You can create a GRE or IPSec tunnel to a third-party SIG or a GRE tunnel to a Zscaler SIG by defining the tunnel properties in the Cisco Secure Internet Gateway (SIG) feature template.

Provision manual tunnels as follows:

1. Specify the details for the tunnel to the SIG by using the Cisco Security Internet Gateway (SIG) feature template.

   In the template, define the parameters for the tunnels such as the interface name, the source interface, the SIG provider, and so on.

2. Edit the Cisco VPN feature template that provides the service route for the devices to the internet. Add a service route to the SIG in the Cisco VPN feature template.

3. Add feature templates to the device templates of the devices that should route traffic to the SIG.

4. Attach the device templates to the devices.

When you attach the device template, the device sets up the defined IPSec or GRE tunnels to the SIG and redirects traffic to it.

Note

When a SIG Zscaler template is removed from a device template, the corresponding tunnel entry sometimes fails to be deleted from Zscaler's cloud services. As a result, attempting to establish a new tunnel may result in a DUPLICATE_ITEM error due to the presence of the existing entry. To resolve this issue, manually delete the stale tunnel entry from the Zscaler cloud whenever the SIG template is removed from a device template.

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.15.1a and Cisco Catalyst SD-WAN Manager Release 20.15.1

You can generate new Cisco Umbrella credentials, also called as scope credentials, and use the same credentials for both Cisco Umbrella SIG and Cisco Umbrella DNS security configurations. The Cisco Umbrella scope credentials provide flexibility with the ability to customize API keys. You can create multiple API keys with tailored access control for each API key. For more information, see Cisco Umbrella SIG User Guide.

Use the no use-v2-api command to continue using legacy credentials while configuring Cisco Umbrella DNS Security.

We recommend the use of feature templates to configure automatic tunnels.

From Cisco IOS XE Release 17.4.1 and Cisco vManage Release 20.4.1, all SIG related workflows for automatic and manual tunnels have been consolidated into the Cisco SIG template. If you are using Cisco IOS XE Release 17.4.1 and Cisco vManage Release 20.4.1, or later, use the Cisco SIG template to configure GRE or IPSec tunnels to a third-party SIG, or GRE tunnels to a Zscaler SIG.

For a software release earlier than Cisco IOS XE Release 17.4.1, Cisco vManage Release 20.4.1, see Configuring a GRE Tunnel or IPsec Tunnel from Cisco SD-WAN Manager.

Layer 7 Health Check: The option to create trackers and monitor the health of manually created tunnels is available from Cisco IOS XE Release 17.8.1a, Cisco vManage Relase 20.8.1. In earlier releases, the Layer 7 Health Check feature is only available if you use VPN Interface GRE/IPSEC templates, and not with Cisco SIG templates.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates.

   Note	In Cisco vManage Release 20.7.x and earlier releases, Feature Templates is called Feature.

3. Click Add Template.

4. Choose the device for which you are creating the template.

5. Under VPN, click Cisco Secure Internet Gateway (SIG).

6. In the Template Name field, enter a name for the feature template.

   This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 to 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

7. In the Description field, enter a description for the feature template.

8. (Optional) To create one or more trackers to monitor tunnel health, do the following in the Tracker section:

   Note	The option to create trackers and monitor tunnel health is available from Cisco IOS XE Release 17.8.1a, Cisco vManage Relase 20.8.1.

   1. Source IP Address: Enter a source IP address for the probe packets.

   2. Click New Tracker.

   3. Configure the following:

      Field	Description
      Name	Enter a name for the tracker. The name can be up to 128 alphanumeric characters.
      Threshold	Enter the wait time for the probe to return a response before declaring that the configured endpoint is down. Range: 100 to 1000 milliseconds Default: 300 milliseconds
      Interval	Enter the time interval between probes to determine the status of the configured endpoint. Range: 20 to 600 seconds Default: 60 seconds
      Multiplier	Enter the number of times to resend probes before determining that a tunnel is down. Range: 1 to 10 Default: 3
      API url of endpoint	Specify the API URL for the SIG endpoint of the tunnel. Note   Both HTTP and HTTPS API URLs are supported. SIG tunnel tracker configuration only supports HTTP even though the HTTPS option is available.

   4. Click Add.

   5. To add more trackers, repeat sub-step b to sub-step d.

9. To create tunnels, do the following in the Configuration section:

   1. SIG Provider: Click Generic.

      Cisco vManage Release 20.4.x and earlier: Click Third Party.

