Log in to the Cisco Nexus Dashboard Orchestrator GUI.

In the left navigation menu, select Config > Site To Site Connectivity.

In the top right of the main pane, click Configure.

In the left pane, under Sites, select a specific cloud site.

Click View Details to load site settings.

Provide the general Inter-Site Connectivity information.

1. In the right <Site> Settings pane, select the Inter-Site Connectivity tab.

2. Enable the Multi-Site knob.

   This defines whether the overlay connectivity is established between this site and other sites.

   The overlay configuration will not be pushed to sites which do not have the underlay intersite connectivity that is established as described in the next step.

3. (Optional) Specify the BGP Password.

Provide site-specific Inter-Site Connectivity information.

1. In the right properties sidebar for the cloud site, click Add Site.

   The Add Site window opens.

2. Under Connected to Site, click Select a Site and select the site (for example, Site2) to which you want to establish connectivity from the site you are configuring (for example, Site1) .

   When you select the remote site, the Add Site window updates to reflect both directions of connectivity: Site1 > Site2 and Site2 > Site1.

3. In the Site1 > Site2 area, from the Connection Type drop-down, choose the type of connection between the sites.

   The following options are available:

   • Public Internet—Connectivity between the two sites is established through the Internet.

     This type is supported between any two cloud sites or between a cloud site and an on-premises site.

   • Private Connection—Connectivity is established using a private connection between the two sites.

     This type is supported between a cloud site and an on-premises site.

   • Cloud Backbone—Connectivity is established using cloud backbone.

     This type is supported between two cloud sites of the same type, such as Azure-to-Azure or AWS-to-AWS.

   If you have multiple types of sites (on-premises, AWS, and Azure), different pairs of site can use different connection type.

4. Choose the Protocol that you want to use for connectivity between these two sites.

   If using BGP-EVPN connectivity, you can optionally enable IPSec and choose which version of the Internet Key Exchange (IKE) protocol to use: IKEv1 (Version 1) or IKEv2 (Version 1) depending on your configuration.

   • For Public Internet connectivity, IPsec is always enabled.

   • For Cloud Backbone connectivity, IPsec is always disabled.

   • For Private Connection, you can choose to enable or disable IPsec.

   If using BGP-IPv4 connectivity instead, you must provide an external VRF which will be used for route leaking configuration from the cloud site you are configuring.

   After Site1 > Site2 connectivity information is provided, the Site2 > Site1 area will reflect the connectivity information in the opposite direction.

5. Click Save to save the intersite connectivity configuration.

   When you save connectivity information from Site1 to Site2, the reverse connectivity is automatically created from Site2 to Site1, which you can see by selecting the other site and checking the Inter-site Connectivity information in the right sidebar.

6. Repeat this step to add intersite connectivity for other sites.

   When you establish underlay connectivity from Site1 to Site2, the reverse connectivity is done automatically for you.

   However, if you also want to establish intersite connectivity from Site1 to Site3, you must repeat this step for that site as well.

Provide External Connectivity information.

1. In the right <Site> Settings pane, select the External Connectivity tab.

2. Click Add External Connection.

   The Add External Connectivity dialog opens.

3. From the VRF drop-down, select the VRF you want to use for external connectivity.

   This is the VRF which will be used to leak the cloud routes. The Regions section displays the cloud regions that contain the CSRs to which this configuration be applied.

4. From the Name drop-down in the External Devices section, select the external device.

   This is the external device that you added in the General Settings > External Devices list during general infra configuration and must already be defined as described in Configuring Infra: General Settings.

5. From the Tunnel IKE Version drop-down, pick the IKE version that will be used to establish the IPsec tunnel between the cloud site's CSRs and the external device.

6. (Optional) From the Tunnel Subnet Pool drop-down, choose one of the named subnet pools.

   Named subnet pools are used to allocate IP addresses for IPsec tunnels between cloud site CSRs and external devices. If you do not provide any named subnet pools here, the external subnet pool will be used for IP allocation.

   Providing a dedicated subnet pool for external device connectivity is useful for cases where a specific subnet is already being used to allocate IP addresses to the external router and you want to continue to use those subnets for IPsec tunnels for NDO and cloud sites.

   If you want to provide a specific subnet pool for this connectivity, it must already be created as described in Configuring Infra: General Settings.

7. (Optional) In the Pre-Shared Key field, provide the custom keys that you want to use to establish the tunnel.

8. If necessary, repeat the previous substeps for any additional external devices you want to add for the same external connection (same VRF).

9. If necessary, repeat this step for any additional external connections (different VRFs).

   There's a one-to-one relationship for tunnel endpoints between CSRs and external devices, so while you can create extra external connectivity using different VRFs, you cannot create extra connectivity to the same external devices.