reads New. If Cisco vAnalytics is available for an overlay, you can launch the Dashboard for overlay by clicking on the overlay or Virtual Account name.

Note	If the vAnalytics Status for an overlay reads New, but you are aware that Cisco vAnalytics has been onboarded, verify whether you have logged in using the correct Cisco vAnalytics URL. See Access Cisco vAnalytics to use one of the URLs based on the location of your Cisco vAnalytics.

To pause data processing for an overlay, click … adjacent to the overlay name and choose Deactivate. When data processing is paused, the vAnalytics Status reads InActive (Paused). To resume data processing, choose Activate.

The entry under IDP Server indicates whether your organization's IdP is configured to be used with the overlay or not (Not Defined).

To configure an IdP for an overlay for which Cisco vAnalytics has been activated, click ... under Actions, and click Define IDP. For more information on defining the IdP, see Define Organization IdP for Overlays.

Define Organization IdP for Overlays

As an administrator for a Smart Account, you can configure your organization's IdP to be used for authenticating Cisco vAnalytics users for all or some of the overlays. As an administrator for a Virtual Account or an overlay, you can configure your organization's IdP to be used for authenticating Cisco vAnalytics users for the overlay.

1. Log in to Cisco vAnalytics.

   Note	If this is your first login to Cisco vAnalytics for your overlay, log in with the Cisco CCO ID. The organization IdP you define for the overlay authenticates and authorizes users in subsequent log-in attempts.

2. If you see the Dashboard, click View all overlays to go to the Smart Accounts screen.

3. Configure your organization's IdP for a Smart Account or the overlay associated with a Virtual Account:

   1. To configure your organization's IdP for a Smart Account, click Define IDP.

   2. To configure your organization's IdP for a virtual account, hover the mouse pointer over ... under Actions. Then, click Define IDP.

4. In the Define IDP dialog box, click OIDC IDP or SAML IDP.

   1. For an SAML 2.0 IdP, do the following:

      Table 2. SAML IdP Properties

      IDP Metadata	Click browse file and upload the SAML 2.0 metadata file to Cisco vAnalytics. Cisco vAnalytics reads the SAML 2.0 file and displays the following details: IDP Issuer URL IDP Single Sign-on URL IDP Signature Certificate Expiry (days)
      Default User Role	Configure a default role for Cisco vAnalytics users. The default role is used if a role is not assigned to a user on the IdP. Note  In addition to specifying a default role while defining an IDP, you can manage user access and operational privileges by defining a authzCiscovAnalytics attribute for users on your organization's IdP. A user can be assigned the following roles: The basic role allows a user to access all the Cisco vAnalytics screens for the overlay except the Microsoft 365 Cloud OnRamp screens. The o365 role allows a user to access the Microsoft 365 Cloud OnRamp screens. You can assign both the basic and o365 roles to an user to enable the user to access all the Cisco vAnalytics screens for the overlay. The admin role allows a user to access all the Cisco vAnalytics screens for the overlay. In addition, the user can also define an IdP for the overlay.
      Domain Identifier	Specify the domain identifier contained by every user ID. For example, if user IDs defined on your organization's IdP have the format userID@example.com, the common domain identifier is example.com.

   2. For an OIDC IdP, do the following:

      Table 3. OIDC IdP Properties

      IDP Metadata	Enter the following OIDC properties for your organization's IdP: Client ID Client Secret Issuer Authorization Endpoint Token Endpoint JWKS Endpoint Userinfo Endpoint
      Default User Role	Configure a default role for Cisco vAnalytics users. The default role is used if a role is not assigned to a user on the IdP. Note  In addition to specifying a default role while defining an IDP, you can manage user access and operational privileges by defining a authzCiscovAnalytics attribute for users on your organization's IdP. A user can be assigned the following roles: The basic role allows a user to access all the Cisco vAnalytics screens for the overlay except the Microsoft 365 Cloud OnRamp screens. The o365 role allows a user to access the Microsoft 365 Cloud OnRamp screens. You can assign both the basic and o365 roles to an user to enable the user to access all the Cisco vAnalytics screens for the overlay. The admin role allows a user to access all the Cisco vAnalytics screens for the overlay. In addition, the user can also define an IdP for the overlay.
      Domain Identifier	Specify the domain identifier contained by every user ID. For example, if user IDs defined on your organization's IdP have the format userID@example.com, the common domain identifier is example.com.