   2. Click Add Tunnel.

   3. Under Basic Settings, configure the following:

      Field	Description
      Tunnel Type	Based on the type of tunnel you wish to create, click ipsec or gre.
      Interface Name (0..255)	Enter the interface name. Note   If you have attached the Cisco VPN Interface IPSec feature template or the Cisco VPN Interface GRE feature template to the same device, ensure that the interface number you enter is different from what you have entered in the IPSec or GRE templates.
      Description	(Optional) Enter a description for the interface.
      Source Type	Click INTERFACE. Cisco IOS XE Catalyst SD-WAN devices, INTERFACE is the only supported Source Type.
      Tracker	(Optional) Choose a tracker to monitor tunnel health. Note   From Cisco IOS XE Release 17.8.1a and Cisco vManage Relase 20.8.1, you can create trackers to monitor tunnel health.
      Track this interface for SIG	Enable or disable tracker for the tunnel. By default, Cisco SD-WAN Manager enables a tracker for automatic tunnels. Default: On.
      Tunnel Source Interface	Enter the name of the source interface of the tunnel. This interface should be the egress interface and is typically the internet-facing interface. For releases before Cisco IOS XE Catalyst SD-WAN Release 17.13.1a and Cisco Catalyst SD-WAN Manager Release 20.13.1, and you have a Cellular or Dialer interface as the tunnel's source interface, the following workaround must be implemented. If you use a cellular interface as a tunnel source interface, you must modify your existing tunnel source interface configuration with the following configuration: interface <interface name> no tunnel route-via <Interface> mandatory Use the CLI add-on feature template to modify the tunnel configuration on the device. For more information on how to use a CLI add-on feature template, see , Create a CLI Add-On Feature Template. After you have modified the tunnel configuration, select the device template for which you want to apply the CLI add-on feature template, and push the configuration to the devices. For more information about attaching a device template to one or more devices, see Attach Template to Devices Note   A SIG tunnel will be created for cellular interfaces only if a global VRF has only one transport interface. A SIG tunnel is not be created if a global VRF has multiple transport interfaces.
      Tunnel Destination IP Address/FQDN	Enter the IP address of the SIG provider endpoint.
      Preshared Key	This field is displayed only if you choose ipsec as the Tunnel Type. Enter the password to use with the preshared key.

   4. (Optional) Under Advanced Options, configure the following:

      Table 13. (Tunnel Type: gre) General

      Field	Description
      Shutdown	Click No to enable the interface; click Yes to disable. Default: No.
      IP MTU	Specify the maximum MTU size of packets on the interface. Range: 576 to 2000 bytes Default: 1400 bytes
      TCP MSS	Specify the maximum segment size (MSS) of TPC SYN packets. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented. Range: 500 to 1460 bytes Default: None

      Table 14. (Tunnel Type: ipsec) General

      Field	Description
      Shutdown	Click No to enable the interface; click Yes to disable. Default: No.
      IP MTU	Specify the maximum MTU size of packets on the interface. Range: 576 to 2000 bytes Default: 1400 bytes
      TCP MSS	Specify the maximum segment size (MSS) of TPC SYN packets. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented. Range: 500 to 1460 bytes Default: None
      DPD Interval	Specify the interval for IKE to send Hello packets on the connection. Range: 0 to 65535 seconds Default: 10
      DPD Retries	Specify how many unacknowledged packets to send before declaring an IKE peer to be dead and then removing the tunnel to the peer. Range: 0 to 255 Default:3

      Table 15. (Tunnel Type: ipsec) IKE

      Field	Description
      IKE Rekey Interval	Specify the interval for refreshing IKE keys Range: 300 to 1209600 seconds (1 hour to 14 days) Default: 14400 seconds
      IKE Cipher Suite	Specify the type of authentication and encryption to use during IKE key exchange. Choose one of the following: AES 256 CBC SHA1 AES 256 CBC SHA2 AES 128 CBC SHA1 AES 128 CBC SHA2 Default: AES 256 CBC SHA1
      IKE Diffie-Hellman Group	Specify the Diffie-Hellman group to use in IKE key exchange, whether IKEv1 or IKEv2. Choose one of the following: 2 1024-bit modulus 14 2048-bit modulus 15 3072-bit modulus 16 4096-bit modulus Default: 16 4096-bit modulus
      IKE ID for Local Endpoint	If the remote IKE peer requires a local end point identifier, specify the same. Range: 1 to 64 characters Default: Tunnel's source IP address
      IKE ID for Remote Endpoint	If the remote IKE peer requires a remote end point identifier, specify the same. Range: 1 to 64 characters Default: Tunnel's destination IP address

      Table 16. (Tunnel Type: ipsec) IPSEC

      Field	Description
      IPsec Rekey Interval	Specify the interval for refreshing IPSec keys. Range: 300 to 1209600 seconds (1 hour to 14 days) Default: 3600 seconds
      IPsec Replay Window	Specify the replay window size for the IPsec tunnel. Options: 64, 128, 256, 512, 1024, 2048, 4096. Default: 512
      IPsec Cipher Suite	Specify the authentication and encryption to use on the IPsec tunnel. Choose one of the following: AES 256 CBC SHA1 AES 256 CBC SHA 384 AES 256 CBC SHA 256 AES 256 CBC SHA 512 AES 256 GCM NULL SHA 384 NULL SHA 256 NULL SHA 512 Default: NULL SHA 512
      Perfect Forward Secrecy	Specify the PFS settings to use on the IPsec tunnel. Choose one of the following Diffie-Hellman prime modulus groups: Group-2 1024-bit modulus Group-14 2048-bit modulus Group-15 3072-bit modulus Group-16 4096-bit modulus None: disable PFS. Default: Group-16 4096-bit modulus

