Configure RBAC for policy groups

Ensure that the granular role-based access control (RBAC) for policy groups is specified by expanding it. With specific permissions to the usergroup, ensure that you are able to access policy groups from Configuration > Policy Groups.

1. From the Cisco SD-WAN Manager menu, choose Administration > Manage Users > User Groups.

2. Click Add User Group.

3. Enter User Group Name.

4. Select the Read or Write check box against the Policy Group and Device feature that you want to assign to a user group.

5. Click Add.

Configure RBAC for Application Priority Policy

Ensure that the granular RBAC for the application priority policy is specified by expanding it. With the set permissions to the usergroup, ensure that you are able to access the application priority policy from Configuration > Policy Groups.

1. From the Cisco SD-WAN Manager menu, choose Administration > Manage Users > User Groups.

2. Click Add User Group.

3. Enter User Group Name.

4. Select the Read or Write check box against the following features that you want to assign to a user group:

   • Feature Profile > Application Priority > Qos Policy

   • Feature Profile > Application Priority > Traffic Policy

   • Feature Profile > Policy Object > App List

   • Feature Profile > Policy Object > SLA Class

   • Feature Profile > Policy Object > TLOC

   • Feature Profile > Policy Object > App Probe

   • Feature Profile > Policy Object > Preferred Color Group

   • Feature Profile > Policy Object > Class

   • Feature Profile > Policy Object > Data Prefix

   • Feature Profile > Policy Object > Data Ipv6

   • Feature Profile > Policy Object > Policer

5. Click Add.

Application

1. Click Application.

2. Click Add Application .

3. From the Application/Application family list drop-down, choose the required applications or application families.

4. Click Save.

A few application lists are preconfigured. You cannot edit or delete these lists.

Microsoft_Apps: Includes Microsoft applications, such as Excel, Skype, and Xbox. To display a full list of Microsoft applications, click the list in the Entries column.

Google_Apps: Includes Google applications, such as Gmail, Google Maps, and YouTube. To display a full list of Google applications, click the list in the Entries column.

App Probe Class

1. Click Add App Probe Class.

2. In the App Probe dialog box, specify the following:

   Field	Description
   Probe Class Name	Enter a name for the probe class.
   Forwarding Class	Choose the forwarding class from the drop-down list.
   Color	Choose the color from the drop-down list.
   DSCP	Enter the DSCP value.

3. You can add more entries if needed by clicking on + icon.

4. Click Save.

Color

1. Click Color.

2. Click New Color List and specify the following:

   Field	Description
   Color List Name	Enter a name for the list.
   Select Color	Choose one or more color lists types from the drop-down list.

3. Click Add.

To configure multiple colors in a single list, you can choose multiple colors from the drop-down list.

Community List

A community list is used to create groups of communities to use in a match clause of a route map. A community list can be used to control which routes are accepted, preferred, distributed, or advertised. You can also use a community list to set, append, or modify the communities of a route.

1. Click Community List.

2. Click Add Community List and specify the following:

   Field	Description
   Community List Name	Enter a name of the community list.
   Add Community	Enter one or more communities separated by commas. aa:nn: Autonomous System (AS) number and network number. Each number is a 2-byte value with a range from 1 to 65535. For example, 65526. internet: Routes in this community are advertised to the internet community. This community comprises all BGP-speaking networking devices. local-as: Routes in this community are not advertised outside the local AS number. no-advertise: Attaches the NO_ADVERTISE community to routes. Routes in this community are not advertised to other BGP peers. no-export: Attaches the NO_EXPORT community to routes. Routes in this community are not advertised outside the local AS or outside a BGP confederation boundary. To configure multiple BGP communities in a single list, include multiple community options, specifying one community in each option.

3. Click Save.

Data Prefix

1. Click Data Prefix.

2. Click Add Data Prefix.

3. In the Data Prefix list dialog box, specify the following:

   Field	Description
   Data Prefix List Name	Enter a name for the data prefix list.
   Add Data Prefix	Enter one or more data prefixes separated by commas. Does not support: 0.0.0.0/0

4. Click Save.

Data Prefix IPv6

1. Click Data Prefix IPv6.

2. Click Add Data Prefix IPv6.

3. In the Data Prefix List dialog box, specify the following:

   Field	Description
   Data Prefix List Name	Enter a name for the IPv6 data prefix list.
   Add Data Prefix	Enter one or more IPv6 data prefixes separated by commas. Does not support: ::/0

4. Click Save.

Expanded Community List

1. Click Expanded Community List.

2. Click Add Expanded Community List and specify the fiollowing:

   Field	Description
   Community List Name	Enter a name for the community list.
   Add Community	Specify details of the expanded community list that is used to filter communities using a regular expression.

