Step 1

Have a valid AWS account.

Step 2

Have a valid AWS Government account for GovCloud access.

Step 3

Subscribe to the Cisco CSR1000V, Cisco Catalyst 8000V devices Amazon machine image (AMI) in your account within the AWS Marketplace. To subscribe to Amazon machine image (AMI) in your account within the AWS Marketplace:

1. Log in to Amazon Web Services Marketplace.

2. Search AWS Marketplace for: “Cisco CSR1000V or Cisco Catalyst 8000V devices”.

   A list of AMIs appears.

3. From the list, click the Cisco CSR1000V or Cisco Catalyst 8000V devices link that you’re planning to deploy.

   The subscription screen appears where you can subscribe to the Cisco CSR1000V or Cisco Catalyst 8000V devices AMI.

4. Click Continue to Subscribe.

5. Click Accept Terms.

   After a few moments, a message appears that you’re subscribed to use the Cisco CSR1000V or Cisco Catalyst 8000V devices AMI.

   Note	Don’t click Continue to Configuration, because Cisco Catalyst SD-WAN Cloud OnRamp for IaaS automatically configures the Cisco Catalyst SD-WAN cloud devices when it creates the transit VPC.

6. Log out of from the AWS Marketplace.

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for IaaS.

Step 2

Click Add New Cloud Instance.

Step 3

Click the Amazon Web Services (AWS) radio button.

Step 4

In the next pop-up window, perform the following:

1. To log in to the cloud server, click IAM Role or Key. We recommend that you use IAM Role.

2. If you click IAM Role, then create an IAM role with Cisco SD-WAN Manager provided External ID. Note the displayed external Id from the window and provide the Role ARN value that is available when creating an IAM role.

   Starting from Cisco IOS XE Catalyst SD-WAN Release 17.4.1a, to create an IAM role, you must enter the Cisco SD-WAN Manager provided External Id into a policy by using the AWS Management Console. Do the following:

   1. Attach an IAM Role to an existing Cisco SD-WAN Manager EC2 instance.

      1. See the Creating an IAM role (console) topic of AWS documentation to create a policy. In the AWS Create policy wizard, click JSON and enter the following JSON policy document.

         {
           
"Version": "2012-10-17",

           "Statement": [{

             "Sid": "VisualEditor0",
             
"Effect": "Allow",

             "Action": "sts:AssumeRole",
             
"Resource": "*"

             }
]
         
}

         

      2. See the Easily Replace or Attach an IAM Role to an Existing EC2 Instance by Using the EC2 Console blog of AWS Security Blog for information about creating an IAM role and attaching it to the Cisco SD-WAN Manager EC2 instance based on the policy created in Step 1.

         Note	On the Attach permissions policy window, choose the AWS-managed policy that you created in Step 1.

   2. Create an IAM role on an AWS account that you want to use for Cisco Catalyst SD-WAN Cloud OnRamp for IaaS.

      1. See the Creating an IAM role (console) topic of AWS Documentation and create an IAM role by checking Require external ID and pasting the external Id that you noted in Step 4(b).

      2. See the Modifying a role trust policy (console) topic of AWS Documentation to change who can assume a role.

         In the IAM Roles window, scroll down and click the role you created in the previous step.

         In the Summary window, note the Role ARN.

         Note	You can enter this role ARN value when you choose the IAM role in Step 4(b).

      3. After modifying the trust relationship, click JSON and enter the following JSON document. Save the changes.

         Note	The account Id in the following JSON document is the Cisco SD-WAN Manager EC2 instance.

         {
           "Version": "2012-10-17",
           "Statement": [
             {
               "Effect": "Allow",
               "Principal": {
                 "AWS": "arn:aws:iam::[Account ID from Part 1]:root"
               },
               "Action": "sts:AssumeRole",
               "Condition": {
                 "StringEquals": {
                   "sts:ExternalId": "[vManage provided External ID]"
                }
               }
             }
           ]
         }
         

3. If you click the Key radio button:

   1. In the API Key field, enter your Amazon API key.

   2. In the Secret Key field, enter the password associated with the API key.

   3. From the Environment drop-down list, choose commercial or govcloud.

      By default, commercial environment is selected. You can choose the geographical regions based on the environment specifications.

Step 5

Click Login to log in to the cloud server.

Step 6

Select a region:

Step 7

Add a transit VPC:

1. In the Transit VPC Name field, enter the transit VPC name.

   The name can contain 128 alphanumeric characters, hyphens (–), and underscores (_). It can’t contain spaces or any other characters.

2. Under Device Information, enter information about the transit VPC:

   1. In the WAN Edge Version drop-down list, choose the software version of the Cisco Catalyst SD-WAN cloud device to run on the transit VPC.