   5. Click Add.

   6. To create more tunnels, repeat sub-step b to sub-step e.

10. To designate active and back-up tunnels and distribute traffic among tunnels, configure the following in the High Availability section:

    Table 17. High Availability

    Field	Description
    Active	Choose a tunnel that connects to the primary data center.
    Active Weight	Enter a weight (weight range 1 to 255) for load balancing. Load balancing helps in distributing traffic over multiple tunnels and this helps increase the network bandwidth. If you enter the same weights, you can achieve ECMP load balancing across the tunnels. However, if you enter a higher weight for a tunnel, that tunnel has higher priority for traffic flow. For example, if you set up two active tunnels, where the first tunnel is configured with a weight of 10, and the second tunnel with weight configured as 20, then the traffic is load-balanced between the tunnels in a 10:20 ratio.
    Backup	To designate a back-up tunnel, choose a tunnel that connects to the secondary data center. To omit designating a back-up tunnel, choose None.
    Backup Weight	Enter a weight (weight range 1 to 255) for load balancing. Load balancing helps in distributing traffic over multiple tunnels and this helps increase the network bandwidth. If you enter the same weights, you can achieve ECMP load balancing across the tunnels. However, if you enter a higher weight for a tunnel, that tunnel has higher priority for traffic flow. For example, if you set up two back-up tunnels, where the first tunnel is configured with a weight of 10, and the second tunnel with weight configured as 20, then the traffic is load-balanced between the tunnels in a 10:20 ratio.

11. Click Save.

You can redirect traffic to a SIG in two ways:

• Using Data Policy. For more information, see Action Parameters in the Policies Configuration Guide.

• Using the Service route to SIG. For more information, see Modify Service VPN Template

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Device Templates.

   Note	In Cisco vManage Release 20.7.x and earlier releases, Device Templates is called Device .

3. Click Create Template and click From Feature Template.

4. From the Device Model drop-down list, choose the device model for which you are creating the template.

   Cisco SD-WAN Manager displays all the feature templates for that device type. The required feature templates are indicated with an asterisk (*), and the remaining templates are optional. The factory-default template for each feature is chosen by default.

5. From the Device Role drop-down list, choose SDWAN Edge.

6. In the Template Name field, enter a name for the device template.

   This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (-), and underscores (_). It cannot contain spaces or any other characters.

7. In the Description field, enter a description for the device template.

   This field is mandatory, and it can contain any characters and spaces.

8. Click Transport & Management VPN.

9. In the Transport & Management VPN section, under Additional Cisco VPN 0 Templates, click Cisco Secure Internet Gateway.

10. From the Cisco Secure Internet Gateway drop-down list, choose the Cisco SIG feature template that you created earlier.

11. Click Additional Templates.

12. In the Additional Templates section,

    1. Automatic tunneling:

       (Cisco vManage Release 20.8.x and earlier) From the Cisco SIG Credentials drop-down list, choose the relevant Cisco SIG Credentials feature template.

       (From Cisco vManage Release 20.9.1) Cisco SD-WAN Manager automatically chooses the applicable global Cisco SIG Credentials feature template based on the Cisco SIG feature template configuration.

       Note

       If there are any changes to the SIG credentials, for these changes to take effect, you must first remove the SIG feature template from the device template and push the device template. Thereafter, re-attach the SIG feature template and then push the template to the device. For information on pushing the device template, see Attach the SIG Template to Devices.

    2. Manual tunneling: No need to attach a Cisco SIG Credentials template.

13. Click Create.

    The new configuration template is displayed in the Device Template table. The Feature Templates column shows the number of feature templates that are included in the device template, and the Type column shows Feature to indicate that the device template was created from a collection of feature templates.

Minimum supported releases: Cisco IOS XE Release 17.8.1a and Cisco vManage Release 20.8.1.

Before you create automatic SIG tunnels, configure Cisco Umbrella or Zscaler credentials to enable Cisco SD-WAN Manager to create the tunnels to Cisco Umbrella or Zscaler endpoints. If you do not configure the SIG credentials on the Administration > Settings page before you configure the Secure Internet Gateway feature in the Security feature profile, Cisco SD-WAN Manager prompts you to enter the credentials when you configure the the Secure Internet Gateway feature. After you have configured the SIG credentials, you can modify the credentials on the Administration > Settings page.

