Choose Devices > Site To Site, and click Add.

In the Topology Name field, enter SDWAN-VPN1 as the name for the SD-WAN VPN topology.

Click the SD-WAN Topology radio button and click Create.

Configure a hub:

1. Click Add Hub.

2. From the Device drop-down list, choose a hub.

3. Click + next to the Dynamic Virtual Tunnel Interface (DVTI) drop-down list to add a dynamic VTI for the hub.

   The Add Virtual Tunnel Interface dialog box is prepopulated with default configurations. However, you must configure the following parameters:

   1. From the Tunnel Source drop-down list, choose the physical interface that is the source of the dynamic VTI. Choose the IP address of this interface from the adjacent drop-down list.

   2. From the Borrow IP drop-down list, choose a loopback interface from the drop-down list. The dynamic VTI inherits this IP address.

      • For SDWAN-VPN1: For Hub1, we use Loopback1 (209.165.201.1) as the Borrow IP.

      • For SDWAN-VPN2: For Hub1, we use Loopback2 (209.165.201.65) as the Borrow IP.

      For more information about the loopback IP addresses of the hubs, see Table 2.

4. Click OK.

5. In the Hub Gateway IP Address field, enter the public IP address of the hub's VPN interface or the tunnel source of the dynamic VTI to which the spokes connect.

   This IP address is auto populated if the interface has a static IP address. If hub is behind a NAT device, you must manually configure the post-NAT IP address.

   • For SDWAN-VPN1: For Hub1, the Hub Gateway IP Address is 192.0.2.17.

   • For SDWAN-VPN2: For Hub1, the Hub Gateway IP Address is 192.0.2.33.

   For more information about the IP addresses of the hubs and spokes, see Table 1.

6. From the Spoke Tunnel IP Address Pool drop-down list, choose an IP address pool or click + to create an address pool.

   Note

   Ensure that you do not check the Allow Overrides check box when you create an address pool in the Add IP Pool dialog box.

   When you add spokes, the wizard auto generates spoke tunnel interfaces, and assigns IP addresses to these spoke interfaces from this IP address pool.

7. Click Add to save the hub configuration.

   

8. (Optional) To add a secondary hub, repeat Step 4a to Step 4g.

   

9. Click Next.

To configure spokes, click Add Spokes (Bulk Addition). In the Add Bulk Spokes dialog box, configure the following parameters:

Configure Authentication Settings for the devices in the SD-WAN topology:

1. From the Authentication Type drop-down list, choose a manual pre-shared key, an auto-generated pre-shared key, or a certificate for device authentication.

   You can use the default settings in this step and proceed to the next step. If required, you can edit the settings later on. In this example, we use Pre-shared Manual Key for device authentication.

   • Pre-shared Manual Key—Specify the pre-shared key for the VPN connection.

   • Pre-shared Automatic Key—(Default value) The wizard automatically defines the pre-shared key for the VPN connection. Specify the key length in the Pre-shared Key Length field. The range is 1 to 127.

   • Certificate—When you use certificates as the authentication method, the peers obtain digital certificates from a CA server in your PKI infrastructure, and use them to authenticate each other.

2. Choose one or more algorithms from the Transform Sets drop-down list.

3. Choose one or more algorithms from the IKEv2 Policies drop-down list.

   

4. Click Next.

Configure the SD-WAN Settings:

1. From the Spoke Tunnel Interface Security Zone drop-down list, choose a security zone or click + to create a security zone to which the wizard automatically adds the spokes' auto-generated Static Virtual Tunnel Interfaces (SVTIs).

2. Check the Enable BGP on the VPN Overlay Topology check box to automate BGP configurations such as neighbor configurations between the overlay tunnel interfaces and basic route redistribution from the directly connected LAN interfaces of the hubs and spokes.

3. In the Autonomous System Number field, enter an Autonomous System (AS) number.

   AS number is a unique number for a network with a single routing policy. BGP uses AS numbers to identify networks. The spoke's BGP neighbor configuration is generated based on the corresponding hub’s AS number. Range is from 0 to 65536.

   • If all the hubs and spokes are in the same region, by default, 64512 is the AS number.

   • If the primary and secondary hubs are in different regions, the primary hub and the spokes are configured with 64512 as the AS number, and the secondary hub is configured with a different AS number.

4. In the Community Tag for Local Routes field, enter the BGP community attribute to tag connected and redistributed local routes. This attribute enables easy route filtering. Note this community string, you must use the same community string for the second SD-WAN VPN topology.