Forwarding Class

1. Click Add Forwarding Class and specify the following:

   Field	Description
   Forwarding Class	Enter a name for the forwarding class.
   Queue	Choose a value for the queue from the drop-down list.

2. Click Save.

Policer

1. Click Policer.

2. Click Add Policer and specify the following:

   Field	Description
   Policer List Name	Enter a name for the policer list.
   Burst (bytes)	Enter the maximum traffic burst size. The range is from 15,000 to 10,000,000 bytes.
   Exceed	Choose the action to take when the burst size or traffic rate is exceeded. The options are: Drop: sets the packet loss priority (PLP) to low Remark: sets the packet loss priority (PLP) to high
   Rate	Enter the maximum traffic rate, a value from 8 through 10^11 bits per second (bps).

3. Click Save.

Preferred Color Group

1. Click Add Preferred Color Group.

2. In the Preferred Color Group Name field, enter a name for the preferred color group.

3. Choose the color preference and path prefernce for the primary, secondary, and tertiary colors from the Color Preference and the Path Preference drop-down lists.

   Field	Description
   Preferred Color Group Name	Enter a name for the preferred color group.
   Color Preference	Choose the color preference from the drop-down list. You can choose multiple colors.
   Path Preference	Choose the path preference from the drop-down list. The options are: Direct Path Multi Hop Path All Paths

4. Click Save.

Prefix List

1. Click Prefix List.

2. Click Add Prefix List and specify the following:

   Field	Description
   Prefix List Name	Enter a name for the IPv4 prefix list.
   Add Prefix	Enter one or more IPv4 prefixes separated by commas.

3. Click Save.

Prefix List IPv6

1. Click Prefix List IPv6.

2. Click Add Prefix List and specify the following:

   Field	Description
   Prefix List Name	Enter a name for the IPv6 prefix list.
   Add Prefix	Enter one or more IPv6 prefixes separated by commas.

3. Click Save.

SLA Class

1. Click SLA Class.

2. Click Add SLA Class and specify the following:

   Field	Description
   SLA Class List Name	Enter a name of the SLA class list.
   Loss (%)	Enter the maximum packet loss on the connection, a value from 0 through 100.
   Latency	Enter the maximum packet latency on the connection, a value from 1 through 1,000 milliseconds.
   Jitter	Enter the maximum jitter on the connection, a value from 1 through 1,000 milliseconds.
   App Probe Class	Choose the app probe class from the drop-down list or click Create New to create one.
   Fallback Best Tunnel	Choose this option to enable the best tunnel criteria.

3. Click Save.

TLOC List

1. Click TLOC List.

2. Click Add TLOC List and specify the following:

   Field	Description
   List Name	Enter a name for the TLOC list.
   TLOC IP	Specify the IP address for TLOC.
   Color	Choose the color from the drop-down list.
   Encapsulation	Choose the value from the drop-down list. The options are: IPSec GRE
   Preference	Choose a preference to associate with the TLOC. The range is 0 to 4294967295.

3. Click Save.

Create an Application Priority and SLA Policy

Click + Application priority & SLA policy to create a policy and configure the values. To edit an existing policy, click the ellipsis icon (...) next to the application priority and SLA policy under Action and click Edit.

Choose one of the following options and configure the values that are based on the likely business relevance of the applications, and to give higher priority to business-relevant applications:

• Gold (Business-relevant): Likely to be important for business operations, for example, WebEx software.

• Silver (Default): No determination of relevance to business operations.

• Bronze (Business-irrelevant): Unlikely to be important for business operations, for example, gaming software.

Within each of the business-relevance categories, the workflow groups the applications into application lists, such as broadcast video, multimedia conferencing, VoIP telephony, and so on.

