Before you can generate a Certificate Signing Request (CSR), you must configure the name of your organization. The organization name is included in the CSR.

In public key infrastructure (PKI) systems, a CSR is sent to a certificate authority to apply for a digital identity certificate.

To configure the organization name:

1. Click the Edit button to the right of the Organization Name bar.

2. In the Organization Name field, enter the name of your organization. The organization name must be identical to the name that is configured on the vBond orchestrator.

3. In the Confirm Organization Name field, re-enter and confirm your organization name.

4. Click Save.

Note that once the control connections are up and running, the organization name bar is no longer editable.

1. Click the Edit button to the right of the vBond bar.

2. In the vBond DNS/IP Address: Port field, enter the DNS name that points to the vBond orchestrator or the IP address of the Cisco vBond orchestrator and the port number to use to connect to it.

3. Click Save.

Signed certificates are used to authenticate devices in the overlay network. Once authenticated, devices can establish secure sessions between each other. It is from the Cisco vManage that you generate these certificates and install them on the controller devices—Cisco vBond orchestrators,Cisco vManage, and Cisco vSmart controllers. You can use certificates signed by Symantec, or you can use enterprise root certificates.

The controller certification authorization settings establish how the certification generation for all controller devices will be done. They do not generate the certificates.

You need to select the certificate-generation method only once. The method you select is automatically used each time you add a device to the overlay network.

To have the Symantec signing server automatically generate, sign, and install certificates on each controller device:

1. Click the Edit button to the right of the Controller Certificate Authorization bar.

2. Click Symantec Automated (Recommended). This is the recommended method for handling controller signed certificates.

3. In the Confirm Certificate Authorization Change popup, click Proceed to confirm that you wish to have the Symantec signing server automatically generate, sign, and install certificates on each controller device.

4. Enter the first and last name of the requestor of the certificate.

5. Enter the email address of the requestor of the certificate. This address is required because the signed certificate and a confirmation email are sent to the requestor via email; they are also made available though the customer portal.

6. Specify the validity period for the certificate. It can be 1, 2, or 3 years.

7. Enter a challenge phrase.The challenge phrase is your certificate password and is required when you renew or revoke a certificate.

8. Confirm your challenge phrase.

9. In the Certificate Retrieve Interval field, specify how often the Cisco vManage server checks if the Symantec signing server has sent the certificate.

10. Click Save.

To manually install certificates that the Symantec signing server has generated and signed:

1. Click the Edit button to the right of the Controller Certificate Authorization bar.

2. Click Symantec Manual.

3. In the Confirm Certificate Authorization Change popup, click Proceed to manually install certificates that the Symantec signing server has generated and signed.

4. Click Save.

To use enterprise root certificates:

1. Click the Edit button to the right of the Controller Certificate Authorization bar.

2. Click Enterprise Root Certificate.

3. In the Confirm Certificate Authorization Change popup, click Proceed to confirm that you wish to use enterprise root certificates.

4. In the Certificate box, either paste the certificate, or click Select a file and upload a file that contains the enterprise root certificate.

5. By default, the enterprise root certificate has the following properties: To view this information, issue the show certificate signing-request decoded command on a controller device, and check the output in the Subject line. For example:

   • Country: United States

   • State: California

   • City: San Jose

   • Organizational unit: ENB

   • Organization: CISCO

   • Domain Name: cisco.com

   • Email: cisco-cloudops-sdwan@cisco.com

   vSmart# show certificate signing-request decoded
       ...
       Subject: C=US, ST=California, L=San Jose, OU=ENB, O=CISCO, CN=vsmart-uuid .cisco.com/emailAddress=cisco-cloudops-sdwan@cisco.com 
       ...
      

   To change one or more of the default CSR properties:

   1. Click Set CSR Properties.

   2. Enter the domain name to include in the CSR. This domain name is appended to the certificate number (CN).

   3. Enter the organizational unit (OU) to include in the CSR.

   4. Enter the organization (O) to include in the CSR.

   5. Enter the city (L), state (ST), and two-letter country code (C) to include in the CSR.

   6. Enter the email address (emailAddress) of the certificate requestor.

   7. Specify the validity period for the certificate. It can be 1, 2, or 3 years.

6. Click Import & Save.

If you are using the Cisco SD-WAN hosted service, you can enforce a version of the Cisco SD-WAN software to run on a router when it first joins the overlay network. To do so:

1. Ensure that the software image for the desired device software version is present in the vManage software image repository:

   1. In Cisco vManage, select the Maintenance > Software Repository screen.

      The Software Repository screen opens and displays a table of software images. If the desired software image is present in the repository, continue with Step 2.