1. From the Cisco SD-WAN Manager menu, choose Administration > Settings.

2. For the Secure Internet Gateyway (SIG) Credentials setting, click Edit.

3. Choose Umbrella or Zscaler.

4. For Umbrella, do one of the following:

   • Enable Cisco SD-WAN Manager to fetch credentials from the Cisco Umbrella portal:

     1. Ensure that you have added your Cisco Smart Account credentials here: Administration > Settings > Smart Account Credentials.

        Cisco SD-WAN Manager uses the Cisco Smart Account credentials to connect to the Cisco Umbrella portal.

     2. Click Get Keys.

        Cisco SD-WAN Manager obtains the following details:

        • Organization ID

        • Registration Key

        • Secret

   • Enter Cisco Umbrella credentials:

     Table 19. Cisco Umbrella Credentials

     Field	Description
     Organization ID	Enter the Cisco Umbrella organization ID (Org ID) for your organization. For more information, see Find Your Organization ID in the Cisco Umbrella SIG User Guide.
     Registration Key	Enter the Umbrella Management API Key. For more information, see Management and Provisioning > Getting Started > Overview in the Cloud Security API documentation on the Cisco DevNet portal.
     Secret	Enter the Umbrella Management API Secret. For more information, see Management and Provisioning > Getting Started > Overview in the Cloud Security API documentation on the Cisco DevNet portal.

5. For Zscaler, configure the following:

   Table 20. Zscaler Credentials

   Field	Description
   Organization	Name of the organization in Zscaler cloud. For more information, see ZIA Help > Getting Started > Admin Portal > About the Company Profile.
   Partner base URI	This is the base URI that Cisco SD-WAN Manager uses in REST API calls. To find this information on the Zscaler portal, see ZIA Help > ZIA API > API Developer & Reference Guide > Getting Started.
   Username	Username of the SD-WAN partner account.
   Password	Password of the SD-WAN partner account.
   Partner API key	Partner API key. To find the key in Zscaler, see ZIA Help > Partner Integrations > Managing SD-WAN Partner Keys.

6. Click Save.

Before you begin: Create a configuration group if you haven't already done so. For more information on creating a configuration group, see Run the Create Configuration Group Workflow.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates > Configuration Groups.

2. For the desired configuration group, click … adjacent to the configuration group name and choose Edit.

3. In the Feature Profiles - Unconfigured area, find the Security Profile and click Start Configuration.

4. In the Add Profile slide-in pane, do one of the following:

   • Create a new Security feature profile:

     1. Click Create new.

     2. Enter a unique Name and an optional Description for the profile.

     3. Click Save.

   • Choose an existing Security feature profile:

     1. Click Choose existing.

     2. Select an existing Security feature profile. Click the radio button adjacent to the profile name.

     3. Click Save.

   The Security feature profile is listed under Associated Profiles.

Before you begin: Create or edit a configuration group and associate the Security feature profile with it.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates > Configuration Groups.

2. For the desired configuration group, click … adjacent to the configuration group name and choose Edit.

3. Under Associated Profiles, find the Security feature profile and expand the profile.

4. Click Add Feature.

5. In the Add Feature slide-in pane, from the drop-down list, choose the Secure Internet Gateway feature.

6. Configure the following details:

   Table 21. Name, Description, and SIG Provider

   Field	Description
   Feature Name	Enter a name for the feature. The name can be up to 128 characters and can contain only alphanumeric characters.
   Description	(Optional) Enter a description of the feature. The description can be up to 2048 characters and can contain only alphanumeric characters.
   SIG Provider	Click one of the following: Umbrella: Configure automatic tunnel to Cisco Umbrella SIG. If you've not configured Umbrella credentials, Cisco SD-WAN Manager prompts you to configure the credentials: Click here to add Umbrella credentials. Click, and in the Add Umbrella Credentials dialog box, enter the details mentioned in Table 2 and click Add. Zscaler: Configure automatic tunnel to Zscaler SIG. If you've not configured Zscaler credentials, Cisco SD-WAN Manager prompts you to configure the credentials: Click here to add Zscaler credentials. Click, and in the Add Zscaler Credentials dialog box, enter the details mentioned in Table 3 click Add. Generic: Configure manual tunnel to a SIG endpoint.

   Table 22. Cisco Umbrella Credentials

   Field	Description
   Organization ID	Enter the Cisco Umbrella organization ID (Org ID) for your organization. For more information, see Find Your Organization ID in the Cisco Umbrella SIG User Guide.
   Registration Key	Enter the Umbrella Management API Key. For more information, see Management and Provisioning > Getting Started > Overview in the Cloud Security API documentation on the Cisco DevNet portal.
   Secret	Enter the Umbrella Management API Secret. For more information, see Management and Provisioning > Getting Started > Overview in the Cloud Security API documentation on the Cisco DevNet portal.

