Provider Role

The provider role entitles system-wide administrative privileges. A user with the provider role has the default username admin. The provider user can access Cisco SD-WAN Manager using the domain name of the service provider or by using the Cisco SD-WAN Manager IP address. When using a domain name, the domain name has the format https://multitenancy.com.

The admin user is part of the user group netadmin​. Users in this group are permitted to perform all operations on the controllers and the Cisco Catalyst SD-WAN devices of the tenants. You can add additional users to the netadmin group.

You cannot modify the privileges of the netadmin group. On Cisco SD-WAN Manager, you can view the privileges of the user group from the Administration > Manage Users > User Groups page.

Note

When you create a new provider user in Cisco SD-WAN Manager, including a netadmin user, by default, the user is not allowed SSH access to the Cisco SD-WAN Manager VM. To enable SSH access, configure SSH authentication using a AAA template and push the template to Cisco SD-WAN Manager. For more information on enabling SSH authentication, see SSH Authentication using Cisco SD-WAN Manager on Cisco IOS XE Catalyst SD-WAN Devices.

For more information about configuring users and user groups, see Configure User Access and Authentication.

Cisco SD-WAN Manager offers two views to a provider:

• Provider View

  When a provider user logs in to multi-tenant Cisco SD-WAN Manager as admin or another netadmin user, Cisco SD-WAN Manager presents the provider view and displays the provider dashboard.

  You can perform the following functions from the provider view:

  • Provision and manage Cisco SD-WAN Manager, Cisco Catalyst SD-WAN Validators and Cisco Catalyst SD-WAN Controllers.

  • Add, modify, or delete tenants.

  • Monitor the overlay network.

• Provider-as-Tenant View

  When a provider user selects a specific tenant from the Select Tenant drop-down list at the top of the provider dashboard, Cisco SD-WAN Manager presents the provider-as-tenant view and displays the tenant dashboard for the selected tenant. The provider user has the same view of Cisco SD-WAN Manager as a tenant user would when logged in as tenantadmin. From this view, the provider can manage the tenant deployment on behalf of the tenant.

  In the provider dashboard, a table of tenants presents a status summary for each tenant. A provider user can also launch the provider-as-tenant view by clicking on a tenant name in this table.

Tenant Role

The tenant role entitles tenant administrative privileges. A user with the tenant role has the default username tenantadmin. The default password is Cisco#123@Viptela. We recommend that you change the default password on first login. For information on changing the default password, see Hardware and Software Installation.

The tenantadmin user is part of the user group tenantadmin. Users in this group are permitted to perform all operations on the WAN edge devices of the tenants. You can add additional users to the tenantadmin group.

You cannot modify the privileges of the tenantadmin group. On Cisco SD-WAN Manager, you can view the privileges of the user group from the Administration > Manage Users > User Groups page.

For more information about configuring users and user groups, see Configure User Access and Authentication.

A tenant user can log in to Cisco SD-WAN Manager using a dedicated URL and the default username tenantadmin. For example, the dedicated URL of a tenant could be https://Customer1.multitenancy.com for a provider using the domain name https://multitenancy.com. When the user logs in, Cisco SD-WAN Manager presents the tenant view and displays the tenant dashboard.

A tenant user with administrative privileges can perform the following functions:

• Provision and manage tenant routers

• Monitor overlay network of the tenant

• Create custom policies on the assigned Cisco Catalyst SD-WAN Controllers

• Upgrade the software on the tenant routers.

Prerequisites

• Download and install software versions as recommended in the following table:

  Table 5. Software Prerequisites for Cisco Catalyst SD-WAN Multitenancy

  Device	Software Version
  Cisco SD-WAN Manager	Cisco vManage Release 20.4.1
  Cisco Catalyst SD-WAN Validator	Cisco SD-WAN Release 20.4.1
  Cisco Catalyst SD-WAN Controller	Cisco SD-WAN Release 20.4.1
  Cisco IOS XE Catalyst SD-WAN device	Cisco IOS XE Catalyst SD-WAN Release 17.4.1a

  A configuration in which one or more controllers, or WAN edge devices, are running software versions earlier than those mentioned in the table above is not supported.

• Do not migrate an existing single-tenant Cisco SD-WAN Manager instance into multitenant mode, even if you invalidate or delete all devices from the existing Cisco SD-WAN Manager instance. Instead, download and install a new Cisco SD-WAN Manager software image.