   3. Click Save.

5. To complete the IdP definition, send the required claims with non-empty values:

   1. For an SAML 2.0 IdP, download the IdP metadata file and send the four claims listed in the file.

   2. For an OIDC IdP, send the firstName, lastName, and email.

Any users logging in to Cisco vAnalytics after the IdP is configured are redirected to the IdP's page for authentication.

Manage a Defined Organization IdP

As an administrator for a Smart Account, you can view, modify, or delete the organization IdP defined for authenticating Cisco vAnalytics users for all or some of the overlays. As an administrator for a Virtual Account or an overlay, you can view, modify, or delete the organization IdP defined for authenticating Cisco vAnalytics users for the overlay.

1. Log in to Cisco vAnalytics.

2. If you see the Dashboard, click View all overlays to go to the Smart Accounts screen.

3. To manage a defined IdP, hover the mouse pointer over ... under Actions.

   • To view the IdP properties, click View IDP.

   • To modify the IdP properties, click Edit IDP.

     You can edit only the default user role and domain identifier for a defined IdP. If you need to modify any other properties, you must delete the IdP definition, and define the IdP again.

   • To delete the defined IdP, click Delete IDP.

     After you delete the IdP, Cisco vAnalytics users cannot log in using IDs that are defined in and authenticated by the organization IdP. Any user sessions that are active when the IdP is deleted are not ended, but subsequent log-in attempts fail.

Sites

The Sites summary widget includes the total count of sites and their distribution based on percentage availability (a site's uptime). The widget also displays the bottom five sites sorted by their availability and percentage-change in terms of availability compared to the previous time period of the same duration.

Applications

The Applications summary widget includes the total count of applications and their distribution based on QoE score of good, fair, and poor. The widget also displays the bottom five applications sorted by the worst QoE score and the change in QoE values for these five applications, and site wise distribution indicating the application health for these five applications in terms of QoE score depicted by a bar chart.

Circuits

The Circuits summary widget includes the total count of circuits and their distribution based on percentage availability. The widget also displays the bottom five circuits sorted by their availability and percentage-change in terms of availability compared to the previous time period of the same duration.

Users

The Users widget displays the top users of data in the overlay, the current usage of data and the changes in the usage of data from the last time period. The top users are tracked by using respective source IP addresses in the overlay network. The widget also displays the top three applications used by the users, and the data is ranked by bandwidth.

From the Overview Dashboard page, when you filter by sites, you can get an overview for the selected site. You can retrieve useful information about a site as to how many applications are running on this site, the number of devices on the site, the total data usage in the site, the circuits in the site, and the top users of the site.

The Devices widget displays the list of devices on the site and other relevant information.

From the Overview Dashboard page, click Applications to navigate to the Application Dashboard page or click Sites to navigate to the Site Dashboard page.

Application Experience

The Application Experience widget displays utilization details, the number of applications that were good, fair and poor by counts, and the total volume of traffic. An accordion chart shows top applications by usage with the color indicating the application health in terms of QoE score. This helps draw attention to the most critical application performance issues.

Application Trend Analysis

Click Application Trend Analysis in the Application Experience widget to launch the Application Trend Analysis widget to view trends of applications for a selected time period in the form of charts.

With Application Trend Analysis widget you can visualize trends of applications from the following perspectives:

• Plot of numbers of Good/Fair/Poor applications by QoE over a selected time-interval.

• QoE trend-line of top five applications (by bandwidth) over a selected time-interval.

• Ability to specify custom list from the table of applications, where you can select or deselect applications to view information.

Click on an individual application block in the accordion chart to navigate to the Application 360 page to view more detailed infomation about the application you selected.

Application 360

Click an application in the Application Experience widget to navigate to the Application 360 page. Alternatively, you can click on an application in Trending Application widget, or on an application in the page elements listed in the table below, or on any application in the Application widget in the Overview Summary Dashboard to retrieve the Application 360 page.

The Application 360 page gives you a view of a single application performance across all sites with capability to further drill down to in-depth details about an application at a single site and tunnel.