   Table 23. Zscaler Credentials

   Field	Description
   Organization	Name of the organization in Zscaler cloud. For more information, see ZIA Help > Getting Started > Admin Portal > About the Company Profile.
   Partner base URI	This is the base URI that Cisco SD-WAN Manager uses in REST API calls. To find this information on the Zscaler portal, see ZIA Help > ZIA API > API Developer & Reference Guide > Getting Started.
   Username	Username of the SD-WAN partner account.
   Password	Password of the SD-WAN partner account.
   Partner API key	Partner API key. To find the key in Zscaler, see ZIA Help > Partner Integrations > Managing SD-WAN Partner Keys.

7. To create tunnels, click Configuration and do the following:

   Parameter Scope	Scope Description
   Device Specific (indicated by a host icon)	Use a device-specific value for the parameter. For device-specific parameters, you cannot enter a value in the feature template. Enter the value when you add a device to the configuration group. To change the default key, type a new string and move the cursor out of the Enter Key box.
   Global (indicated by a globe icon)	Enter a value for the parameter, and apply that value to all devices.

   1. Click Add Tunnel.

   2. In the Add Tunnel dialog box, under Basic Settings configure the following:

      Table 24. Basic Settings

      Field	Description
      Tunnel Type	Umbrella: (Read only) ipsec Zscaler: Click ipsec or gre. Generic: Click ipsec or gre.
      Interface Name (1..255)	Enter the interface name.
      Description	Enter a description for the interface.
      Tracker	By default, a tracker is attached to monitor the health of tunnels. Alternatively, you can create a customized tracker as described in step 7 and choose the tracker.
      Tunnel Source Interface	Enter the name of the source interface of the tunnel. This interface should be the egress interface and is typically the internet-facing interface. For releases before Cisco IOS XE Catalyst SD-WAN Release 17.13.1a and Cisco Catalyst SD-WAN Manager Release 20.13.1, and you have a Cellular or Dialer interface as the tunnel's source interface, the following workaround must be implemented. If you use a cellular interface as a tunnel source interface, you must modify your existing tunnel source interface configuration with the following configuration: interface <interface name> no tunnel route-via <Interface> mandatory Use the CLI add-on feature template to modify the tunnel configuration on the device. For more information on how to use a CLI add-on feature template, see , Create a CLI Add-On Feature Template. After you have modified the tunnel configuration, select the device template for which you want to apply the CLI add-on feature template, and push the configuration to the devices. For more information about attaching a device template to one or more devices, see Attach Template to Devices. Note   A SIG tunnel will be created for cellular interfaces only if a global VRF has only one transport interface. A SIG tunnel is not be created if a global VRF has multiple transport interfaces.
      Source Public IP	(Automatic GRE tunnels to Zscaler only) Public IP address of the tunnel source interface that is required to create the GRE tunnel to Zscaler. Default: Auto. We recommend that you use the default configuration. With the default configuration, the Cisco IOS XE Catalyst SD-WAN device finds the public IP address assigned to the tunnel source interface using a DNS query. If the DNS query fails, the device notifies Cisco SD-WAN Manager of the failure. Enter the public IP address only if the DNS query fails.
      Data-Center	For a primary data center, click Primary, or for a secondary data center, click Secondary. Tunnels to the primary data center serve as active tunnels, and tunnels to the secondary data center serve as back-up tunnels.
      Tunnel Destination IP Address/FQDN	(Manual tunnels only) Enter the IP address of the SIG provider endpoint.
      Preshared Key	(Manual tunnels only) This field is displayed only if you choose ipsec as the Tunnel Type. Enter the password to use with the preshared key.

   3. (Optional) Under Advanced Options, configure the following:

      Table 25. (Tunnel Type: gre) General

      Field	Description
      Shutdown	Click No to enable the interface; click Yes to disable. Default: No.
      IP MTU	Specify the maximum MTU size of packets on the interface. Range: 576 to 2000 bytes Default: 1400 bytes
      TCP MSS	Specify the maximum segment size (MSS) of TPC SYN packets. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented. Range: 500 to 1460 bytes Default: None

      Table 26. (Tunnel Type: ipsec) General

      Field	Description
      Shutdown	Click No to enable the interface; click Yes to disable. Default: No.
      Track this interface for SIG	Enable or disable tracker for the tunnel. By default, Cisco SD-WAN Manager enables a tracker for automatic tunnels. Default: On.
      TCP MSS	Specify the maximum segment size (MSS) of TPC SYN packets. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented. Range: 500 to 1460 bytes Default: None
      IP MTU	Specify the maximum MTU size of packets on the interface. Range: 576 to 2000 bytes Default: 1400 bytes
      DPD Interval	Specify the interval for IKE to send Hello packets on the connection. Range: 10 to 3600 seconds Default: 10
      DPD Retries	Specify the number of seconds between DPD retry messages if the DPD retry message is missed by the peer. Once 1 DPD message is missed by the peer, the router moves to a more aggressive state and sends the DPD retry message at the faster retry interval, which is the number of seconds between DPD retries if the DPD message is missed by the peer. The default DPD retry message is sent every 2 seconds. Five aggressive DPD retry messages can be missed before the tunnel is marked as down. Range: 2 to 60 seconds Default: 3

