Access permissions for cloud-hosted control components

Cisco-managed cloud-hosted control components are, by default, closed for management access. To permit access, configure specific public IP prefixes within your enterprise VPN. The universal IP address range (0.0.0.0/0) is not permitted for security reasons. Only those IP prefixes that are specifically listed in the allow list can access management interfaces; you may also specify that only HTTPS and SSH protocols are permitted for your source IP prefixes.

Key facts about allow lists:

• The allow list applies to all network interfaces with public IP addresses on control components.

• Cisco SD-WAN Cloud-Pro control components have private IP addresses mapped one-to-one to public IP addresses in the cloud.

• IP addresses assigned to the control components remain the same unless the instance is recovered or replaced.

• Smart Account administrators can view and modify control component IP access lists via the SD-WAN Service Portal.

To remove Smart Account administrator privileges, use the Manage Smart Account section in Cisco Software Central. Trusted users may be added using the identity provider (IDP) onboarding feature for access to the Cisco Catalyst SD-WAN Portal.

Update allow lists

For shared tenant fabrics, open a TAC support case to update or view the allow list for your control component set. Support can permit up to five IP prefixes or restrict HTTP access for web login.

For single-tenant dedicated fabric control components:

• Log in to the Cisco Catalyst SD-WAN Portal at https://ssp.sdwan.cisco.com to manage the access list. You must be the Cisco PNP Smart Account administrator for the Smart Account where the fabric control component profile resides.

• Provide up to 200 IP prefixes for inclusion in the allow list.

• Alternatively, contact TAC and supply information including Fabric and VA name, Cisco SD-WAN Manager IP address or FQDN, specific IP address, and desired protocol restrictions.