Home
Support
Product Support
Security
Cisco Secure Firewall Management Center
Configuration Guides

Use Cases for SD-WAN Capabilities in Cisco Secure Firewall

View all Saved Content

PDF

Is this helpful?

Helpful Unhelpful

Feedback

Thank you for your feedback. Your response has been recorded.

Ask about this document

Cisco Configuration Guide, Release 4.2

Table of contents

Expand all sections

About this document

Getting Started

Cisco Secure Firewall
SD-WAN Capabilities
SD-WAN Features of Cisco Secure Firewall

Simplify Branch to Hub Communication using Dynamic Virtual Tunnel Interface (DVTI)

Route-based VPN in a Hub and Spoke Topology
Benefits
Is This Use Case For You?
Scenario
Network Topology
Best Practices
Prerequisites
Workflow for Configuring a Route-based VPN (Hub and Spoke Topology)
Create a Route-based Site-to-Site VPN
Configure the Endpoint for the Hub Node
Configure the Endpoint for the Spoke Node
Configure OSPF on the Hub Node
Configure OSPF on the Spoke Node
Configure the Access Control Policy
Deploy Configuration
Verify Traffic Flow Over the VPN Tunnel
Configure the Backup VTI Interface on the Spoke Node
Configure an ECMP Zone for the Primary and Secondary VTI Interfaces
Verify the Primary and Secondary Tunnels
Troubleshoot Route-based VPN Tunnels
Additional Resources

Route Application Traffic from the Branch to the Internet Using Direct Internet Access (DIA)

Direct Internet Access
Benefits
Is This Use Case For You?
Components for Direct Internet Access
Best Practices
Prerequisites
Scenario 1: Direct Internet Access
Scenario 2: Direct Internet Access With Path Monitoring
Configure a Trusted DNS Server
Configure Interface Priority
Create an ECMP Zone
Configure an Equal Cost Static Route
Configure Path Monitoring Settings
Configure an Extended ACL Object for YouTube
Configure an Extended ACL Object for WebEx
Configure a Policy Based Routing Policy for YouTube
Configure a Policy Based Routing Policy for WebEx
Configure a Policy Based Routing Policy With Path Monitoring for Webex
Deploy Configuration
Verify Application Traffic Flow
Monitor and Troubleshoot Policy Based Routing
Additional Resources

Secure Internet Traffic Using Umbrella Auto Tunnel

Cisco Umbrella Auto Tunnel
Benefits
Is This Use Case For You?
Scenario
Network Topology
Best Practices for SASE Umbrella Tunnels
Prerequisites for Configuring Umbrella SASE Tunnels
Workflow for Configuring Umbrella Auto Tunnel
Configure a SASE Tunnel for Umbrella
Configure a Static Route
Configure an Extended ACL for DNS and Web Traffic
Configure a PBR Policy for DNS and Web Traffic
Deploy Configuration
Verify SASE Umbrella Tunnel Deployment
Troubleshoot Umbrella Auto Tunnels
Additional Resources

Empower Remote Workers with Secure Connectivity: DIA, Umbrella Auto Tunnel, and DVTI in Action

Enhancing Connectivity and Security for Remote Workers with DIA, Umbrella SASE Auto Tunnel, and DVTI
Is This Use Case For You?
Sample Scenario
Network Topology
Workflow for Configuring DIA, Umbrella Auto Tunnel, and DVTI
Additional Resources

Set Up SD-WAN Branch Office with Dual ISPs Using Registration Key and Device Templates

SD-WAN Wizard and Device Templates
Is this Guide for You?
Sample Scenario
System Requirements
Prerequisites for Using SD-WAN Wizard and Device Templates
Guidelines and Limitations for SD-WAN Wizard and Device Templates
Network Topology Depicting Dual ISP with Hubs and Spokes in the Same Region
Workflow for Setting Up SD-WAN Branch Office with Dual ISPs Using Registration Key and Device Templates
Verify Tunnel Statuses and Configurations of SD-WAN Topologies
Troubleshoot Device Templates and SD-WAN Topologies

Set Up SD-WAN Branch Office with Dual ISPs Using Serial Numbers and Device Template

SD-WAN Wizard and Device Templates
Is this Guide for You?
Sample Scenario
System Requirements
Prerequisites for Using SD-WAN Wizard and Device Templates
Guidelines and Limitations for SD-WAN Wizard and Device Templates
Network Topology Depicting Dual ISP with Hubs and Spokes
Workflow for Setting Up SD-WAN Branch Office with Dual ISPs Using Serial Number and Device Templates
Validate and Monitor Tunnel Statuses and Configurations of SD-WAN Topologies
Troubleshoot Device Templates and SD-WAN Topologies

Configure a Trusted DNS Server

Updated: February 5, 2026

Overview

Provides instructions to configure a trusted DNS server in Firewall Management Center (FMC) so that Threat Defense devices can resolve application domains for DIA traffic.

Application detection in DIA relies on DNS snooping to map the application domains to IPs in order to detect the application or a group of applications. To ensure that DNS requests are not resolved by rogue DNS servers and are indeed locked to desired DNS servers, Firewall Management Center allows you to configure trusted DNS servers for Firewall Threat Defense devices. Thus, the firewall only snoops the traffic that goes to trusted DNS servers. Apart from configuring the trusted DNS servers, you can include the already configured servers in DNS server group, DHCP pool, DHCP relay, and DHCP client as trusted DNS servers.

Note

For an application-based PBR, you must configure trusted DNS servers. You must also ensure that the DNS traffic passes through threat defense in a clear-text format (encrypted DNS is not supported) so that domains can be resolved to detect applications.

Before you begin

Ensure you have created one or more DNS server groups. For more information, see Creating DNS Server Group Objects.
Ensure you have created interface objects to connect to the DNS servers.
Ensure that the managed device has appropriate static or dynamic routes to access the DNS servers.

Procedure

	1.	Choose Devices > Platform Settings and edit a threat defense policy.
	2.	Click the Edit () icon.
	3.	Click DNS.
	4.	To configure the trusted DNS servers, click the Trusted DNS Servers tab.
	5.	To choose DNS_Server from the existing host objects, under Available Host Objects, search for it using the search field, and click Add to include it to the Selected DNS Servers list. Note DNS_Server is the DNS server configured in this example.
	6.	Click Save. The added DNS server is displayed in the Trusted DNS Servers page.
	7.	Click Policy Assignments to ensure NGFWBR1 is already in the Selected Devices list.
	8.	Click OK to confirm the changes.
	9.	Click Save to write the changes for platform settings.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.