      Table 27. (Tunnel Type: ipsec) IKE

      Field Name	Description
      IKE Rekey Interval	Specify the interval for refreshing IKE keys. Range: 300 to 1209600 seconds (1 hour to 14 days) Default: 14400 seconds
      IKE Cipher Suite	Specify the type of authentication and encryption to use during IKE key exchange. Choose one of the following: AES 256 CBC SHA1 AES 256 CBC SHA2 AES 128 CBC SHA1 AES 128 CBC SHA2 Default: AES 256 CBC SHA1
      IKE Diffie-Hellman Group	Specify the Diffie-Hellman group to use in IKE key exchange, whether IKEv1 or IKEv2. 2 1024-bit modulus 14 2048-bit modulus 15 3072-bit modulus 16 4096-bit modulus Default: 14 2048-bit modulus

      Table 28. (Tunnel Type: ipsec) IPSEC

      Field	Description
      IPsec Rekey Interval	Specify the interval for refreshing IPSec keys. Range: 300 to 1209600 seconds (1 hour to 14 days) Default: 3600 seconds
      IPsec Replay Window	Specify the replay window size for the IPsec tunnel. Options: 64, 128, 256, 512, 1024, 2048, 4096. Default: 512
      IPsec Cipher Suite	Specify the authentication and encryption to use on the IPsec tunnel. Options: AES 256 CBC SHA1 AES 256 CBC SHA 384 AES 256 CBC SHA 256 AES 256 CBC SHA 512 AES 256 GCM NULL SHA1 NULL SHA 384 NULL SHA 256 NULL SHA 512 Default: AES 256 GCM
      Perfect Forward Secrecy	Specify the PFS settings to use on the IPsec tunnel. Choose one of the following Diffie-Hellman prime modulus groups: Group-2 1024-bit modulus Group-14 2048-bit modulus Group-15 3072-bit modulus Group-16 4096-bit modulus None: disable PFS. Default: None

   4. Click Add.

8. To create one or more trackers to monitor tunnel health, click Tracker and do the following:

   1. Source IP Address: Enter a source IP address for the probe packets.

   2. Click Add Tracker.

   3. In the Add Tracker dialog box, configure the following:

      Table 29. Tracker Parameters

      Field	Description
      Name	Enter a name for the tracker. The name can be up to 128 alphanumeric characters.
      API url of endpoint	Specify the API URL for the SIG endpoint of the tunnel.
      Threshold	Enter the wait time for the probe to return a response before declaring that the configured endpoint is down. Range: 100 to 1000 milliseconds Default: 300 milliseconds.
      Probe Interval	Enter the time interval between probes to determine the status of the configured endpoint. Range: 20 to 600 seconds Default: 60 seconds
      Multiplier	Enter the number of times to resend probes before determining that a tunnel is down. Range: 1 to 10 Default: 3

   4. Click Add.

   5. To add more trackers, repeat sub-step b to sub-step d.

9. To designate active and back-up tunnels and distribute traffic among tunnels, click High Availability and do the following:

   1. Click Add Interface Pair.

   2. In the Add Interface Pair dialog box, configure the following:

      Table 30. High Availability Parameters

      Field	Description
      Active	Choose a tunnel that connects to the primary data center.
      Active Weight	Enter a weight (weight range 1 to 255) for load balancing. Load balancing helps in distributing traffic over multiple tunnels and this helps increase the network bandwidth. If you enter the same weights, you can achieve ECMP load balancing across the tunnels. However, if you enter a higher weight for a tunnel, that tunnel has higher priority for traffic flow. For example, if you set up two active tunnels, where the first tunnel is configured with a weight of 10, and the second tunnel with weight configured as 20, then the traffic is load-balanced between the tunnels in a 10:20 ratio.
      Backup	To designate a back-up tunnel, choose a tunnel that connects to the secondary data center. To omit designating a back-up tunnel, choose None.
      Backup Weight	Enter a weight (weight range 1 to 255) for load balancing. Load balancing helps in distributing traffic over multiple tunnels and this helps increase the network bandwidth. If you enter the same weights, you can achieve ECMP load balancing across the tunnels. However, if you enter a higher weight for a tunnel, that tunnel has higher priority for traffic flow. For example, if you set up two back-up tunnels, where the first tunnel is configured with a weight of 10, and the second tunnel with weight configured as 20, then the traffic is load-balanced between the tunnels in a 10:20 ratio.