   2. In the Size of Transit WAN Edge drop-down list, choose an option to determine the memory and CPUs you can use for each of the Cisco Catalyst SD-WAN cloud devices that run on the transit VPC.

      • See the Supported Instance Types topic for Cisco CSR1000V devices of the Cisco CSR 1000v Series Cloud Services Router Deployment Guide for Amazon Web Services.

      • See the Supported Instance Types topic for Cisco Catalyst 8000V in the Deploying Cisco Catalyst 8000V on Amazon Web Services.

      Note	We recommend that you choose the following size: For Cisco CSR1000V and Cisco Catalyst 8000V, choose c5 instance type with four or more than four vCPUs, such as c5.xlarge (4 vCPU).

   3. In the Max. Host VPCs per Device Pair field, select the maximum number of host VPCs that can be mapped to each device pair for the transit VPC. Valid values are 1–32.

   4. To set up the transit VPC devices for Direct Internet Access (DIA), click one of the following:

      • Disabled: No Internet access.

      • Enabled via Transport: Configure or enable NAT for the WAN interface on a device.

      • Enabled via Umbrella SIG: Configure Cisco Umbrella to enable secure DIA on a device.

   5. In the Device Pair 1# field, choose the serial numbers of each device in the pair. To remove a device serial number, click X that appears in the field.

      The serial numbers of the devices that appear are associated with a configuration template and supports the Cisco Catalyst SD-WAN WAN edge version that you selected in Step 1.

   6. To add more device pairs, click .

      To remove a device pair, click .

      A transit VPC can be associated with one to four device pairs. To enable the autoscale feature on AWS, associate at least two device pairs with the transit VPC.

   7. Click Advanced, if you wish to enter more specific configuration options:

      1. In the Transit VPC CIDR field, enter a custom CIDR that has a network mask in the range of 16–25. If you choose to leave this field empty, the Transit VPC is created with a default CIDR of 10.0.0.0/16. There must be sufficient address space to create six subnets within the CIDR block.

      2. (Optional) In the SSH PEM Key drop-down list, choose a PEM key pair to log into an instance. The key pairs are region-specific. See the AWS Documentation for instructions about creating key pairs.

   8. To complete the transit VPC configuration, click Save and Finish, or optionally to continue with the wizard, click Proceed to Discovery and Mapping.

      With this cloud instance, a single transit VPC with two Cisco Catalyst SD-WAN cloud devices has been created. You can configure multiple transit VPCs within a single cloud instance (AWS account within a region). When multiple transit VPCs exist within a cloud instance, you can map host VPCs to any one of the transit VPCs.

   9. Discover host VPCs:

      1. In the Select an account to discover field, choose the AWS account from which you wish to discover host VPCs.

         Alternatively, to add a new AWS account from which you wish to discover host VPCs, click New Account.

      2. Click Discover Host VPCs.

         A table appears that display the VPCs, which are available to be mapped to a transit VPC. Only the host VPCs in the selected AWS account and within the same AWS region as the transit VPC appears.

      3. In the table that appears, check one or more hosts to map to the transit VPC.

         To filter the search results, use the Filter option in the search bar and display only host VPCs that match specific search criteria.

         Click the Refresh icon to update the table with current information.

         Click the Show Table Columns icon to specify which columns to be displayed in the table.

   10. Map the host VPCs to a transit VPC:

       1. In the table with all host VPCs, choose the desired host VPCs.

       2. Click Map VPCs. The Map Host VPCs pop-up opens.

       3. In the Transit VPC drop-down list, choose the transit VPC to map to the host VPCs.

       4. In the VPN drop-down list, choose a service VPN in the overlay network in which to place the mapping.

       5. Enable the Route Propagation option if Cisco SD-WAN Manager automatically propagates route to the host VPC routes table.

          By default, Route Propagation is disabled.

       6. Click Map VPCs.

   After a few minutes, the Task View screen appears, confirming that the host VPC has been mapped to the transit VPC.

Step 1

From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for IaaS.

Step 2

Click Add New Cloud Instance

Step 3

Click the Microsoft Azure radio button.

Step 4

In the next pop-up screen, perform the following:

1. In the Subscription ID field, enter the ID of the Microsoft Azure subscription you want to use as part of the Cisco Catalyst SD-WAN Cloud OnRamp for IaaS workflow.

2. In the Client ID field, enter the ID of an existing application or create a new application. To create an application, go to your Azure Active Directory > App Registrations > New registration. See Microsoft Azure documentation for more information on creating an application.

3. In the Tenant ID field, enter the ID of your account. To find the tenant ID, go to your Microsoft Azure Active Directory and click Properties.

4. In the Secret Key field, enter the password associated with the client ID.

5. In the Environment field, choose commercial or GovCloud.

   By default, commercial environment is selected. You can choose the geographical locations based on the environment specifications.