5. Check the Redistribute Connected Interfaces check box and choose an interface group from the drop-down list or click + to create an interface group with connected inside or LAN interfaces for BGP route redistribution in the overlay topology.

6. Check the Enable Multiple Paths for BGP check box to allow multiple BGP routes to be used at the same time to reach the same destination. This option enables BGP to load-balance traffic across multiple links.

7. (Optional) Check the Secondary Hub is in Different Autonomous System check box. This check box appears only if you have a secondary hub in this topology.

8. In the Autonomous System Number field, enter the AS number for the secondary hub. In our example, both the hubs are in the same region and have the same AS number.

9. In the Community Tag for Learned Routes field, enter the BGP community attribute to tag routes learned from other SD-WAN peers over the VPN tunnel. This attribute is required only for eBGP configuration when the secondary hub has a different AS number. This field appears only if you have configured two hubs in the SD-WAN topology. In our example, we do not have to configure this value because all the devices are in the same region.

   

10. Click Next.

Click Finish to save and validate the SD-WAN topology.

Choose Devices > Template Management.

Click Add Device Template.

1. In the Name field, enter the name for the template.

2. (Optional) In the Description field, enter a description for the template.

3. From the Access Control Policy drop-down list, choose an access control policy.

Click OK.

Choose Devices > Template Management.

Click the edit icon of the template in which you want to add the physical interface.

In the Interfaces tab, click Add Physical Interface.

Choose a Slot and Port Index number from the drop-down list.

Click Create Interface.

You can rename the outside interfaces of the device template. In this example, these interfaces are outside-isp1 and outside-isp2.

Choose Devices > Template Management.

Click the edit icon adjacent to the device template that you want to edit.

Click the VPN tab.

Click Add VPN Connection.

Choose an SD-WAN topology from the VPN Topology drop-down list.

1. From the VPN Interface drop-down list, choose a WAN-facing or internet-facing physical interface to establish a VPN connection with the hub.

   This list contains all the interfaces configured in the device template. In this example, the VPN interface is outside-isp1.

2. Use IP Address from the VPN Interface—This drop-down list is auto populated with the IP address variable. For IPv6 address, choose an IPv6 address from the drop-down list.

3. Check the Local Tunnel (IKE) Identity check box to enable a unique and configurable identity for the VPN tunnel from the spoke to a remote peer.

4. Identity Type—Key ID is the only supported identity type. Choose a key ID variable from the drop-down list or click + to create a new key ID variable.

5. Click OK.

   

   You can view the VPN connection in the Site-to-Site VPN Connections table.

Click Save.

Repeat Step 4 to Step 6 to configure another SD-WAN VPN connection using the second outside interface.

In this example, the second outside interface is outside-isp2, and there are two SD-WAN VPN connections:

• SDWAN-VPN1 with outside-isp1 as the VPN interface

• SDWAN-VPN2 with outside-isp2 as the VPN interface

Choose Devices > Template Management.

Click Add Model Mapping for the template in which you want to create the model mapping. Alternatively, you can click the edit icon of the template and choose Template Settings > Model Mapping.

Click Add Model Mapping

Choose the Device Model from the drop-down list.

Map the template interfaces to the device model interfaces by choosing the interface from the Model Interface drop-down list.

Click Save.

Note

Some configurations in the template may not be supported on all device models. Unsupported configurations, if any, are not applied to the device. The Device Template Apply Report provides details about such configurations.

Choose Devices > Device Management.

Click Add > Device (Wizard).

In the Add Device (Wizard) window, choose Registration Key to register a device using registration key.

Click Next.

Choose a template from the Device template drop-down list.

Click Next.

In the Host field, enter the IP address or the hostname of the device you want to add.

In the Display name field, enter a name for the device as you want it to display in the management center.

In the Registration key field, enter the same registration key that you used when you configured the device to be managed by the management center. The registration key is a one-time-use shared secret. The key can include alphanumeric characters and hyphens (-).

(Optional) From the Device group drop-down list, choose a device group in which the device is added.

Enter values for the Variables and Network object overrides.

Click Add Device to initiate device registration.

In the Notifications > Tasks window, you can view the messages related to the device registration, device discovery, and device template application.

A Device Template Apply report is generated after the apply template task is completed. This report is generated on both successful and unsuccessful application of the template on the device. You will see a link to this report in the Notifications > Tasks window.