   3. Click Add.

   4. To add more active and back-up tunnel pairs, repeat sub-step a to sub-step c.

10. (Optional) To configure advanced settings for Cisco Umbrella or Zscaler, click Advanced Settings and configure the following:

    Table 31. Umbrella

    Field	Description
    Umbrella Primary Data-Center	Cisco SD-WAN Manager automatically selects the primary data center closest to the WAN edge device. If you wish to route traffic to a specific Cisco Umbrella data center, choose the data center from the drop-down list.
    Umbrella Secondary Data-Center	Cisco SD-WAN Manager automatically selects the secondary data center closest to the WAN edge device. If you wish to route traffic to a specific Cisco Umbrella data center, choose the data center from the drop-down list.

    Table 32. Zscaler

    Field	Description
    Primary Datacenter	Automatic IPSec tunnels: Cisco SD-WAN Manager automatically selects the primary data center closest to the WAN edge device. If you wish to route traffic to a specific Zscaler data center, choose the data center from the drop-down list. Automatic GRE tunnels: Cisco SD-WAN Manager automatically selects the primary data center closest to the WAN edge device. If you wish to route traffic to specific Zscaler data center, ensure that you choose a Zscaler data center that is recommended by Zscaler based on geographical proximity to the device. Obtain the recommend list of Zscaler data centers through a GET API request for /vips/recommendedList. In the API request, specify the public IP of your device as the value of the sourceIp query parameter. For more information on /vips/recommendedList, see ZIA API Developer & Reference Guide. If you choose a data center that is not in the recommended list, the Cisco IOS XE Catalyst SD-WAN device reverts to the automatically selected data center.
    Secondary Datacenter	Automatic IPSec tunnels: Cisco SD-WAN Manager automatically selects the secondary data center closest to the WAN edge device. If you wish to route traffic to a specific Zscaler data center, choose the data center from the drop-down list. Automatic GRE tunnels: Cisco SD-WAN Manager automatically selects the secondary data center closest to the WAN edge device. If you wish to route traffic to specific Zscaler data center, ensure that you choose a Zscaler data center that is recommended by Zscaler based on geographical proximity to the device. Obtain the recommend list of Zscaler data centers through a GET API request for /vips/recommendedList. In the API request, specify the public IP of your device as the value of the sourceIp query parameter. For more information on /vips/recommendedList, see ZIA API Developer & Reference Guide. If you choose a data center that is not in the recommended list, the Cisco IOS XE Catalyst SD-WAN device reverts to the automatically selected data center.
    Zscaler Location	(Optional) Enter the name of a location that is configured on the ZIA Admin Portal. If you do not enter a location name, the Zscaler service detects the location based on the received traffic. For more information about locations, see ZIA Help > Traffic Forwarding > Location Management > About Locations.
    Authentication Required	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Off
    XFF Forwarding	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Off
    Enable Firewall	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Off
    Enable IPS Control	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Off
    Enable Surrogate IP	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Off
    Display Time Unit	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Minute
    Idle Time to Disassociation	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: 0
    Enforce Surrogate IP for known browsers	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Off
    Refresh Time Unit	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: Minute
    Refresh Time	See ZIA Help > Traffic Forwarding > Location Management > Configuring Locations. Default: 0

11. Click Save.

Configure a SIG service route for a service VPN to direct the VPN traffic to SIG.

Note	Alternatively, you can also redirect traffic to SIG using Data Policy. For more information, see Action Parameters in the Policies Configuration Guide.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates > Configuration Groups.

2. For the desired configuration group, click … adjacent to the configuration group name and choose Edit.

3. Expand the Service Profile, and for the service VPN whose traffic you want to redirect traffic to SIG, click ... and click Edit Parcel.

4. Remove any existing static IPv4 routes to the internet:

   1. Click Route.

   2. Under IPv4 Static Route, find any routes to the internet and click the delete icon to remove it.

5. Add SIG service route:

   1. Click Service Route.

   2. Click Add Service Route.

   3. In the Add Service Route dialog box, configure the following:

      Table 33. Service Route Parameters

      Field	Description
      Network Address	Enter the public IPv4 address.
      Subnet Mask	Enter the subnet for the IPv4 address.
      Service	Choose SIG from the drop-down list.
      VPN	Enter the VPN over which to direct the traffic. Default: VPN 0

   4. Click Add.

6. Click Save.

Next steps: Add Devices to Configuration Group and Deploy Devices.

After upgrading from Cisco vManage Release 20.3.1 to Cisco vManage Release 20.3.2, you may see failures when connecting from your devices to SIG services or when connecting standard IPSec tunnels to cloud security services.

show sdwan running-config interface tunnel Number

Device#sh sdwan running-config interface | begin Tunnel100001
interface Tunnel100001
 ip unnumbered GigabitEthernet1
 ip mtu 1400
 tunnel source GigabitEthernet1
 tunnel mode ipsec ipv4
 tunnel destination dynamic
 tunnel route-via GigabitEthernet1 mandatory
 tunnel vrf multiplexing
 tunnel protection ipsec profile if-ipsec2-ipsec-profile
exit

Note: This problem and solution applies for releases Cisco IOS XE Catalyst SD-WAN Release 17.13.1a or before.