   2. If you need to add a software image, click Add New Software.

   3. Select the location from which to download the software images, either Cisco vManage, Remote Server, or Remote Server - vManage.

   4. Select an x86-based or a MIPS-based software image.

   5. Click Add to play the image in the repository.

2. In the Administration > Settings screen, click the Edit button to the right of the Enforce Software Version (ZTP) bar.

3. In the Enforce Software Version field, click Enabled.

4. From the Version drop-down, select the version of the software to enforce on the device when they join the network.

5. Click Save.

If you enable this feature on the Cisco vManage, any device joining the network is configured with the version of the software specified in the Enforce Software Version field regardless of whether the device was running a higher or lower version of Cisco SD-WAN software.

Use the Banner template for Cisco vBond Orchestrators, Cisco vManages, Cisco vSmart Controllers, s, and Cisco IOS XE SD-WAN devices.

• To configure the banner text for login screens using Cisco vManage templates, create a Banner feature template to configure PIM parameters, as described in this topic.

• To configure a login banner for the Cisco vManage system, go to Administration > Settings.​

Configure a Banner

1. In Cisco vManage, select the Configuration > Templates screen.

2. In the Device tab, click Create Template.

3. From the Create Template drop-down, select From Feature Template.

4. From the Device Model drop-down, select the type of device for which you are creating the template.

5. Click the Additional Templates tab located directly beneath the Description field, or scroll to the Additional Templates section.

6. From the Banner drop-down, click Create Template. The Banner template form is displayed. The top of the form contains fields for naming the template, and the bottom contains fields for defining Banner parameters.

7. In the Template Name field, enter a name for the template. The name can be up to 128 characters and can contain only alphanumeric characters.

8. In the Template Description field, enter a description of the template. The description can be up to 2048 characters and can contain only alphanumeric characters.

   When you first open a feature template, for each parameter that has a default value, the scope is set to Default (indicated by a check mark), and the default setting or value is shown. To change the default or to enter a value, click the Scope drop-down to the left of the parameter field.

9. To set a banner, configure the following parameters:

   Table 1. Parameters to be configured while setting a banner:

   Parameter Name	Description
   MOTD Banner	On a Cisco IOS XE SD-WAN device enter message-of-the-day text to display prior to the login banner. The string can be up to 2048 characters long. To insert a line break, type \n.
   Login Banner	Enter text to display before the login prompt. The string can be up to 2048 characters long. To insert a line break, type \n.

10. To save the feature template, click Save.

CLI equivalent:

banner{login login-string | motd motd-string}

To create a custom banner that is displayed after you log in to the Cisco vManage:

1. Click the Edit button to the right of the Banner bar.

2. In the Enable Banner field, click Enabled.

3. In the Banner Info text box, enter the text string for the login banner or click Select a File to download a file that contains the text string.

4. Click Save.

To enable or disable the collection of statistics for devices in the overlay network:

1. Click the Edit button to the right of the Statistics Settings bar. By default, all statistics collection settings are enabled for all Cisco SD-WAN devices.

2. To set statistics collection parameters for all devices in the network, click Disable All for the parameter you wish to disable statistics collection for. To return to the saved settings during an edit operation, click Reset. To return the saved settings to the factory-default settings, click Restore Factory Default

3. To set statistics collection parameters for individual devices in the network, click Custom to select devices on which to enable or disable statistics collection. The Select Devices popup screen opens listing the hostname and device IP of all devices in the network. Select one or more devices from the Enabled Devices column on the left and click the arrow pointing right to move the device to the Disabled Devices column on the right. To move devices from the Disabled Devices to the Enabled Devices column, select one or more devices and click the arrow pointing left. To select all devices in the Select Devices popup screen, click the Select All checkbox in either window. Click Done when all selections are made.

4. Click Save.