6. Click Login.

Step 5

From the Choose Location drop-down list, choose a location where you want to create the transit VNet.

Step 6

Add a transit VNet:

1. In the Transit VNet Name field, type a name for the transit VNet.

   The name can contain 32 alphanumeric characters, hyphens (–), and underscore (_). It can't contain spaces or any other characters.

2. Under Device Information, enter information about the transit VNet:

   1. In the WAN Edge Version drop-down list, choose the software version to run on the transit VNet. The drop-down list includes the published versions of the device software in the Microsoft Azure marketplace.

   2. In the Size of Transit WAN Edge drop-down list, choose an option to determine the memory and CPUs you can use for each of theCisco Catalyst SD-WAN cloud devices that run on the transit VNet.

      • See Supported Instance Types for Cisco CSR1000V in the Cisco CSR 1000v Deployment Guide for Microsoft Azure.

      • See Supported Instance Types for Cisco Catalyst 8000V in the Deploying Cisco Catalyst 8000V on Microsoft Azure.

      Note	We recommend that you choose the following size: For Cisco CSR1000V and Cisco Catalyst 8000V, choose DS3 instance type with four or more than four vCPUs such as, Standard DS3 v2 (4vCPU).

   3. To set up the transit VNet devices for Direct Internet Access (DIA), click one of the following:

      • Disabled: No Internet access.

      • Enabled via Transport: Configure or enable NAT for the WAN interface on a device.

      • Enabled via Umbrella SIG: Configure Cisco Umbrella to enable secure DIA on a device.

   4. In the Device 1 drop-down list, choose the serial number of the first device.

   5. In the Device 2 drop-down list, choose the serial number of the second device in the device pair.

   6. Click Advanced if you wish to enter more specific configuration options.

   7. In the Transit VNet CIDR field, enter a custom CIDR that has a network mask in the range of 16–25. If you leave this field empty, the Transit VNet is created with a default CIDR of 10.0.0.0/16.

3. To complete the transit VNet configuration. click Save and Finish, or optionally to continue with the wizard, click Proceed to Discovery and Mapping.

Step 7

Map host VNets to transit VNets:

1. In the Select an account to discover drop-down list, choose your Azure subscription ID.

   Alternatively, to add a new Azure account from which you wish to discover host VNets, click New Account.

2. Click Discover Host VNets.

3. In the Select a VNet drop-down list, choose a desired host VNet.

4. Click Next.

5. From the table of host VNets, choose a desired host VNet.

6. Click Map VNets. The Map Host VNets pop-up appears.

7. In the Transit VNet drop-down list, choose the transit VNet to map to the host VNets.

8. In the VPN drop-down list, choose a VPN in the overlay network in which to place the mapping.

9. In the IPSec Tunnel CIDR section, to configure IPSec tunnels to reach the Azure virtual network transit, enter two pairs of interface IP addresses and a pair of loopback IP addresses for each of the Cisco CSR1000V or Cisco Catalyst 8000V devices . Ensure that the IP addresses are network addresses in the /30 subnet, unique across the overlay network, and they aren’t part of the host VNet CIDR. If they are part of the host VNet CIDR, Microsoft Azure returns an error when attempting to create VPN connections to the transit VNet.

   Note	The IP addresses aren’t part of the host VNet and Transit VPC CIDR.

   Microsoft Azure supports single Virtual Private Gateway (VGW) configuration over IPSec tunnels with redundancy provided over a single tunnel. Therefore, Cisco Catalyst SD-WAN Cloud OnRamp for IaaS supports two VGWs for redundancy. During a planned maintenance or an unplanned event of a VGW, the IPSec tunnel from the VGW to the cloud devices get disconnected. This loss of connectivity causes the cloud devices lose BGP peering with Cisco SD-WAN Manager over IPSec tunnel. To enable BGP peering with the cloud routers rather than the IP address of the IPSec tunnel, provide the loopback addresses for each cloud device.

   Note	The loopback option for BGP peering supports single and multiple Virtual Gateways, or Customer Gateway configuration or both on Azure cloud. The loopback option applies only to the new host VNets mapped to transit VNets and not on the existing VNets.

10. In the Azure Information section:

    1. In the BGP ASN field, enter the ASN that you configure on the Azure Virtual Network Gateway, which is brought up within the host VNet. Use an ASN that isn’t part of an existing configuration on Azure. For acceptable ASN values, refer to Microsoft Azure documentation.

    2. In the Host VNet Gateway Subnet field, enter a host VNet subnet in which the Virtual Network Gateway can reside. We recommend you use a /28 subnet or higher. Ensure not to provide a subnet that is already created in the VNet.

       Note	Ensure that there’s an unused CIDR inside the host VNet CIDR.

11. Click Map VNets.

12. Click Save and Complete.