Before you can generate a Certificate Signing Request (CSR), you must configure the name of your organization. The organization name is included in the CSR.

In public key infrastructure (PKI) systems, a CSR is sent to a certificate authority to apply for a digital identity certificate.

To configure the organization name:

1. From the Cisco vManage menu, choose Administration > Settings.

2. From Organization Name, click Edit .

3. In Organization Name, enter the name of your organization. The organization name must be identical to the name that is configured on the vBond orchestrator.

4. In Confirm Organization Name, re-enter and confirm your organization name.

5. Click Save.

Note	After the control connections are up and running, the organization name bar is no longer editable.

1. From vBond, click Edit .

2. In vBond DNS/IP Address: Port, enter the DNS name that points to the vBond orchestrator or the IP address of the Cisco vBond orchestrator and the port number to use to connect to it.

3. Click Save.

   Note

   The DNS cache timeout should be proportional to the number of Cisco vBond Orchestrator IP addresses that DNS has to resolve, otherwise the control connection for Cisco vManage might not come up during a link failure. This is because, when there are more than six IP addresses (this is the recommended number since the default DNS cache timeout is currently two minutes) to check, the DNS cache timer expires even as the highest preferred interface tries all vBond IP addresses, before failing over to a different color. For instance, it takes about 20 seconds to attempt to connect to one IP address. So, if there are eight IP addresses to be resolved, the DNS cache timeout should be 20*8=160 seconds or three minutes.

Signed certificates are used to authenticate devices in the overlay network. Once authenticated, devices can establish secure sessions between each other. It is from the Cisco vManage that you generate these certificates and install them on the controller devices—Cisco vBond orchestrators,Cisco vManage, and Cisco vSmart controllers. You can use certificates signed by Symantec, or you can use enterprise root certificates.

The controller certification authorization settings establish how the certification generation for all controller devices will be done. They do not generate the certificates.

You need to select the certificate-generation method only once. The method you select is automatically used each time you add a device to the overlay network.

To have the Symantec signing server automatically generate, sign, and install certificates on each controller device:

1. From Controller Certificate Authorization, click Edit.

2. Click Symantec Automated (Recommended). This is the recommended method for handling controller signed certificates.

3. In the Confirm Certificate Authorization Change dialog box, click Proceed to confirm that you wish to have the Symantec signing server automatically generate, sign, and install certificates on each controller device.

4. Enter the first and last name of the requester of the certificate.

5. Enter the email address of the requester of the certificate. This address is required because the signed certificate and a confirmation email are sent to the requester via email; they are also made available though the customer portal.

6. Specify the validity period for the certificate. It can be 1, 2, or 3 years.

7. Enter a challenge phrase. The challenge phrase is your certificate password and is required when you renew or revoke a certificate.

8. Confirm your challenge phrase.

9. In Certificate Retrieve Interval, specify how often the Cisco vManage server checks if the Symantec signing server has sent the certificate.

10. Click Save.

To manually install certificates that the Symantec signing server has generated and signed:

1. From Controller Certificate Authorization, click Edit.

2. Click Symantec Manual.

3. In the Confirm Certificate Authorization Change dialog box, click Proceed to manually install certificates that the Symantec signing server has generated and signed.

4. Click Save.

To use enterprise root certificates:

1. From Controller Certificate Authorization, click Edit.

2. Click Enterprise Root Certificate.

3. In the Confirm Certificate Authorization Change dialog box, click Proceed to confirm that you wish to use enterprise root certificates.

4. In the Certificate box, either paste the certificate, or click Select a file and upload a file that contains the enterprise root certificate.

5. By default, the enterprise root certificate has the following properties: To view this information, issue the show certificate signing-request decoded command on a controller device, and check the output in the Subject line. For example:

   • Country: United States

   • State: California

   • City: San Jose

   • Organizational unit: ENB

   • Organization: CISCO

   • Domain Name: cisco.com

   • Email: cisco-cloudops-sdwan@cisco.com

   vSmart# show certificate signing-request decoded
       ...
       Subject: C=US, ST=California, L=San Jose, OU=ENB, O=CISCO, CN=vsmart-uuid .cisco.com/emailAddress=cisco-cloudops-sdwan@cisco.com 
       ...
      

   To change one or more of the default CSR properties:

   1. Click Set CSR Properties.

   2. Enter the domain name to include in the CSR. This domain name is appended to the certificate number (CN).

   3. Enter the organizational unit (OU) to include in the CSR.

   4. Enter the organization (O) to include in the CSR.

   5. Enter the city (L), state (ST), and two-letter country code (C) to include in the CSR.

   6. Enter the email address (emailAddress) of the certificate requester.

   7. Specify the validity period for the certificate. It can be 1, 2, or 3 years.

6. Click Import & Save.

If you are using the Cisco SD-WAN hosted service, you can enforce a version of the Cisco SD-WAN software to run on a router when it first joins the overlay network.

