Cisco SD-WAN Analytics is a cloud-based analytics service for Cisco Catalyst SD-WAN offering comprehensive insights into application and network performance. The analytics service is available with Cisco DNA Advantage and Cisco DNA Premier software subscriptions. Cisco SD-WAN Analytics collects and stores metadata about traffic flows in its cloud storage and produces analytics based on this collected data.

Some of the key benefits of Cisco SD-WAN Analytics service are:

• Network Visibility: Gain visibility into key network performance metrics, such as loss, latency, jitter, and availability.

• Application Experience: Assess Quality of Experience (QoE) for applications deployed in data centres and on cloud.

• Operational Insights: Establish historical benchmarks, identify trends, and correlate application experience with the underlying network behavior.

• Path Recommendations: Gain insights into the quality of the current network paths your applications are taking, and the quality of the alternate recommended paths for better application experience.

• Faster Resolution: Lower the mean time to identification (MTTI) of issues with faster root cause isolation.

• Application Flows: Gain insights into application traffic flows over various network paths.

• Top Talkers: Identify top consumers of network bandwidth.

• Reporting: Generate analysis reports for offline review by CIO/CTO/COO and network teams.

Enable Data Collection

• Enable Data Collection (Cisco vManage Release 20.3 or Later)

• Enable Data Collection (Cisco vManage Release 20.1 or Earlier)

• Additional Steps to Enable Data Collection on an On-Premises Cisco SD-WAN Manager Instance

You can manage user access and operational privileges through Cisco Software Central. Each overlay is associated with a Virtual Account. To allow a user to access Cisco SD-WAN Analytics for a particular overlay, add the user to the Virtual Account in one of the following capacities:

• Virtual Account Administrator: The user can access all Cisco SD-WAN Analytics screens for the overlay. In addition, the user can configure the IdP to be used for user authentication for the overlay.

• Virtual Account User: The user can access all Cisco SD-WAN Analytics screens for the overlay.

Alternatively, you can add a user to a Smart Account. Doing so allows the user to access Cisco SD-WAN Analytics for all Virtual Accounts belonging to the Smart Account. This option of adding a user at the Smart Account level is especially useful for managed service providers (MSPs) and enterprises managing multiple overlays. You can add a user to a Smart Account in one of the following capacities:

• Smart Account Administrator: The user can access all Cisco SD-WAN Analytics screens for all the overlays. In addition, the user can view the reports tab and generate reports for anlysis. This user can also configure the IdP to be used for all the overlays or configure the use of an organization IdP for a particular overlay.

• Smart Account User: The user can access all the Cisco SD-WAN Analytics screens for the overlay.

  Note	A Smart Account Approver has the same privileges as a Smart Account User.

When authenticated by their organization's IdP, users are granted access to overlays and operations based on the default role assigned to them while defining organization IdP on Cisco SD-WAN Analytics. Alternatively, user role can be updated by using the authzCiscovAnalytics attribute on the organization IdP.

Use the following syntax to specify the default role or a value for the authzCiscovAnalytics attribute:

<syntax-version>;<overlay-1>:<role1>[,<role2>][;<overlay-2>:<role1>[,<role2>]]...

Currently, only one version of the syntax is supported and you must specify the syntax version as v1.

You can specify an overlay name and the user privileges for the overlay in the format: <overlay-1>:<role1>[,<role2>].

• To assign the same privileges to the user for all the overlays, specify the overlay name as *. Further, if a set of overlays share a part of their name, you can specify the set of the overlays using a combination of the shared part of the name and the wildcard character *.

  If you're configuring the IdP for a single overlay, specify the overlay name as *.

The Cisco Smart Account or Virtual Account administrator must first login to Cisco SD-WAN Analytics service using the Cisco CCO ID. After login, the administrator can view a list of Smart Accounts or Virtual Accounts that they have access to. The administrator will then be able to define organization IDP against Cisco SD-WAN Analytics for subsequent access through organization ID by users.

If the administrator belongs to more than one Virtual Account, Smart Account, or both, the administrator sees the Smart Accounts screen. The Smart Accounts screen lists the Smart Accounts and Virtual Accounts to which the administrator is subscribed. Each Virtual Account represents an overlay network.

The administrator sees the Overview Dashboard page if the administrator belongs to only one Virtual Account and Smart Account, and therefore, has access to only one overlay. From the Overview Dashboard, you can access the Smart Accounts screen by clicking View all overlays.

