Installing and configuring IPS/IDS, URL-F, or AMP security policies require the following workflow:

Task 1: Create a Security Policy Template for IPS/IDS, URL-F, or AMP Filtering

Task 2: Create a Feature Template for Security App Hosting

Task 3: Create a Device Template

Task 4: Attach Devices to the Device Template

Create a Security Policy Template

1. From the Cisco SD-WAN Manager menu, choose Configuration > Security.

2. Click Add Security Policy.

3. In the Add Security Policy window, select your security scenario from the list of options.

4. Click Proceed.

Create a Feature Template for Security App Hosting

The feature profile template configures two functions:

• NAT: Enables or disables Network Address Translation (NAT), which protects internal IP addresses when outside the firewall.

• Resource Profile: Allocates default or high resources to different subnets or devices.

Note	A feature profile template, while not strictly required, is recommended.

To create a feature profile template, follow these steps:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Feature Templates and then click Add Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is called Feature.

3. From the Select Devices list, choose the devices that you want to associate with the template.

4. Under Basic Information, click Security App Hosting.

5. Enter Template Name and Description.

6. Under Security Policy Parameters, customize the security policy parameters if required.

   • Enable or disable the Network Address Translation (NAT) feature, based on your use case. By default, NAT is on.

   • Click the drop-down arrow to set boundaries for the policy. The default is Default.

     Global: Enables NAT for all devices attached to the template.

     Device Specific: Enables NAT only for specified devices. If you select Device Specific, enter the name of a device key.

     Default: Enables the default NAT policy for devices attached to the template.

   • Set Resource Profile. This option sets the number of snort instances to be used on a router. The default is Low that indicates one snort instance. Medium indicates two instances and High indicates three instances.

   • Click the drop-down arrow to set boundaries for the resource profile. The default is Global.

     Global: Enables the selected resource profile for all devices attached to the template.

     Device Specific: Enables the profile only for specified devices. If you select Device Specific, enter the name of a device key.

     Default: Enables the default resource profile for devices attached to the template.

7. Set Download URL Database on Device to Yes if you want to download the URL-F database on the device. In this case, the device looks up in the local database before trying the cloud lookup.

8. Click Save.

Create a Device Template

To activate the policies you want to apply, you can create a device template that will push the policies to the devices that need them. The available options vary with the device type. For example, Cisco SD-WAN Manager devices require a more limited subset of the larger device template. You will see only valid options for that device model.

To create a security device template, follow this example for vEdge 2000 model routers:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Device Templates, and then choose Create Template > From Feature Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Device Templates is called Device.

3. From the Device Model drop-down list, choose the device model.

4. From the Device Role drop-down list, choose the device role.

5. Enter Template Name and Description.

6. Scroll down the page to the configuration submenus that let you select an existing template, create a new template, or view the existing template. For example, to create a new System template, click Create Template.

Attach Devices to the Device Template

1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2. Click Device Templates, and then choose Create Template > From Feature Template.

   Note	In Cisco vManage Release 20.7.1 and earlier releases, Device Templates is called Device.

3. In the row of the desired device template, click ... and choose Attach Devices.

4. In the Attach Devices window, select the desired devices from the Available Devices list, and click the right-pointing arrow to move them to the Selected Devices list.

5. Click Attach.