Display Domain Information

1. In the SD-AVC Dashboard, click Application Visibility.

2. In the timeline, click the drop-down list and choose Domain Hits to view the top five domains.

3. Click Application Insights to display a timeline and other options.

4. Click the drop-down list in the timeline and choose Domain Hits.

   A table shows the following information:

   Field	Description
   Domain	Domains and subdomains used for flows in the network. The domain information is collected by devices in the network and aggregated by SD-AVC.
   Hits	Number of flows handled by devices in the network, for each domain or subdomain, within the time interval configured in the SD-AVC Dashboard. SD-AVC displays the top 100 domains, as determined by the number of flows (hits).
   Last Application Name	If NBAR is able to classify the domain, this field displays an application name that corresponds to the domain.

5. You can click one or more domains in the list to display a graph of their contributions to the total number flows, over time.

Telemetry Data Collection

By default, SD-AVC shares telemetry with the cloud service to improve classification throughout the network.

The Cloud Connector setup enables you to specify the location for storing telemetry data for each network segment. This provides the flexibility to store telemetry data for different segments in different locations, and assists in compliance with EU General Data Protection Regulation (GDPR) regulations.

The NBAR component of SD-AVC is configured to automatically connect and transmit telemetry data, in near real time, to Cisco. Telemetry information will be used by Cisco to improve SD-AVC functionality and facilitate development of new features that result in increased value. Telemetry information is transported securely to keep customer data private. Data collected includes general administrative information (such as SD-AVC IP address and telemetry status), cache rules (such as application name, IP addresses, and socket rating), unclassified and generic traffic (such as SSL and HTTP), analytics protocol discovery (such as number of active flows, number of TCP flows, and number of DNS flows), device information (such as deployed engine versions), and protocols information (such as application name and application attributes). Users may opt out of data collection for certain telemetry categories by turning this feature off in the “Settings” tab on the “Cloud Connector” page.

Office 365 Traffic Categories

Cloud Connector receives information from Microsoft about domains and L3/L4 combinations (IP ranges, port, and L4 protocol) used for Office 365 traffic. Microsoft indicates the traffic category (Optimize, Allow, or Default) for each domain and L3/L4 combination. (See Microsoft 365 Network Connectivity Principles.) Cisco SD-AVC identifies traffic from each of the domains and L3/L4 combinations as Office 365 traffic, and assigns it the traffic category provided by Microsoft

You can use the Office 365 traffic category when creating traffic policy, enabling you to apply policy decisions based on Office 365 traffic categorization. Recognizing Office 365 traffic by the L3/L4 combination offers the special advantage of first-packet classification, allowing traffic policy to be applied from the first packet of a flow.

Device requirement: To use Office 365 categories, devices must be using Cisco IOS XE Amsterdam 17.3.1 or later.

Policy example using Office 365 traffic categories: The following policy, configured on a device in the network, uses Office 365 traffic categories optimize and allow.

class-map match-any optimize
match traffic-category optimize
class-map match-all allow
match traffic-category allow
!
policy-map type epbr epbr-policy-return
parameter default flow-stickness
class optimize
   set ipv4 vrf traffic next-hop 10.0.0.254
class allow
   set ipv4 vrf traffic next-hop 10.0.0.254


interface GigabitEthernet0/0/1
service-policy type epbr input epbr-policy

Prerequisites

• Cloud server domain access

  The device hosting the SD-AVC network service requires access to the following Cisco SD-AVC cloud server domains:

  • api.cisco.com
  • cloudsso.cisco.com
  • prod.sdavc-cloud-api.com

  Ensure that:

  • The host device's access to these domains is not blocked by a firewall.

  • If a proxy server is required, configure the server from the SD-AVC Dashboard, using Serviceability > Proxy Settings.

Procedure

1. In the SD-AVC Dashboard, open the Cloud Connector page.

2. On the Cloud Connector page, click Settings. A pop-up displays connection information.

3. In the pop-up, click the Cisco API Console link. The Cisco API Console page opens in a browser.

   Note	Procedure details in the Cisco API Console are subject to change.

4. On the Cisco API Console page, sign in using your Cisco credentials.

   Note	(The steps on the Cisco API Console page are subject to change.)