  Note	After you enable Cisco SD-WAN Manager for multitenancy, you cannot migrate it back to single tenant mode.

• Log in to Cisco SD-WAN Manager as the provider admin user.

1. Create three Cisco SD-WAN Manager instances and associated configuration templates. See Deploy Cisco SD-WAN Manager.

   1. While configuring Cisco SD-WAN Manager instances, configure the service provider organization name (sp-organization-name) and the organization name (organization-name).

      Example:

      sp-organization-name multitenancy
      organization-name multitenancy

2. Configure one of the Cisco SD-WAN Manager instances to support multitenancy. See Enable Multitenancy on Cisco SD-WAN Manager

3. Create a Cisco SD-WAN Manager cluster consisting of three Cisco SD-WAN Manager instances. See Cluster Management.

   • The Cisco SD-WAN Manager cluster must have three Cisco SD-WAN Manager instances. A cluster with more than three instances or fewer than three instances is not a supported configuration for Cisco Catalyst SD-WAN multitenancy.

   • While creating the Cisco SD-WAN Manager cluster, add the Cisco SD-WAN Manager instance configured to support multitenancy before adding the other two Cisco SD-WAN Manager instances.

4. Certify all instances of Cisco SD-WAN Manager. See Generate Cisco SD-WAN Manager Certificate.

5. Create and configure Cisco SD-WAN Validatorinstances. See Deploy Cisco SD-WAN Validator.

   While configuring Cisco SD-WAN Validator instances, configure the service provider organization name (sp-organization-name) and the organization name (organization-name). See Configure Organization Name in Cisco SD-WAN Validator.

   sp-organization-name multitenancy
   organization-name multitenancy

6. Create Cisco SD-WAN Controller instances. See Deploy the Cisco SD-WAN Controllers.

   To support 50 tenants and 1000 devices across all tenants, deploy 6 Cisco SD-WAN Controller instances. To support 100 tenants and 5000 devices across all tenants, deploy 12 Cisco SD-WAN Controllers.

   1. Add Cisco SD-WAN Controllers to the overlay network.

7. Onboard new tenants. See Add a New Tenant.

Prerequisites

• At least two Cisco SD-WAN Controllers must be operational and in the Manager mode before you can add new tenants.

  A Cisco SD-WAN Controller enters the Manager mode when you push a template onto the controller from Cisco SD-WAN Manager. A Cisco SD-WAN Controller in the CLI mode cannot serve multiple tenants.

• Each pair of Cisco SD-WAN Controllers can serve a maximum of 24 tenants. Ensure that there at least two Cisco SD-WAN Controllers that can serve a new tenant. If no pair of Cisco SD-WAN Controllers in the deployment can serve a new tenant, add two Cisco SD-WAN Controllers and change their mode to Manager.

• If you add a second tenant immediately after adding a tenant, Cisco SD-WAN Manager adds them sequentially, and not in parallel.

• Each tenant must have a unique Virtual Account (VA) on Plug and Play Connect on Cisco Software Central. The tenant VA should belong to the same Smart Account (SA) as the provider VA.

• For an on-premises deployment, create a Cisco SD-WAN Validator controller profile for the tenant on Plug and Play Connect. The fields in the following table are mandatory.

  Table 6. Controller Profile Fields

  Field	Description/Value
  Profile Name	Enter a name for the controller profile.
  Multi-Tenancy	From the drop-down list, select Yes.
  SP Organization Name	Enter the provider organization name.
  Organization Name	Enter the tenant organization name in the format <SP Org Name>-<Tenant Org Name>. Note   The organization name can be up to 64 characters.
  Primary Controller	Enter the host details for the primary Cisco SD-WAN Validator.

  For a cloud deployment, the Cisco SD-WAN Validator controller profile is created automatically as part of the tenant creation process.

1. Log in to Cisco SD-WAN Manager as the provider admin user.

2. From the Cisco SD-WAN Manager menu, choose Administration > Tenant Management.

3. Click Add Tenant. In the Add Tenant dialog box:

   1. Enter a name for the tenant.

      For a cloud deployment, the tenant name should be same as the tenant VA name on Plug and Play Connect.

