Use Cases for SD-WAN Capabilities in Cisco Secure Firewall

PDF

Configure the Endpoint for the Hub Node

Updated: February 5, 2026

Overview

Provides instructions for configuring a Threat Defense (FTD) device as a hub in a route-based site-to-site VPN using Firewall Management Center (FMC).

When you specify the tunnel type as dynamic and configure the related parameters, the management center generates a dynamic virtual template. The virtual template dynamically generates the virtual access interface that is unique for each VPN session.

Procedure

1.

In the Hub Nodes section, click +. The Add Endpoint dialog box is displayed.
2.

Choose NGFW1 as the hub from the Device drop-down list.

Note

The device must be running on software version 7.3 or later.
3.

Click + next to the Dynamic Virtual Tunnel Interface drop-down list to add a new dynamic VTI.

The Add Virtual Tunnel Interface dialog box appears with the following pre-populated default configurations.

  • Tunnel Type is auto-populated with Dynamic.

  • Name is auto-populated as <tunnel_source interface logical name>+ dynamic_vti +<tunnel ID>. For example, outside_dynamic_vti_1 .

  • The Enabled checkbox is checked by default.

  • Security Zone –To define a security zone for this interface, choose New… from the drop-down list. In the New Security Zone dialog box, enter Tunnel_Zone as the name and click OK. Select Tunnel_Zone as the security zone for this tunnel interface.

  • Template ID is auto-populated with a unique ID for the DVTI interface.

  • Tunnel Source is the physical interface that is the source of the DVTI and is auto-populated by default. In this use case, we do not want to set an explicit tunnel source for the DVTI. Clear the selection by choosing Select Interface from the drop-down list.

  • IPsec Tunnel Mode is set to IPv4, by default.

  • IP address cannot be a static IP address as DVTI is a template interface. We recommend that you configure the Borrow IP for the dynamic interface from a loopback interface. To add a loopback interface, click + next to the Borrow IP (IP unnumbered) drop-down list. In the Add Loopback Interface dialog box:

    1. In the General tab, enter the Name as HUB_Tunnel_IP and Loopback ID as 1.

    2. In the IPv4 tab, enter the IP address as 198.48.133.81/32 .

    3. Click OK to save the loopback interface.

    The Borrow IP is set to Loopback 1(HUB_Tunnel_IP).

Click OK to save the DVTI. A message is displayed that confirms the VTI is created successfully. Click OK.

The Dynamic Virtual Tunnel Interface is set to outside_dynamic_vti_1(198.48.133.81).
4.

Select GigabitEthernet 0/0 (outside) from the Tunnel Source drop-down list. The IP address of the outside interface (198.18.133.81) is auto-populated in the next field.
5.

Expand Advanced Settings to view the default settings.
6.

Click OK.

NGFW1 is successfully configured as the hub node.