For an overlay, if Cisco SD-WAN Analytics has been onboarded, the entry under vAnalytics Status reads Active; if Cisco SD-WAN Analytics is not onboarded, the entry reads New. If Cisco SD-WAN Analytics is available for an overlay, you can launch the Dashboard for overlay by clicking on the overlay or Virtual Account name.

Note

If the vAnalytics Status for an overlay reads New, but you are aware that Cisco SD-WAN Analytics has been onboarded, verify whether you have logged in using the correct Cisco SD-WAN Analytics URL. See Access Cisco SD-WAN Analytics to use one of the URLs based on the location of your Cisco SD-WAN Analytics.

To pause data processing for an overlay, click … adjacent to the overlay name and choose Deactivate. When data processing is paused, the vAnalytics Status reads InActive (Paused). To resume data processing, choose Activate.

The entry under IDP Server indicates whether your organization's IdP is configured to be used with the overlay or not (Not Defined).

To configure an IdP for an overlay for which Cisco SD-WAN Analytics has been activated, click ... under Actions, and click Define IDP. For more information on defining the IdP, see Define Organization IdP for Overlays.

Define Organization IdP for Overlays

As an administrator for a Smart Account, you can configure your organization's IdP to be used for authenticating Cisco SD-WAN Analytics users for all or some of the overlays. As an administrator for a Virtual Account or an overlay, you can configure your organization's IdP to be used for authenticating Cisco SD-WAN Analytics users for the overlay.

1. Log in to Cisco SD-WAN Analytics.

   Note	If this is your first login to Cisco SD-WAN Analytics for your overlay, log in with the Cisco CCO ID. The organization IdP you define for the overlay authenticates and authorizes users in subsequent log-in attempts.

2. If you see the Dashboard, click View all overlays to go to the Smart Accounts screen.

3. Configure your organization's IdP for a Smart Account or the overlay associated with a Virtual Account:

   1. To configure your organization's IdP for a Smart Account, click Define IDP.

   2. To configure your organization's IdP for a virtual account, hover the mouse pointer over ... under Actions. Then, click Define IDP.

4. In the Define IDP dialog box, click OIDC IDP or SAML IDP.

   1. For an SAML 2.0 IdP, do the following:

      Table 3. SAML IdP Properties

      IDP Metadata	Click browse file and upload the SAML 2.0 metadata file to Cisco SD-WAN Analytics. Cisco SD-WAN Analytics reads the SAML 2.0 file and displays the following details: IDP Issuer URL IDP Single Sign-on URL IDP Signature Certificate Expiry (days)
      Default User Role	Configure a default role for Cisco SD-WAN Analytics users. The default role is used if a role is not assigned to a user on the IdP. Note   In addition to specifying a default role while defining an IDP, you can manage user access and operational privileges by defining a authzCiscovAnalytics attribute for users on your organization's IdP. A user can be assigned the following roles: The basic role allows a user to access all the Cisco SD-WAN Analytics screens for the overlay except the Microsoft 365 Cloud OnRamp screens. The o365 role allows a user to access the Microsoft 365 Cloud OnRamp screens. You can assign both the basic and o365 roles to an user to enable the user to access all the Cisco SD-WAN Analytics screens for the overlay. The admin role allows a user to access all the Cisco SD-WAN Analytics screens for the overlay. In addition, the user can also define an IdP for the overlay.
      Domain Identifier	Specify the domain identifier contained by every user ID. For example, if user IDs defined on your organization's IdP have the format userID@example.com, the common domain identifier is example.com.

   2. For an OIDC IdP, do the following:

      Table 4. OIDC IdP Properties

      IDP Metadata	Enter the following OIDC properties for your organization's IdP: Client ID Client Secret Issuer Authorization Endpoint Token Endpoint JWKS Endpoint Userinfo Endpoint
      Default User Role	Configure a default role for Cisco SD-WAN Analytics users. The default role is used if a role is not assigned to a user on the IdP. Note   In addition to specifying a default role while defining an IDP, you can manage user access and operational privileges by defining a authzCiscovAnalytics attribute for users on your organization's IdP. A user can be assigned the following roles: The basic role allows a user to access all the Cisco SD-WAN Analytics screens for the overlay except the Microsoft 365 Cloud OnRamp screens. The o365 role allows a user to access the Microsoft 365 Cloud OnRamp screens. You can assign both the basic and o365 roles to an user to enable the user to access all the Cisco SD-WAN Analytics screens for the overlay. The admin role allows a user to access all the Cisco SD-WAN Analytics screens for the overlay. In addition, the user can also define an IdP for the overlay.
      Domain Identifier	Specify the domain identifier contained by every user ID. For example, if user IDs defined on your organization's IdP have the format userID@example.com, the common domain identifier is example.com.