To ensure that templates are in sync after an upgrade that enforces a software version, make sure of the following before you perform the upgrade:

• The bootflash and flash on the router must have enough free space to support the upgrade

• The version of the SD-WAN image that is on the device before the upgrade must be a lower version than the enforced SD-WAN version you specify in the following procedure

To enforce a version of the Cisco SD-WAN software to run on a router when it first joins the overlay network, follow these steps:

1. Ensure that the software image for the desired device software version is present in the Cisco vManage software image repository:

   1. From the Cisco vManage menu, choose Maintenance > Software Repository.

      The Software Repository screen opens and displays a table of software images. If the desired software image is present in the repository, continue with Step 2.

   2. If you need to add a software image, click Add New Software.

   3. Select the location from which to download the software images, either Cisco vManage, Remote Server, or Remote Server - vManage.

   4. Select an x86-based or a MIPS-based software image.

   5. To place the image in the repository, click Add.

2. From the Cisco vManage menu, choose Administration > Settings.

3. From Enforce Software Version (ZTP), click Edit.

4. In Enforce Software Version, click Enabled.

5. From the Version drop-down list, select the version of the software to enforce on the device when they join the network.

6. Click Save.

Use the Banner template for Cisco vBond Orchestrators, Cisco vManages, Cisco vSmart Controllers, Cisco vEdge devices, and s.

You can configure two different banner text strings, one to be displayed before the CLI login prompt on a Cisco SD-WAN device and the other to be displayed after a successful login to the device.

• To configure the banner text for login screens using Cisco vManage templates, create a Banner feature template to configure PIM parameters, as described in this topic.

• To configure a login banner for the Cisco vManage system, from the Cisco vManage menu, choose Administration > Settings.​

Configure a Banner

1. From the Cisco vManage menu, choose Configuration > Templates.

2. Click Device Templates, and click Create Template.

   Note	In Cisco vManage Release 20.7.x and earlier releases, Device Templates is called Device.

3. From the Create Template drop-down list, select From Feature Template.

4. From the Device Model drop-down list, select the type of device for which you are creating the template.

5. Click Additional Templates or scroll to the Additional Templates section.

6. From the Banner drop-down list, click Create Template. The Banner template form is displayed. This form contains fields for naming the template, and the fields for defining Banner parameters.

7. In Template Name, enter a name for the template. The name can be up to 128 characters and can contain only alphanumeric characters.

8. In Template Description, enter a description of the template. The description can be up to 2048 characters and can contain only alphanumeric characters.

   When you first open a feature template, for each parameter that has a default value, the scope is set to Default (indicated by a check mark), and the default setting or value is shown. To change the default or to enter a value, click the Scope drop-down list.

9. To set a banner, configure the following parameters:

   Table 1. Parameters to be configured while setting a banner:

   Parameter Name	Description
   MOTD Banner	On a Cisco vEdge device enter message-of-the-day text to display after a successful login. The string can be up to 2048 characters long. To insert a line break, type \n.
   Login Banner	Enter text to display before the login prompt. The string can be up to 2048 characters long. To insert a line break, type \n.

10. To save the feature template, click Save.

CLI equivalent:

banner{login text | motd text}

Release Information

Introduced in Cisco vManage NMS in Release 15.2.

To create a custom banner that is displayed after you log in to the Cisco vManage:

1. From Banner, click Edit.

2. In Enable Banner, click Enabled.

3. In Banner Info, enter the text string for the login banner or click Select a File to download a file that contains the text string.

4. Click Save.

Enable or disable the collection of statistics for devices in the overlay network. By default, the collection of statistics is enabled for all the devices in the overlay network.

1. From the Cisco vManage menu, choose Administration > Settings.

2. To modify the settings for collecting device statistics, click Statistics Setting, and click Edit.

   Tip	To view the configured settings, click View.

   By default, for every group of statistics (such as Aggregated DPI and AppHosting), collection of statistics is enabled for all devices.

3. To enable the collection of a group of statistics for all devices, click Enable All for the particular group.

4. To disable the collection of a group of statistics for all devices, click Disable All for the particular group.

5. To enable the collection of a group of statistics for all devices only for consumption by Cisco vAnalytics, click vAnalytics only for the particular group.

6. To enable or disable the collection of a group of statistics for specific devices in the overlay network, click Custom for the particular group.

   In the Select Devices dialog box, depending on whether statistics collection is enabled or disabled for a device, the device is listed among Enabled Devices or Disabled Devices respectively.

   1. To enable statistics collection for one or more devices, choose the devices from Disabled Devices and move them to Enabled Devices.

      Tip	To choose all Disabled Devices, click Select All.

   2. To disable statistics collection for one or more devices, choose the devices from Enabled Devices and move them to Disabled Devices.

