Use Cases for SD-WAN Capabilities in Cisco Secure Firewall
Is this content helpful?
Thank you for your feedback. Your response has been recorded.
AI responses are currently only available to logged in users. Log in
Only ask questions about this document. To ask questions about this product as a whole, go to Technical Documentation .
Suggestions
Sorry, we couldn't generate a response for this query.
Use Cases for SD-WAN Capabilities in Cisco Secure Firewall
Updated: February 5, 2026
Want to summarize with AI?
Log inProvides instructions for configuring a Threat Defense (FTD) device as a hub in a route-based site-to-site VPN using Firewall Management Center (FMC).
When you specify the tunnel type as dynamic and configure the related parameters, the management center generates a dynamic virtual template. The virtual template dynamically generates the virtual access interface that is unique for each VPN session.
In the Hub Nodes section, click +. The Add Endpoint dialog box is displayed.
Choose NGFW1 as the hub from the Device drop-down list.
NoteThe device must be running on software version 7.3 or later.
Click + next to the Dynamic Virtual Tunnel Interface drop-down list to add a new dynamic VTI.
The Add Virtual Tunnel Interface dialog box appears with the following pre-populated default configurations.
Tunnel Type is auto-populated with Dynamic.
Name is auto-populated as <tunnel_source interface logical name>+ dynamic_vti +<tunnel ID>. For example, outside_dynamic_vti_1 .
The Enabled checkbox is checked by default.
Security Zone –To define a security zone for this interface, choose New… from the drop-down list. In the New Security Zone dialog box, enter Tunnel_Zone as the name and click OK. Select Tunnel_Zone as the security zone for this tunnel interface.
Template ID is auto-populated with a unique ID for the DVTI interface.
Tunnel Source is the physical interface that is the source of the DVTI and is auto-populated by default. In this use case, we do not want to set an explicit tunnel source for the DVTI. Clear the selection by choosing Select Interface from the drop-down list.
IPsec Tunnel Mode is set to IPv4, by default.
IP address cannot be a static IP address as DVTI is a template interface. We recommend that you configure the Borrow IP for the dynamic interface from a loopback interface. To add a loopback interface, click + next to the Borrow IP (IP unnumbered) drop-down list. In the Add Loopback Interface dialog box:
In the General tab, enter the Name as HUB_Tunnel_IP and Loopback ID as 1.
In the IPv4 tab, enter the IP address as 198.48.133.81/32 .
Click OK to save the loopback interface.
The Borrow IP is set to Loopback 1(HUB_Tunnel_IP).
Click OK to save the DVTI. A message is displayed that confirms the VTI is created successfully. Click OK.
The Dynamic Virtual Tunnel Interface is set to outside_dynamic_vti_1(198.48.133.81).
Select GigabitEthernet 0/0 (outside) from the Tunnel Source drop-down list. The IP address of the outside interface (198.18.133.81) is auto-populated in the next field.
Expand Advanced Settings to view the default settings.
Click OK.
NGFW1 is successfully configured as the hub node.
Need help?
(Requires a Cisco Service Contract)
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.