   2. Enter a description of the tenant.

      The description can be up to 256 characters and can contain only alphanumeric characters.

   3. Enter the name of the organization.

      The organization name is case-sensitive. Each tenant or customer must have a unique organization name.

      Enter the organization name in the following format:

      <SP Org Name>-<Tenant Org Name>

      For example, if the provider organization name is 'multitenancy' and the tenant organization name is 'Customer1', while adding the tenant, enter the organization name as multitenancy-Customer1.

      Note	The organization name can be up to 64 characters.

   4. In the URL Subdomain Name field, enter the fully qualified sub-domain name of the tenant.

      • The sub-domain name must include the domain name of the service provider. For example, for the multitenancy.com service provider, a valid domain name can be Customer1.multitenancy.com.

        Note	The service provider name is shared amongst all tenants. Hence, ensure that the URL naming convention follows the same domain name convention that was provided while enabling multitenancy from the Cisco SD-WAN Manager Administration > Settings > Tenancy Mode GUI navigation path.

      • For an on-premises deployment, add the fully qualified sub-domain name of the tenant to the DNS. Map the fully qualified sub-domain name to the IP addresses of the three Cisco SD-WAN Manager instances in the Cisco SD-WAN Manager cluster.

        When creating fully qualified domain names (FQDN) the following DNS entries are required:

        • Provider Level: Create DNS A record and map it to the IP addresses of the Cisco SD-WAN Manager instances running in the Cisco SD-WAN Manager cluster. The A record is derived from the domain and Cluster ID that was created in steps 5 and 6 in Enable Multitenancy on Cisco SD-WAN Manager. For example, if domain is sdwan.cisco.com and Cluster ID is vmanage123, then A record will need to be configured as vmanage123.sdwan.cisco.com.

          Note	If you fail to update DNS entries, it will result in authentication errors when logging in to Cisco SD-WAN Manager. Validate DNS is configured correctly by executing nslookup vmanage123.sdwan.cisco.com.

        • Tenant Level: Create DNS CNAME records for each tenant created and map them to the FQDN created at the Provider Level. For example, if domain is sdwan.cisco.com and tenant name is customer1 the CNAME record will need to be configured as customer1.sdwan.cisco.com.

          Note	Cluster ID is not required for CNAME record. Validate DNS is configured correctly by executing nslookup customer1.sdwan.cisco.com.

        For a cloud deployment, the fully qualified sub-domain name of the tenant is automatically added to the DNS as part of the tenant creation process. After you add a tenant, it could take up to an hour before the fully qualified sub-domain name of the tenant can be resolved by the DNS.

   5. Click Save.

      The Create Tenant screen appears, and the Status of the tenant creation reads In progress. To view status messages related to the creation of a tenant, click the > button to the left of the status.

      Cisco SD-WAN Manager does the following:

      • creates the tenant

      • assigns two Cisco SD-WAN Controllers to serve the tenant and pushes a CLI template to these controllers to configure tenant information

      • sends the tenant and Cisco SD-WAN Controller information to Cisco SD-WAN Validators.

After the Status column changes to Success, you can view the tenant information on the Administration > Tenant Management page.

Before You Begin

• Before you begin the migration,

  • Ensure that the edge devices in the single-tenant deployment can reach the Cisco SD-WAN Validator in the multitenant deployment

  • Ensure that the template, routing, and policy configuration on the edge devices is synchronized with the current configuration on Cisco SD-WAN Manager

  • Ensure that the Certificate Authority (CA) on both single-tenant and multitenant Cisco SD-WAN Managers are same.

  • Configure a maintenance window for the single-tenant overlay before performing this procedure. See Configure or Cancel Cisco SD-WAN Manager Server Maintenance Window.

• Minimum software requirements for the single-tenant overlay to be migrated:

  Device	Software Version
  Cisco SD-WAN Manager	Cisco vManage Release 20.5.1
  Cisco SD-WAN Validator	Cisco SD-WAN Release 20.5.1
  Cisco SD-WAN Controller	Cisco SD-WAN Release 20.5.1
  Cisco IOS XE Catalyst SD-WAN device	Cisco IOS XE Catalyst SD-WAN Release 17.4.1a

• Minimum software requirements for the multitenant deployment to which the single-tenant overlay must be migrated:

  Device	Software Version
  Cisco SD-WAN Manager	Cisco vManage Release 20.5.1
  Cisco SD-WAN Validator	Cisco SD-WAN Release 20.5.1
  Cisco SD-WAN Controller	Cisco SD-WAN Release 20.5.1
  Cisco IOS XE Catalyst SD-WAN device	Cisco IOS XE Catalyst SD-WAN Release 17.5.1a

• We recommend that you use a custom script or a third-party application like Postman to execute the API calls.