Note

When you upgrade Cisco SD-WAN Manager, built-in protocol pack gets updated. This might affect the existing policy groups which are using the Application priority and SLA policy in the non-advanced layout. You need to redeploy the policies when there is an upgrade. If policy is in the advanced layout, the upgrade will not affect the policy group.

Troubleshooting Policy Group Validations

When you activate or deactivate a centralized policy or deploy a controller template, some controller-related policies associated in policy groups are deployed to prevent any errors in policy. You can avoid these validation errors using any one of the following workarounds:

• Dissociate application priority and SLA policy from any of the policy groups that have devices associated.

• Dissociate devices from any policy group that has application priority and SLA policy.

• Fix the issues in the application priority and SLA policy (In this case, you need to associate the device to a configuration group that has the selected VPNs).

Advanced Layout

The advanced view provides further options to configure the traffic policy along with rules, service level agreement (SLA) class, and QoS Map. Click the Advanced button on the top-right corner of the window to swtich to the advanced view.

Note	If you make changes to the application priority and SLA policies and switch to the advanced layout, the changes are retained. You cannot switch back to the default view.

Based on the values you configure in the workflow, a policy profile and the relevant policy objects are created in the back-end when the workflow is completed. Similarly, you can configure traffic filtering and rules by creating the match and action conditions of a policy. You can also configure the app route policy SLA class and create customized QoS queues.

The VPNs that you intend to use in policy group must be present in service or transport profile of configuration group.

You can identify the VPNs when you configure VPNs using configuration groups as VPNs are identified with VPN name. Where as, when you configure VPNs from CLI template, VPNs are identified by VPN IDs. Hence, you cannot read the VPNs in policy groups when they are configured in CLI.

Policy sequence generation for match and action rules

The workflow generates data policy and app-route policy sequences based on the match and action conditions configured in a traffic rule. The following rules apply:

• A data policy sequence is generated when the rule includes a data match condition, a data action, or both. If no match condition is configured but a data action is configured, the workflow also generates a data policy sequence.

• An app-route policy sequence is generated when the rule includes an app-route match condition, an app-route action, or both. The workflow also generates an app-route policy sequence for a common-only sequence if a data policy sequence is not already generated for that sequence.

• If the rule includes only the Cloud Monitoring action, the workflow drops the sequence. If the Cloud Monitoring action is configured with other actions, the workflow evaluates the sequence according to the data policy and app-route policy sequence generation rules.

• If both the match and action conditions are empty, the workflow generates an empty data policy sequence.

• For the Cloud OnRamp for SaaS excluded data prefix use case, if the rule includes an application list and either a destination data prefix list or destination IP address with the count action, the workflow also generates an app-route policy sequence.

In the action, you first specify whether to accept or drop a matching data packet, and whether to count it:

To rearrange match–action pairs in the route policy, drag them to the desired position and click Save Match and Actions.

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.14.1a, the SLA class loss, latency, and jitter values are as follows:

• Default values: Loss 5%, latency 500 ms, jitter 500 ms

• Business relevant values: Loss 2%, latency 300 ms, jitter 60 ms

• Business irrelevant values: Loss 10%, latency 600 ms, jitter 600 ms

• Bulk data values: Loss 5%, latency 500 ms, jitter 500 ms

For more information about SLA class and its components, see SLA Classes in Application-Aware Routing.

For more information about QoS, see the section Cisco Catalyst SD-WAN Forwarding and QoS Overview in Forwarding and QoS.

Monitor traffic flow

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.13.1a, Cisco Catalyst SD-WAN Manager Release 20.13.1.

You can configure collectors by clicking the Additional Settings tab, which provide options to monitor traffic flow on incoming packets in the LAN for application and flow visibility over IPv4, IPv6, or both network addresses.

Before you begin, ensure that you have configured Cflowd collector details in the Cisco SD-WAN Manager menu from Configuration > Network Hierarchy > Collectors > Cflowd.

Note

The Cflowd configuration applies to the global level and not the site level. The additional settings that you configure are applied to the Cisco SD-WAN Controllers while deploying the application priority and SLA policy. For more information about configuring Cflowd, see the section Configure Cflowd in Configure Collectors in a Network Hierarchy.

Enable traffic flow monitoring

To enable traffic flow monitoring while configuring an application priority & SLA policy, click the Additional Settings tab in the top-right corner and configure the following values: