Step 1

Choose Devices > Site To Site, and click Add.

Step 2

In the Topology Name field, enter SDWAN-VPN1 as the name for the SD-WAN VPN topology.

Step 3

Click the SD-WAN Topology radio button and click Create.

Step 4

Configure a hub:

1. Click Add Hub.

2. From the Device drop-down list, choose a hub.

3. Click + next to the Dynamic Virtual Tunnel Interface (DVTI) drop-down list to add a dynamic VTI for the hub.

   The Add Virtual Tunnel Interface dialog box is prepopulated with default configurations. However, you must configure the following parameters:

   1. From the Tunnel Source drop-down list, choose the physical interface that is the source of the dynamic VTI. Choose the IP address of this interface from the adjacent drop-down list.

   2. From the Borrow IP drop-down list, choose a loopback interface. The dynamic VTI inherits this IP address.

      • For SDWAN-VPN1: For Hub1, we use Loopback1 (209.165.201.1) as the Borrow IP address.

      • For SDWAN-VPN2: For Hub1, we use Loopback2 (209.165.201.65) as the Borrow IP address.

      For more information about the loopback IP addresses of the hubs, see Table 2.

4. Click OK.

5. In the Hub Gateway IP Address field, enter the public IP address of the hub's VPN interface or the tunnel source of the dynamic VTI to which the spokes connect.

   This IP address is auto populated if the interface has a static IP address. If hub is behind a NAT device, you must manually configure the post-NAT IP address.

   • For SDWAN-VPN1: For Hub1, the Hub Gateway IP Address is 192.0.2.17.

   • For SDWAN-VPN2: For Hub1, the Hub Gateway IP Address is 192.0.2.33.

   For more information about the IP addresses of the hubs and spokes, see Table 1.

6. From the Spoke Tunnel IP Address Pool drop-down list, choose an IP address pool or click + to create an address pool.

   When you add spokes, the wizard auto generates spoke tunnel interfaces, and assigns IP addresses to these spoke interfaces from this IP address pool.

   Note	Ensure that you do not check the Allow Overrides check box when you create an address pool in the Add IP Pool dialog box.

7. Click Add to save the hub configuration.

   

8. To add the secondary hub, repeat Step 4a to Step 4g.

   

9. Click Next.

Step 5

To configure spokes, click Add Spokes (Bulk Addition).

Step 6

Configure Authentication Settings for the devices in the SD-WAN topology:

1. From the Authentication Type drop-down list, choose a manual pre-shared key, an auto-generated pre-shared key, or a certificate for device authentication.

   • Pre-shared Manual Key—Specify the pre-shared key for the VPN connection.

   • Pre-shared Automatic Key—(Default value) The wizard automatically defines the pre-shared key for the VPN connection. Specify the key length in the Pre-shared Key Length field. The range is 1 to 127.

   • Certificate—When you use certificates as the authentication method, the peers obtain digital certificates from a CA server in your PKI infrastructure, and use them to authenticate each other.

2. Choose one or more algorithms from the Transform Sets drop-down list.

3. Choose one or more algorithms from the IKEv2 Policies drop-down list.

   

4. Click Next.

Step 7

Configure the SD-WAN Settings.

1. From the Spoke Tunnel Interface Security Zone drop-down list, choose a security zone or click + to create a security zone to which the wizard automatically adds the spokes' auto-generated Static Virtual Tunnel Interfaces (SVTIs).

2. Check the Enable BGP on the VPN Overlay Topology check box to automate BGP configurations such as neighbor configurations between the overlay tunnel interfaces and basic route redistribution from the directly connected LAN interfaces of the hubs and spokes.

3. In the Autonomous System Number field, enter an Autonomous System (AS) number.

   AS number is a unique number for a network with a single routing policy. BGP uses AS numbers to identify networks. The spoke's BGP neighbor configuration is generated based on the corresponding hub’s AS number. Range is from 0 to 65536.

   • If all the hubs and spokes are in the same region, by default, 64512 is the AS number.

   • If the primary and secondary hubs are in different regions, the primary hub and its spokes are configured with 64512 as the AS number, and the secondary hub is configured with a different AS number.

     In our example, Hub1 and the spokes are in the same region with AS number as 1111. Hub2 is in a different region with AS number as 2222.

4. In the Community Tag for Local Routes field, enter the BGP community attribute to tag the connected and redistributed local routes. This attribute enables easy route filtering. Make a note of this community string; you must use the same community string for the second SD-WAN VPN topology. In our example, this tag is 1.

5. Check the Redistribute Connected Interfaces check box and choose an interface group from the drop-down list, or click + to create an interface group with connected inside or LAN interfaces for BGP route redistribution in the overlay topology.

6. Check the Secondary Hub is in different Autonomous System check box. This check box is displayed only if you have a secondary hub in this topology.

7. In the Autonomous System Number field, enter the AS number for the secondary hub. In our example, Hub2 is in a different region with AS number as 2222.

