Home
Support
Product Support
Security
Cisco Secure Firewall Management Center
Configuration Guides

Use Cases for SD-WAN Capabilities in Cisco Secure Firewall

View all Saved Content

PDF

Is this helpful?

Helpful Unhelpful

Feedback

Thank you for your feedback. Your response has been recorded.

Ask about this document

Cisco Configuration Guide, Release 4.2

Table of contents

Expand all sections

About this document

Getting Started

Cisco Secure Firewall
SD-WAN Capabilities
SD-WAN Features of Cisco Secure Firewall

Simplify Branch to Hub Communication using Dynamic Virtual Tunnel Interface (DVTI)

Route-based VPN in a Hub and Spoke Topology
Benefits
Is This Use Case For You?
Scenario
Network Topology
Best Practices
Prerequisites
Workflow for Configuring a Route-based VPN (Hub and Spoke Topology)
Create a Route-based Site-to-Site VPN
Configure the Endpoint for the Hub Node
Configure the Endpoint for the Spoke Node
Configure OSPF on the Hub Node
Configure OSPF on the Spoke Node
Configure the Access Control Policy
Deploy Configuration
Verify Traffic Flow Over the VPN Tunnel
Configure the Backup VTI Interface on the Spoke Node
Configure an ECMP Zone for the Primary and Secondary VTI Interfaces
Verify the Primary and Secondary Tunnels
Troubleshoot Route-based VPN Tunnels
Additional Resources

Route Application Traffic from the Branch to the Internet Using Direct Internet Access (DIA)

Direct Internet Access
Benefits
Is This Use Case For You?
Components for Direct Internet Access
Best Practices
Prerequisites
Scenario 1: Direct Internet Access
Scenario 2: Direct Internet Access With Path Monitoring
Configure a Trusted DNS Server
Configure Interface Priority
Create an ECMP Zone
Configure an Equal Cost Static Route
Configure Path Monitoring Settings
Configure an Extended ACL Object for YouTube
Configure an Extended ACL Object for WebEx
Configure a Policy Based Routing Policy for YouTube
Configure a Policy Based Routing Policy for WebEx
Configure a Policy Based Routing Policy With Path Monitoring for Webex
Deploy Configuration
Verify Application Traffic Flow
Monitor and Troubleshoot Policy Based Routing
Additional Resources

Secure Internet Traffic Using Umbrella Auto Tunnel

Cisco Umbrella Auto Tunnel
Benefits
Is This Use Case For You?
Scenario
Network Topology
Best Practices for SASE Umbrella Tunnels
Prerequisites for Configuring Umbrella SASE Tunnels
Workflow for Configuring Umbrella Auto Tunnel
Configure a SASE Tunnel for Umbrella
Configure a Static Route
Configure an Extended ACL for DNS and Web Traffic
Configure a PBR Policy for DNS and Web Traffic
Deploy Configuration
Verify SASE Umbrella Tunnel Deployment
Troubleshoot Umbrella Auto Tunnels
Additional Resources

Empower Remote Workers with Secure Connectivity: DIA, Umbrella Auto Tunnel, and DVTI in Action

Enhancing Connectivity and Security for Remote Workers with DIA, Umbrella SASE Auto Tunnel, and DVTI
Is This Use Case For You?
Sample Scenario
Network Topology
Workflow for Configuring DIA, Umbrella Auto Tunnel, and DVTI
Additional Resources

Set Up SD-WAN Branch Office with Dual ISPs Using Registration Key and Device Templates

SD-WAN Wizard and Device Templates
Is this Guide for You?
Sample Scenario
System Requirements
Prerequisites for Using SD-WAN Wizard and Device Templates
Guidelines and Limitations for SD-WAN Wizard and Device Templates
Network Topology Depicting Dual ISP with Hubs and Spokes in the Same Region
Workflow for Setting Up SD-WAN Branch Office with Dual ISPs Using Registration Key and Device Templates
Verify Tunnel Statuses and Configurations of SD-WAN Topologies
Troubleshoot Device Templates and SD-WAN Topologies

Set Up SD-WAN Branch Office with Dual ISPs Using Serial Numbers and Device Template

SD-WAN Wizard and Device Templates
Is this Guide for You?
Sample Scenario
System Requirements
Prerequisites for Using SD-WAN Wizard and Device Templates
Guidelines and Limitations for SD-WAN Wizard and Device Templates
Network Topology Depicting Dual ISP with Hubs and Spokes
Workflow for Setting Up SD-WAN Branch Office with Dual ISPs Using Serial Number and Device Templates
Validate and Monitor Tunnel Statuses and Configurations of SD-WAN Topologies
Troubleshoot Device Templates and SD-WAN Topologies

Network Topology

Updated: February 5, 2026

Overview

llustrates the end‑to‑end topology workflow for configuring a route-based VPN for a hub and spoke topology in Cisco Firewall Management Center (FMC).

In this hub spoke topology, a threat defense device is deployed at a branch location. In the figure below, the internal client or branch workstation is labelled WKST BR and the branch (spoke) threat defense is labelled NGFWBR1. The headquarters (hub) is labelled as NGFW1 and is connected to the corporate network. A VPN tunnel is configured between NGFWBR1 and NGFW1. An ECMP zone is configured on the primary and secondary static VTI interfaces on the branch node for link redundancy and loading balancing of VPN traffic.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.