interface Tunnel16000001
 no shutdown
 ip unnumbered Cellular0/1/0
 ip mtu 1400
 tunnel source Cellular0/1/0
 tunnel destination dynamic
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile if-ipsec1-ipsec-profile
 tunnel vrf multiplexing
 tunnel route-via Cellular0/1/0 preferred

Minimum Supported Releases: Cisco IOS XE Catalyst SD-WAN Release 17.15.1a and Cisco Catalyst SD-WAN Manager Release 20.15.1

Information Sharing

Cisco SD-WAN Manager shares VPN context information with Secure Service Edge (SSE). It provides SSE with VPN details, including VPN names and IDs. ISE shares SGT information with both Cisco SD-WAN Manager and SSE. SSE uses the VPN and SGT information to enforce specific security policies on traffic from Cisco Catalyst SD-WAN to internet and SaaS applications. These policies match source objects based on SGT or VPN for internet- and SaaS-bound traffic.

In the control plane, Cisco SD-WAN Manager shares VPN information with SSE but does not share SGT information. In the data plane, both VPN and SGT information are included in the traffic directed towards Cisco SSE.

Integration Requirements

Integrating ISE with the Cisco SD-WAN Manager is optional, but it is mandatory to configure the integration of ISE with SSE.

• SSE Integration

  Ensure SSE is integrated with both Cisco SD-WAN Manager and ISE. For more information, see Integrate Your Devices with Secure Service Edge.

• API Credentials for SSE

  Ensure that the API credentials for SSE has the necessary permissions, specifically write access, to manage identity-related information and enable context sharing.

• Configure DNS on VPN0 Interface

  Ensure DNS is configured on the VPN0 interface of the device for seamless connectivity between Cisco SD-WAN Manager and Cisco Secure Access.

• Enable NAT on WAN and LAN Interfaces

  Enable NAT on the WAN and LAN interfaces of the device to ensure proper address translation for both outbound and inbound traffic. This is crucial for maintaining seamless connectivity and proper routing of traffic through the network.

• CLI Commands for SGT Sharing with SSE

  To share SGT with SSE, use the following CLI commands as part of the CLI add-on template to fetch the SGT value:

  policy
   app-visibility
   flow-visibility
   ip visibility features
   ulogging enable
  

  For more information about using CLI templates, see CLI Add-On Feature Templates and CLI Templates.

You cannot use CLI profiles to configure this feature.

To check whether context sharing is active on a Cisco IOS XE Catalyst SD-WAN device, use the show sse all command.

In the following command, context sharing is enabled, and it is shown in bold.

Device# show sse all

***************************************
SSE Instance Cisco-Secure-Access
***************************************
Tunnel name : Tunnel16000001
Site id: 2432287619
Tunnel id: 634930903
SSE tunnel name: C8K-e28146f8-e524-46ff-a799-a95fc1a086da
HA role: Active
Local state: Up
Tracker state: Up
Destination Data Center: 52.42.220.205
Tunnel type: IPSEC
Provider name: Cisco Secure Access
Context sharing: CONTEXT_SHARING_SRC_VPN | CONTEXT_SHARING_SGT

Use the security operations dashboard to monitor the status and performance of SSE tunnels.

1. From the Cisco SD-WAN Manager menu, choose Monitor > Security.

   The SIG/SSE Tunnel Status pane shows the following information using a donut chart:

   • Total number of SIG/SSE tunnels that are configured.

   • The number of SIG/SSE tunnels that are up and down.

   • The number of SIG/SSE tunnels that are in a degraded state.

     Degraded state indicates that the SIG tunnel is up but the Layer 7 health of the tunnel as detected by the tracker does not meet the configured SLA parameters. Traffic is not routed through the tunnel.

2. (Optional) Click a section of the donut chart to view detailed information about tunnels having a particular status.

   Cisco SD-WAN Manager displays detailed information about the tunnels in the SIG/SSE Tunnels dashboard.

3. (Optional) Click All SIG/SSE Tunnels to view the SIG/SSE Tunnels dashboard.

View SSE tunnels to obtain granular information about each tunnel.

1. From the Cisco SD-WAN Manager menu, choose Monitor > Tunnels.

2. Click SIG/SSE Tunnels.

   Cisco SD-WAN Manager displays a table that provides the following details about each automatic tunnel created to a Cisco Umbrella, Zscaler SIG or Cisco Secure Access: For more information, see the section SIG/SSE Tunnels Dashboard in Monitor SIG/SSE Tunnels.

View context-sharing data by enabling context-sharing filters. These filters can help identify whether the context-sharing data (VPN and SGT) is enabled or disabled.

To enable context-sharing filters:

1. From the Cisco SD-WAN Manager menu, choose Monitor > Tunnels > SIG/SSE Tunnels.

2. Click on the gear icon to display the table settings slide-in pane.

3. Click to enable the context sharing filters to display detailed information about VPN and SGT context sharing in the table.