   3. Click Save.

5. To complete the IdP definition, send the required claims with non-empty values:

   The required claims are firstName, lastName, and email.

   An optional claim attribute authzCiscovAnalytics is also available. For more details, see the section Authorization with Organization ID.

Any users logging in to Cisco SD-WAN Analytics after the IdP is configured are redirected to the IdP's page for authentication.

Manage a Defined Organization IdP

As an administrator for a Smart Account, you can view, modify, or delete the organization IdP defined for authenticating Cisco SD-WAN Analytics users for all or some of the overlays. As an administrator for a Virtual Account or an overlay, you can view, modify, or delete the organization IdP defined for authenticating Cisco SD-WAN Analytics users for the overlay.

1. Log in to Cisco SD-WAN Analytics.

2. If you see the Dashboard, click View all overlays to go to the Smart Accounts screen.

3. To manage a defined IdP, hover the mouse pointer over ... under Actions.

   • To view the IdP properties, click View IDP.

   • To modify the IdP properties, click Edit IDP.

     You can edit only the default user role and domain identifier for a defined IdP. If you need to modify any other properties, you must delete the IdP definition, and define the IdP again.

   • To delete the defined IdP, click Delete IDP.

     After you delete the IdP, Cisco SD-WAN Analytics users cannot log in using IDs that are defined in and authenticated by the organization IdP. Any user sessions that are active when the IdP is deleted are not ended, but subsequent log-in attempts fail.

Sites

The Sites summary widget includes the total count of sites and their distribution based on percentage availability (a site's uptime). When the availability information for certain sites cannot be obtained, these sites are categorized as unknown. When sites are administratively down, the availability data cannot be generated for them.

The widget also displays the bottom five sites that are sorted by their availability and percentage-change in terms of availability compared to the previous time period of the same duration.

Applications

The Applications summary widget includes the total count of applications and their distribution based on QoE score of good, fair, and poor. Applications for which the health score is unavailable, or whose Quality of Experience (QoE) score is unknown, such applications are classified as unknown. Similarly, applications where all the traffic flows through DIA paths, which do not have a QoE score, are also classified as unknown applications.

The widget also displays the bottom five applications that are sorted by the worst QoE score and the change in QoE values for these five applications, and site wise distribution indicating the application health for these five applications in terms of QoE score depicted by a bar chart.

Click an application for more information about the sites. The Application 360 page displays where you can get a site level view of the application, the top sites using the application, its QoE, and usage information.

Circuits

The Circuits summary widget includes the total count of circuits and their distribution based on percentage availability. When the availability information for certain circuits cannot be obtained, these circuits are categorized as unknown. When circuits are administratively down, availability data cannot be generated for them.

The widget also displays the bottom five circuits that are sorted by their availability and percentage-change in terms of availability compared to the previous time period of the same duration.

When you click the View Bandwidth Forecast link, you can view a Bandwidth Forecasting chart that can be used to predict network bandwidth requirements based on current and historic bandwidth usage. For more information, see Bandwidth Forecasting.

Clients

The Clients widget displays the top clients of data in the overlay, the current usage of data and the changes in the usage of data from the last time period. The top clients are tracked by using respective source IP addresses in the overlay network. The widget also displays the top three applications that are used by the clients, and the data is ranked by bandwidth.

From the Overview Dashboard page, when you filter by sites, you can get an overview for the selected site. You can retrieve useful information about a site as to how many applications are running on this site, the number of devices on the site, the total data usage in the site, the circuits in the site, and the top clients of the site.

The Devices widget displays the list of devices on the site and other relevant information.

From the Overview Dashboard page, click Applications to navigate to the Application Dashboard page or click Sites to navigate to the Site Dashboard page.

Application Experience

The Application Experience widget displays utilization details, the number of applications that were good, fair, poor, and unknown by counts, and the total volume of traffic. An accordion chart shows the top applications by usage with the color indicating the application health in terms of QoE score. This helps draw attention to the most critical application performance issues. Applications with an unknown QoE score are represented in gray.

Application Trend Analysis

Click Application Trend Analysis in the Application Experience widget to launch the Application Trend Analysis widget to view trends of applications for a selected time period in the form of charts.