From the Application 360 page, you can visualize how the QoE for a specific application has changed over a selected time period. You can use the the Application 360 page to do the following:

• Compare an application’s performance across each sites, showing aggregated counts of Good/Fair/Poor sites on a map view.

• View the network path taken by an application across time for a single site.

• Viewmetrics of applications across an overlay corresponding to various network Key Performance Indicators (KPI), with the ability to select specific sites to view loss, latency, jitter, users, and usage per site.

Sankey Chart

A Sankey chart provides more details about an application flow across various tunnels for a single site, and helps you understand the application health over various tunnels terminating at the remote sites.

The left side of the chart displays information about the local site and the color, followed by the QoE score. The right side of the chart displays information about the remote site and color.

Based on the QoE score, the sites with the top five QoE scores appear in the Site drop-down list. All other site information is aggregated and displayed in the chart. You can select and display information for up to six sites.

The Sankey chart displays information for both DIA and non-DIA tunnels. For the DIA tunnel paths, the local color represents the interface name, and the remote site is displayed as SaaS. A tunnel path without remote color and site information represents a DIA tunnel path.

To view a tunnel path, click on a node.

Microsoft 365

From Cisco IOS XE Release 17.6.1a Cisco vManage Release 20.6.1, you can enable Microsoft Informed Network Routing to enable collection of telemetry data for the Microsoft 365 application suite. For information on how to enable collection of telemetry data for Microsoft 365 in Cisco vManage, see Enable Application Feedback Metrics for Office 365 Traffic

The telemetry data for Microsoft 365 applications is displayed on the Path Analytics tab on the Application 360 page.

Path Analytics

The Path Analytics tab displays path telemetry data for the Microsoft 365 family of applications if the feature is enabled in Cisco vManage. See Enable Application Feedback Metrics for Office 365 Traffic.

The Path Analytics tab displays path telemetry data for Microsoft 365 family of applications. It includes data such as best path scores across time, the Cisco SD-WAN scores computed for each path, the feedback received by Microsoft for the paths, and latency data.

To view the telemetry data for Microsoft 365 applications, perform the following steps:

1. From the Overview Dashboard page, click Applications to navigate to the Application Dashboard page.

2. From the Applications dashboard page, choose a Microsoft application.

3. Select a site.

   The Path Analytics tab displays for the selected site and the Microsoft application.

   The Path Analytics tab displays only for the Microsoft 365 family of applications if the feature is enabled in Cisco vManage, and the telemetry data is available from Microsoft.

The Path Analytics tab displays the following charts:

For more information about the Cloud onRamp for SaaS configuration and viewing the metric logs, see the following sections in the Cloud OnRamp Configuration Guide, Cisco IOS XE Release 17.x:

• Enable Application Feedback Metrics for Office 365 Traffic

• Enable Microsoft to Provide Traffic Metrics for Office 365 Traffic

• View Office 365 Application Logs

Webex

The Path Analytics tab displays for a Webex application if you have enabled Webex telemetry in Cisco vManage. See Enable Webex Server-Side Metrics.

The Path Analytics tab displays path-telemetry data for Webex applications. It includes data such as best path scores across time, and the details about Webex traffic from the edge devices and from the Webex server.

To view the telemetry data for Webex, perform the following steps:

1. From the Overview Dashboard page, click Applications to navigate to the Application Dashboard page.

2. From the Applications dashboard page, choose a Webex application.

3. Select a site.

   The Path Analytics tab is displays for a selected site.

   The Path Analytics tab displays Webex data if the feature is enabled in Cisco vManage.

The Path Analytics tab displays the following charts:

QoE Distribution by Application Classes

The QoE Distribution by Application Classes widget displays the applications against different classes. Application classes are broad categories used to group together applications based on their behavior and network performance requirements. The plot helps identify systemic network and overlay issues that can cause specific classes of applications to perform poorly in the overlay network. An inconsistent ratio of Poor/Fair/Good for a specific traffic class could indicate possible policy misconfiguration for that application in the overlay.

Trending Applications

The Trending Applications widget lets you compare top applications that have significant rise and drop in their measured QoE score, usage, loss, latency.

Applications

The Applications widget displays a table of all applications in an overlay.