      Tip	To choose all Enabled Devices, click Select All.

   3. To save your selections, click Done.

      To discard your selections, click Cancel.

7. To apply the modified settings, click Save.

   To discard your changes, click Cancel.

   To revert to the default settings, click Restore Factory Default.

Configure the Time Interval to Collect Device Statistics

1. From the Cisco vManage menu, choose Administration > Settings.

2. To modify the time interval at which device statistics are collected, find Statistics Configuration and click Edit.

   Tip	To view the configured time interval, click View.

3. Enter the desired Collection Interval in minutes.

   • Default value: 30 minutes

   • Minimum value: 5 minutes

   • Maximum value: 180 minutes

4. To apply the modified settings, click Save.

   To discard your changes, click Cancel.

   To revert to the default settings, click Restore Factory Default.

Use the Logging template for all Cisco SD-WANs to configure logging to either the local hard drive or a remote host.

Navigate to the Template Screen and Name the Template

1. In vManage NMS, select the Configuration ► Templates screen.

2. In the Device tab, click Create Template.

3. From the Create Template drop-down, select From Feature Template.

4. From the Device Model drop-down, select the type of device for which you are creating the template.

5. To create a custom template for Logging, select the Factory_Default_Logging_Template and click Create Template. The Logging template form is displayed. The top of the form contains fields for naming the template, and the bottom contains fields for defining Logging parameters. You may need to click a tab or the plus sign (+) to display additional fields.

   

6. In the Template Name field, enter a name for the template. The name can be up to 128 characters and can contain only alphanumeric characters.

7. In the Template Description field, enter a description of the template. The description can be up to 2048 characters and can contain only alphanumeric characters.

When you first open a feature template, for each parameter that has a default value, the scope is set to Default (indicated by a check mark), and the default setting or value is shown. To change the default or to enter a value, click the scope drop-down to the left of the parameter field.

Minimum Logging Configuration

The following logging parameters are configured by default:

• Log event notification system log (syslog) messages are logged to a file on the local device's hard disk, at a priority level of "information."

• Log files are placed in the directory /var/log on the local device.

• Log files are readable by the "admin" user.

Configure Logging to the Local Disk

To configure logging of event notification system log messages to the local device's hard disk, select the Disk tab and configure the following parameters:

To save the feature template, click Save.

CLI equivalent:

 system  
  logging
  ​   disk   
      enable
      file
        rotate numbersize megabytes priority priority

Configure Logging to Remote Severs

To configure logging of event notification system log messages to a remote server, click the Server tab. Then click Add New Server and configure the following parameters:

To edit a logging server, click the pencil icon to the right of the entry.

To remove a logging server, click the trash icon to the right of the entry.

To save the feature template, click Save.

CLI equivalent:

 system  
  logging 
    ​ server  (dns-name | hostname | ip-address)
      priority priority
      source-interface interface-name
      vpn vpn-id
            

Release Information

Introduced in Cisco vManage NMS in Release 15.2.

1. Log in to one of the Cisco vManage nodes in the Cisco vManage cluster and configure the following command:

   vManage# request nms server-proxy set ratelimit

2. The command-line displays the following prompt about the rate limit for non-bulk APIs:

   Do you want to reconfigure rate limit for URL non bulk api [y/n] :

   Enter n .

3. The command-line displays the following prompt about the rate limit for bulk APIs:

   Do you want to reconfigure rate limit for URL bulk api /dataservice/data/device/statistics [y/n] :

   Enter y .

4. Enter the per-node rate limit in response to a prompt similar to the following:

   Enter the PER NODE rate limit for URL bulk api /dataservice/data/device/statistics [144 load balanced across all nodes at present] :

   This prompt is from a three-node Cisco vManage cluster, with the bulk API rate limit configured to the default value of 48 requests per node. Across all the three nodes, the bulk API rate limit is (rate-limit/node) * 3, which is 144 requests.

   Before you enter the rate limit, consider its effect on Cisco vManage resources.

5. Enter the unit time for which the rate limit applies in response to a prompt similar to the following.

   You can apply a rate limit per second, minute, hour, or day. The default unit is minute.

   Enter the rate limit unit (second, minute, hour, day) for URL bulk api /dataservice/data/device/statistics [minute] :

   Cisco vMange applies the rate limit on all the Cisco vManage instances in the cluster. The command line displays the following message:

   Propagating rate limit update across all nodes. Please wait.

   After the rate limit is applied, Cisco vManage prompts you to restart the server-proxy on all nodes and the command line returns to the privileged EXEC mode:

   Done. Please restart server-proxy on all nodes using "request nms server-proxy restart" command.
   vManage# 

6. Restart the server-proxy using the following command:

   vManage# request nms server-proxy restart

7. Log in to the other Cisco vManage nodes in the cluster and restart the server-proxy using the request nms server-proxy restart command.