With the Application Trend Analysis widget you can visualize trends of applications from the following perspectives:

• Plot of numbers of Good/Fair/Poor applications by QoE over a selected time-interval.

• QoE trend-line of top five applications (by bandwidth) over a selected time-interval.

• Ability to specify a custom list from the table of applications, where you can select or deselect applications to view information.

Click an individual application block in the accordion chart to navigate to the Application 360 page to view more detailed information about the application you selected.

Application 360

Click an application in the Application Experience widget to navigate to the Application 360 page. Alternatively, you can click an application in the Trending Application widget, or on an application in the page elements that are listed in the table below, or on any application in the Application widget in the Overview Summary Dashboard to retrieve the Application 360 page.

The Application 360 page gives you a view of a single application performance across all sites with the capability to further drill down to in-depth details about an application at a single site and tunnel.

From the Application 360 page, you can visualize how the QoE for a specific application has changed over a selected time period. You can use the Application 360 page to do the following:

• Compare an application’s performance across each site, showing aggregated counts of Good/Fair/Poor sites on a map view.

• View the network path taken by an application across time for a single site.

• View metrics of applications across an overlay corresponding to various network Key Performance Indicators (KPI), with the ability to select specific sites to view loss, latency, jitter, users, and usage per site.

Note	The Application 360 page for a single site does not present statistics for applications flowing through a Direct Internet Access (DIA) exit for Cisco vEdge devices.

Sankey Chart

A Sankey chart provides more details about application flows across various Cisco Catalyst SD-WAN tunnels and DIA paths within a single site, and aids in understanding the health of the application over these tunnels, which terminate at the remote sites.

To view a Sankey chart, choose a single site, and then choose an application. Click the App Flow tab.

The left side of the chart displays information about the local site and color, followed by the QoE score. The right side displays information about the remote site and its color. The size of each link indicates the cumulative usage volume of the tunnel extending from the local site to the remote site.

By default, the Site drop-down list showcases the top five sites with the highest QoE scores. The chart aggregates and displays this site information. Furthermore, you can select and display information for up to six sites from the drop-down list.

The Sankey chart displays information for both Cisco Catalyst SD-WAN tunnels and DIA paths. For the DIA path, the local color represents the interface name, while the remote site is denoted as SaaS. A flow without remote color and site information represents a DIA path. The chart also identifies any unknown QoE paths as gray paths.

Click a node to highlight all relevant tunnel paths passing through that node. Hover the mouse pointer over the individual sections to view additional information about the volume of usage traffic. The central link classifies the path's quality, categorizing it as good, fair, poor, or unknown.

Microsoft 365

From Cisco IOS XE Catalyst SD-WAN Release 17.6.1a Cisco vManage Release 20.6.1, you can enable Microsoft Informed Network Routing to enable collection of telemetry data for the Microsoft 365 application suite. For information on how to enable collection of telemetry data for Microsoft 365 in Cisco SD-WAN Manager, see Enable Application Feedback Metrics for Office 365 Traffic

The telemetry data for Microsoft 365 applications is displayed on the Path Analytics tab on the Application 360 page.

Path Analytics

The Path Analytics tab displays path telemetry data for the Microsoft 365 family of applications if the feature is enabled in Cisco SD-WAN Manager. See Enable Application Feedback Metrics for Office 365 Traffic.

The Path Analytics tab displays path telemetry data for Microsoft 365 family of applications. It includes data such as best path scores across time, the Cisco Catalyst SD-WAN scores computed for each path, the feedback received by Microsoft for the paths, and latency data.

To view the telemetry data for Microsoft 365 applications, perform the following steps:

1. From the Overview Dashboard page, click Applications to navigate to the Application Dashboard page.

2. From the Applications dashboard page, choose a Microsoft application.

3. Select a site.

   The Path Analytics tab displays for the selected site and the Microsoft application.

   The Path Analytics tab displays only for the Microsoft 365 family of applications if the feature is enabled in Cisco SD-WAN Manager, and the telemetry data is available from Microsoft.

The Path Analytics tab displays the following charts:

For more information about the Cloud onRamp for SaaS configuration and viewing the metric logs, see the following sections in the Cloud OnRamp Configuration Guide, Cisco IOS XE Release 17.x:

• Enable Application Feedback Metrics for Office 365 Traffic

• Enable Microsoft to Provide Traffic Metrics for Office 365 Traffic

• View Office 365 Application Logs

Webex

The Path Analytics tab displays for a Webex application if you have enabled Webex telemetry in Cisco SD-WAN Manager. See Enable Webex Server-Side Metrics.