Migration Procedure

1. Export the single-tenant deployment and configuration data from a Cisco SD-WAN Manager instance controlling the overlay.

   Method	POST
   URL	https://ST-vManage-IP-address
   Endpoint	/dataservice/tenantmigration/export
   Authorization	Admin user credentials.
   Body	Required Format: Raw JSON { "desc": <tenant_description>, "name": <tenant_name>, "subdomain": <tenant_name>.<domain>, "orgName": <tenant_orgname > } Field Description: desc: A description of the tenant. The description can be up to 256 characters and can contain only alphanumeric characters. name: Unique name for the tenant in the multitenant deployment. subdomain: Fully qualified sub-domain name of the tenant. The sub-domain name must include the domain name of the service provider. For example, if multitenancy.com is the domain name of service provider, and the tenant name is Customer1, the tenant sub-domain name would be Customer1.multitenancy.com. orgName: Name of the tenant organization. The organization name is case-sensitive.
   Response	Format: JSON { "processId": <vManage_process_ID>, }

   While exporting the data, Cisco SD-WAN Manager attempts to detach any CLI templates from the edge devices in preparation for the migration to the multitenant deployment. If prompted by Cisco SD-WAN Manager, detach CLI templates from the edge devices and execute the export API call again.

2. Check the status of the data export task in Cisco SD-WAN Manager. When the task succeeds, download the data using the URL https://ST-vManage-IP-address/dataservice/tenantmigration/download/default.tar.gz

3. On a multitenant Cisco SD-WAN Manager instance, import the data exported from the single-tenant overlay.

   Method	POST
   URL	https://MT-vManage-IP-address
   Endpoint	/dataservice/tenantmigration/import
   Authorization	Provider Admin user credentials.
   Body	Required Format: form-data Key Type: File Value: default.tar.gz
   Response	Format: JSON { "processId": <vManage_process_ID>, "migrationTokenURL": <token_URL>, }

   When the task succeeds, on the multitenant Cisco SD-WAN Manager, you can view the devices, templates, and policies imported from the single-tenant overlay.

4. Obtain the migration token using the token URL obtained in response to the API call in Step 3.

   Method	GET
   URL	https://MT-vManage-IP-address
   Endpoint	migrationTokenURL obtained in Step 3.
   Authorization	Provider Admin user credentials.
   Response	The migration token as a large blob of encoded text.

5. On the single-tenant Cisco SD-WAN Manager instance, initiate the migration of the overlay to the multitenant deployment.

   Method	POST
   URL	https://ST-vManage-IP-address
   Endpoint	dataservice/tenantmigration/networkMigration
   Authorization	Admin user credentials.
   Body	Required Format: Raw text Content: Migration token obtained in Step 4.
   Response	Format: JSON { "processId": <vManage_process_ID>, }

   In Cisco SD-WAN Manager, check the status of the migration task. As part of the migration task, the address of the multitenant Cisco SD-WAN Validator, and the service provider and tenant organization names are pushed to the WAN edge devices of the single-tenant overlay. If the task succeeds, WAN edge devices form control connections to controllers in the multitenant deployment; the WAN edge devices are no longer connected to the controllers of the single-tenant overlay.

   Attach any CLI templates detached from the edge devices (in Step 1) after migration to the multitenant deployment. Before you attach the templates, update the Cisco SD-WAN Validator IP address and the Organization name to match the configuration of the multitenant deployment.

   Note

   In the single-tenant deployment, if Cisco SD-WAN Manager-signed certificates are installed on cloud-based WAN edge devices, the certificates are cleared when the devices are migrated to the multitenant deployment. You must re-certify the devices on the multitenant Cisco SD-WAN Manager. If enterprise certificates are installed on the cloud-based WAN edge devices, the certificates are not affected by the migration. For more information, see Enterprise Certificates.