5. On the Cisco API Console page, open the My Apps & Keys tab. A page opens for registering a new application.

6. Register SD-AVC.

   1. Name of your application:

      Use any descriptive name. Save this name for a later step.

   2. In the Application Type area, click Service.

   3. In the Grant Type area, check the Client Credentials check box.

   4. Check the Hello API check box.

   5. In the Terms of Service section, check the check box to agree with the terms.

   6. Click Register. The Cisco API Console page displays the Client ID and Client Secret details. Keep this page open to complete the procedure.

7. In the SD-AVC Dashboard, complete the activation process in the open pop-up.

   1. Enter the Client ID and Client Secret details from the Cisco API Console page.

      Note	These credentials expire after 90 days.

   2. For Organization Name, use the descriptive name that you entered on the Cisco API Console page in the “Name of your application” field.

   3. (Optional) Click Change Data Store Location, and select a region. This determines where your telemetry data is stored. For organizations located in Europe, it is recommended to change the location to Europe, in accordance with EU General Data Protection Regulation (GDPR) regulations.

   4. Wait for the Cisco Console API to propagate your credential information in the system. This may take a few minutes.

   5. Click Authenticate. The pop-up closes.

When this process is complete, the Cloud Connector page shows the external sources enabled: Cloud Updates and MS Office 365 Web Service. When enabled, the box for an external source shows a View Details button. For either of these sources, click View Details to show details of the network traffic classification affected.

Note	After enabling Cloud Connector, there may be a delay of several minutes before any details are displayed by theView Details button.

On the Application Visibility page, the Cloud Connector pane shows a green indicator when Cloud Connector is enabled.

Use Case

A use case for limiting the Microsoft Office 365 servers sent to devices is to enable you to create a traffic policy that affects only Microsoft Office 365 traffic meeting both of the following conditions:

• The traffic is categorized by Microsoft as Optimize.

• The traffic connects to a Microsoft server within a specific subset of service instances.

For example, an organization might need to configure a traffic policy that applies only to Microsoft Office 365 traffic that is categorized as Optimize, and that uses USGovGCCHigh and USGovDoD-compliant service instances. The organization might configure this traffic policy to bypass a firewall used for other traffic, in order to provide better performance for this select Optimize-type traffic. For their network that employs SD-AVC, the organization can do the following:

• Use the procedure described below to limit the Microsoft Office 365 servers to USGovGCCHigh and USGovDoD service instances.

• Define a traffic policy for the network that matches the Optimize category for Microsoft Office 365 traffic. The action for this policy might be to direct only this traffic to a specific proxy server that bypasses a firewall, to provide better performance. The traffic policy does not match any other network traffic, including Microsoft Office 365 traffic categorized as Allow or Default. It also does not match any Microsoft Office 365 traffic that connects to Microsoft servers outside of the USGovGCCHigh and USGovDoD service instances.

Prerequisites

Use this procedure before enabling the cloud connector. See Enable the Cloud Connector.

Procedure

1. Verify that the cloud connector has not yet been enabled.

   See Enable the Cloud Connector.

   Note	If you enable the cloud connector before configuring the specific geographic regions you want to include, the SD-AVC network service may already have sent the full domain list to devices in the network.

2. Disable the Microsoft Office365 Service option.

   See Enable or Disable Sending Microsoft 365 Server Information to Devices in the Network.

3. In the SD-AVC dashboard, click Cloud Connector.

   The MS Office 365 Web Service is disabled, indicating that the SD-AVC network service is not connected to the MS Office 365 Web Service.

4. In the MS Office 365 Web Service pane, click Select Service Instance.

5. Select service instance regions to include Microsoft Office 365 server domains in those regions, and click Apply.

6. To enable the service, click the toggle in the MS Office 365 Web Service pane.

   The SD-AVC network service sends a list of Microsoft Office 365 server domains, filtered according to your selections, to the devices in the network.

   Note	Within several minutes, the updated list of server domains replaces any list previously sent to the devices.

Adding DNS Servers

If you need to add additional DNS servers, configure them on the platform hosting the SD-AVC network service, using the ip name-server command, before installing the network service.

Example (adds two DNS servers):

(config)#ip name-server 198.51.100.1 198.51.100.2

Viewing DNS Servers

To view the configured DNS servers, open the SD-AVC Dashboard > Serviceability page > System pane.