Or

Pre-requisities:

• Log into the device using the username and password (admin/admin).

• At the command prompt, configure the license boot level network-advantage addon dna-advantage command.

• Save the configuration and reboot the device. Ensure that the device is in-sync under Configuration Devices in Cisco SD-WAN Manager.

• Device Status - The status of the device should be In Sync

• Managed By - The respective SD-Routing Config Group created in Step 4a.

This example shows the minimum CLIs for the Config Group.

Configurations:
==============
sd-routing
organization-name CSRQA20231024
site-id 1
system-ip 4.7.8.9
vbond ip 44.226.182.48
vbond port 12346
wan-interface GigabitEthernet1
!
interface GigabitEthernet1
no shutdown
negotiation auto
ip address dhcp
exit
interface GigabitEthernet2
no shutdown
negotiation auto
ip address dhcp
exit

ip domain lookup

license boot level network-advantage addon dna-advantage
no logging console

• Device Status - The status of the device should be In Sync

• Managed By - The respective SD-Routing Config Group created in Step 1.

Choose the authentication model you want to use in the field Login in to AWS With.

• Key

• IAM Role

If you choose the Key model, then provide API Key and Secret Key in the respective fileds.

If you choose the IAM Role model, then create an IAM role with Cisco SD-WAN Manager provided External ID. Note the displayed external Id from the window and provide the Role ARN value that is available when creating an IAM role.

Starting from Cisco IOS XE Catalyst SD-WAN Release 17.4.1a, to create an IAM role, you must enter the External Id provided by Cisco SD-WAN Manager into a policy by using the AWS Management Console. Do the following:

1. Attach an IAM Role to an existing Cisco SD-WAN Manager EC2 instance.

   1. See the Creating an IAM role (console) topic of AWS documentation to create a policy. In the AWS Create policy wizard, click JSON and enter the following JSON policy document.

      {
        
"Version": "2012-10-17",

        "Statement": [{

          "Sid": "VisualEditor0",
          
"Effect": "Allow",

          "Action": "sts:AssumeRole",
          
"Resource": "*"

          }
]
      
}

      

   2. See the Easily Replace or Attach an IAM Role to an Existing EC2 Instance by Using the EC2 Console blog of AWS Security Blog for information about creating an IAM role and attaching it to the Cisco SD-WAN Manager EC2 instance based on the policy created in Step 1.

      Note	On the Attach permissions policy window, choose the AWS managed policy that you created in Step 1.

      Note	The following set of permissions are allowed: AmazonEC2FullAccess IAMReadOnlyAccess AWSNetworkManagerFullAccess AWSResourceAccessManagerFullAccess For more information on creating an AWS IAM Role, refer Creating an AWS IAM Role.

2. Create an IAM role on an AWS account that you want to use for the multicloud environment.

   1. See the Creating an IAM role (console) topic of AWS Documentation and create an IAM role by checking Require external ID and pasting the external Id that you noted in Step 2.

   2. See the Modifying a role trust policy (console) topic of AWS Documentation to change who can assume a role.

      In the IAM Roles window, scroll down and click the role you created in the previous step.

      In the Summary window, note the Role ARN that is displayed at the top.

      Note	You can enter this role ARN value when you choose the authentication model as IAM role in Step 7.

   3. After modifying the trust relationship, click JSON and enter the following JSON document. Save the changes.

      Note	The account Id in the following JSON document belongs to the Cisco SD-WAN Manager EC2 instance.

      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "AWS": "arn:aws:iam::[Account ID from Part 1]:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
              "StringEquals": {
                "sts:ExternalId": "[vManage provided External ID]"
             }
            }
          }
        ]
      }
      

• Transit Gateway–Branch-connect—Allows connectivity of different SD-Routing devices to VPCs in the cloud through the transit gateway that is instantiated in the AWS cloud. This option uses the AWS VPN connection (IPSec) approach.

If you the enable periodic audit, Cisco SD-WAN Manager triggers an automatic audit every two hours. This automatic audit takes place in the background, and a discrepancies report is generated.

The host VPC table includes the following columns:

• Cloud Region

• Account Name

• Host VPC Name

• Host VPC Tag

• Account ID

• Host VPC ID

Click a column to sort the VPCs, as required.

• Add Tag - group the selected VPCs and tag them together.

• Edit Tag - migrate the selected VPCs from one tag to another.

• Delete Tag - remove the tag for the selected VPCs.

A number of host VPCs can be grouped under a tag. All VPCs under the same tag are considered as a singular unit.

For each of the cloud gateways, you can view, delete, or attach more sites.

The Are you sure you want to detach sites from cloud gateway? window appears.

The sites attached to a cloud gateway are detached.