8. In the Community Tag for Learned Routes field, enter the BGP community attribute to tag the routes learned from other SD-WAN peers over the VPN tunnel. This attribute is required only for eBGP configuration when the secondary hub has a different AS number. This field appears only if you have configured two hubs in the SD-WAN topology. Make a note of this community string, you must use the same community string for the second SD-WAN VPN topology. In our example, this tag is 2.

9. Check the Enable Multiple Paths for BGP check box to allow multiple BGP routes to be used at the same time to reach the same destination. This option enables BGP to load-balance traffic across multiple links.

   

10. Click Next.

Step 8

Click Finish to save and validate the SD-WAN topology.

Step 9

Repeat Step 1 to Step 8 to configure the SDWAN-VPN2 topology with the VPN interface for ISP2: outside-isp2.

Step 1

Choose Devices > Template Management.

Step 2

Click Add Device Template.

1. In the Name field, enter the name for the template.

2. (Optional) In the Description field, enter a description for the template.

3. From the Access Control Policy drop-down list, choose an access control policy.

Step 3

Click OK.

Step 1

Choose Devices > Template Management.

Step 2

Click the edit icon of the template in which you want to add the physical interface.

Step 3

In the Interfaces tab, click Add Physical Interface.

Step 4

Choose a Slot and Port Index number from the drop-down list.

Step 5

Click Create Interface.

You can rename the outside interfaces of the device template. In this example, these interfaces are outside-isp1 and outside-isp2.

Step 1

Choose Devices > Template Management.

Step 2

Click the edit icon adjacent to the device template that you want to edit.

Step 3

Click the VPN tab.

Step 4

Click Add VPN Connection.

Step 5

Choose an SD-WAN topology from the VPN Topology drop-down list.

1. From the VPN Interface drop-down list, choose a WAN-facing or internet-facing physical interface to establish a VPN connection with the hub.

   This list contains all the interfaces configured in the device template. In this example, the VPN interface is outside-isp1.

2. Use IP Address from the VPN Interface—This drop-down list is auto populated with the IP address variable. For IPv6 address, choose an IPv6 address from the drop-down list.

3. Check the Local Tunnel (IKE) Identity check box to enable a unique and configurable identity for the VPN tunnel from the spoke to a remote peer.

4. Identity Type—Key ID is the only supported identity type. Choose a key ID variable from the drop-down list or click + to create a new key ID variable.

5. Click OK.

   

   You can view the VPN connection in the Site-to-Site VPN Connections table.

Step 6

Click Save.

Step 7

Repeat Step 4 to Step 6 to configure another SD-WAN VPN connection using the second outside interface.

In this example, the second outside interface is outside-isp2, and there are two SD-WAN VPN connections:

• SDWAN-VPN1 with outside-isp1 as the VPN interface

• SDWAN-VPN2 with outside-isp2 as the VPN interface

Step 1

Choose Devices > Template Management.

Step 2

Click Add Model Mapping for the template in which you want to create the model mapping. Alternatively, you can click the edit icon of the template and choose Template Settings > Model Mapping.

Step 3

Choose the Device Model from the drop-down list.

Step 4

Map the template interfaces to the device model interfaces by choosing the interface from the Model Interface drop-down list.

Step 5

Click Save.

Note	Some configurations in the template may not be supported on all device models. Unsupported configurations, if any, are not applied to the device. The Device Template Apply Report provides details about such configurations.

Step 1

Choose Devices > Device Management.

Step 2

Click Add > Device (Wizard).

Step 3

In Device registration method, click Serial Number and click Next.

Step 4

In Initial device configuration:

1. Click the Device template radio button.

2. From the Device template drop-down list, choose a device template for the device, and click Next.

Step 5

In Device details:

1. Download SampleTemplate.csv. This file includes parameters that must be defined for each device. For more information on the CSV template file parameters, see CSV Template File.

2. Drag & drop your CSV template file or click Browse to select the CSV template file that you want to upload. A validation check is done on the file after you upload it.

   After the CSV template file has been uploaded successfully, the content of the CSV template file is displayed in a table format.

   See the following sample CSV template file containing parameters for onboarding the Cisco Firepower 1120 Threat Defense device.

   
   DisplayName,SerialNumber,AdminPassword,$Local_Identity1_SDWAN_ISP1,$Local_Identity2_SDWAN_ISP2,$Local_Identity_SDWAN_ISP1,$Local_Identity_SDWAN_ISP2,$outside-isp1-ipv4,$outside-isp2-ipv4
   Spoke,FJC282917RQ,******,,SDWAN-VPN2_isp1_Spoke,SDWAN-VPN2_isp2_Spoke,SDWAN-VPN1_isp1_Spoke,SDWAN-VPN1_isp2_Spoke,192.0.2.21/28,192.0.2.37/28
   
   

Step 6

Click Add Device to initiate device registration.

In the Notifications > Tasks window, you can view the messages related to the device registration, device discovery, and device template application.

A Device Template Apply report is generated after the apply template task is completed. This report is generated on both successful and unsuccessful application of the template on the device. You will see a link to this report in the Notifications > Tasks window.