The Path Analytics tab displays path-telemetry data for Webex applications. It includes data such as best path scores across time, and the details about Webex traffic from the edge devices and from the Webex server.

To view the telemetry data for Webex, perform the following steps:

1. From the Overview Dashboard page, click Applications to navigate to the Application Dashboard page.

2. From the Applications dashboard page, choose a Webex application.

3. Select a site.

   The Path Analytics tab is displays for a selected site.

   The Path Analytics tab displays Webex data if the feature is enabled in Cisco SD-WAN Manager.

The Path Analytics tab displays the following charts:

QoE Distribution by Application Classes

The QoE Distribution by Application Classes widget displays the applications against different classes. Application classes are broad categories that are used to group applications based on their behavior and network performance requirements. The plot helps identify systemic network and overlay issues that can cause specific classes of applications to perform poorly in the overlay network. An inconsistent ratio of Poor/Fair/Good/unknown for a specific traffic class could indicate possible policy misconfiguration for that application in the overlay.

Trending Applications

The Trending Applications widget lets you compare top applications that have significant rise and drop in their measured QoE score, usage, loss, latency.

Applications

The Applications widget displays a table of all applications in an overlay. Applications that have an unknown QoE score are represented with a hyphen.

Total Uptime

The Total Uptime widget displays the total time the Cisco Catalyst SD-WAN fabric was active.

Circuits Trend Analysis

Click Trend Analysis in the Total Uptime widget to launch the Circuits Trend Analysis page to view the trends of circuits for a selected time period in the form of charts.

The Circuits Trend Analysis page displays the availability trend for each circuit. Click a circuit for additional information on the applications that use a specific circuit.

The Circuits table provides a comprehensive display of the circuits within your network, showcasing the bottom 10 circuits ranked by their availability. Click Custom List to customize the display of circuits in the page. You can select specific circuits that you want to include or exclude from the displayed information.

DIA Vs Tunnel Usage

The DIA vs Tunnel Usage widget provides a breakdown of the usage, specifically highlighting the distribution between DIA and tunnel usage within the circuit.

Click Trend Analysis in the DIA vs Tunnel Usage widget to view usage trends for DIA and tunnels in the form of charts. This information helps you to know the proportion of traffic that is routed through tunnels versus the traffic that uses DIA.

Color Usage

The Color Usage widget provides a visual representation of the distribution of usage per color within a fabric.

Click Trend Analysis in the Color Usage widget to view the usage trends of circuits based on color. Furthermore, it tracks the usage patterns that are associated with each color within the network fabric using time series data.

Bandwidth Utilization

The Bandwidth Utilization chart showcases the top five circuits based on their hourly bandwidth utilization.

The Bandwidth chart displays the utilization of bandwidth based on received (Rx) and transmitted (Tx) data. By applying the utilization filter, you can narrow down the chart display to showcase the specific bandwidth usage for either Rx or Tx.

Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.12.1

The Bandwidth chart displays both the absolute bitrate utilization (Rx+Tx) and the percentage utilization of Rx and Tx data. By applying the percentage utilization filter, you can refine the chart to show specific bandwidth usage for either Rx or Tx. To view the percentage utilization, ensure that you have configured the upstream bandwidth (for Tx percentage utilization) and downstream bandwidth (for Rx percentage utilization) settings in the Cisco SD-WAN Manager. For more information, see Monitoring Bandwidth on a Transport Circuit.

Circuits Distribution in an SD-WAN Fabric

The Circuits widget presents a comprehensive list of all circuits within a fabric, providing essential metrics such as service provider information, availability, downtime, bandwidth, and details about packet loss, latency, and jitter.

Click a circuit in the Circuits widget to navigate to the Circuits 360 page, where you can obtain 360-degree information and detailed insights about the circuit.

On the Circuits 360 page, you can view various components that provide information about the circuit's performance. This includes line charts showcasing metrics such as bandwidth utilization, application usage, tunnel usage, and comparison of DIA versus tunnel usage over time.

Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.12.1

To view the percentage utilization, ensure that you have configured the upstream bandwidth (for Tx percentage utilization) and downstream bandwidth (for Rx percentage utilization) settings in the Cisco SD-WAN Manager. For more information, see Monitoring Bandwidth on a Transport Circuit.