The edge devices connect to the host VPCs in the cloud over secure point-to-point tunnels. IPSec tunnels are set up between edge devices and the AWS Transit Gateway. These tunnels carry the branch VPNs traffic and BGP routing traffic. Using BGP, the devices and the transit gateway exchange the routing information and build routing tables.

A branch device can have any number of VPNs that require connectivity to the host VPCs. Each of these VPNs is represented as a VPN attachment to the transit gateway. As part of the VPN attachment, AWS customer gateway and VPN gateway cloud objects are created, which allow VPN connectivity from the branch device to the transit gateway. The transit gateway and the branch devices of a given site are in different BGP ASNs. The mapping information of VPNs to the tags (host VPCs) is derived from the global mapping. This mapping is realized in the cloud.

When you configure a new service VPN in a branch device template, an update event is generated, which triggers mapping based on the connectivity matrix. Similarly, when you remove a service VPN from the device template, another update event is generated, which triggers unmapping.

Note

The number of branch edge WAN interfaces need to be proportional to the number of regions that the branch edge device needs to connect to. For example, if a branch needs to connect to hosts in two AWS regions, you need one WAN interface attached to each of the cloud gateway in that region. The WAN interfaces within a branch cannot have the same color.

Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.12.1a and Cisco Catalyst SD-WAN Manager Release 20.12.1

AWS Cloud WAN is a managed WAN service that you can use to build, manage, and monitor a unified global network. You can easily connect and route traffic from different sites and regions over the AWS global network.

AWS Cloud WAN enables you to use simple network policies to configure and secure your network. The network policy is defined and populated in the backend, as you configure AWS integration using Cisco SD-WAN Manager workflows.

Using AWS integration workflows you can create global AWS Cloud WAN network, define different segments and attach different VPCs in different regions to these segments.

(Minimum supported releases: Cisco IOS XE Catalyst SD-WAN Release 17.13.1a and Cisco Catalyst SD-WAN Manager Release 20.13.1) AWS Cloud WAN integration uses BGP-based dymanic routing to route traffic from different sites and regions instead of using static routes. In the AWS integration workflows, the cloud gateways have BGP peering with segments which allow IPSec based connectivity. This adds flexibility and redundancy to the workflows.

Minimum supported release: Cisco IOS XE Catalyst SD-WAN Release 17.14.1a and Cisco Catalyst SD-WAN Manager Release 20.14.1

You can use configuration groups in Cisco SD-WAN Manager to configure devices in AWS integration workflows. The use of same configuration groups between two cloud gateways is not supported.

You can enable configuration of devices using configuration groups in the global settings. When you create a cloud gateway, if you have enabled configuration using configuration groups in the global settings, you can choose an existing configuration group or create a new one. For more information about configuration groups, see Cisco Catalyst SD-WAN Configuration Groups.

Note	After you enable configuration of devices using configuration groups in the global settings, you can configure devices using both templates and configuration groups.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for Multicloud. The Cloud OnRamp for Multicloud dashboard displays.

2. Click Associate Cloud Account in the Setup pane. Note the external Id from the Associate Cloud Account page.

3. In the Cloud Provider field, choose Amazon Web Services from the drop-down list.

4. Enter the account name in the Account Name field.

5. (Optional) Enter the description in the Description field.

6. In Use for Cloud Gateway, choose Yes if you want to create cloud gateway in your account, or choose No.

7. Choose the authentication model you want to use in the field Login in to AWS With.

   • Key

   • IAM Role

   If you choose the Key model, then provide API Key and Secret Key in the respective fileds.

   Or

   If you choose the IAM Role model, then create an IAM role with Cisco SD-WAN Manager provided External ID. Note the displayed external Id from the window and provide the Role ARN value that is available when creating an IAM role.

   Starting from Cisco IOS XE Catalyst SD-WAN Release 17.4.1a, to create an IAM role, you must enter the External Idprovided by Cisco SD-WAN Manager into a policy by using the AWS Management Console. Do the following:

   1. Attach an IAM Role to an existing Cisco SD-WAN Manager EC2 instance.

      1. See the Creating an IAM role (console) topic of AWS documentation to create a policy. In the AWS Create policy wizard, click JSON and enter the following JSON policy document.

         {
           
"Version": "2012-10-17",

           "Statement": [{

             "Sid": "VisualEditor0",
             
"Effect": "Allow",

             "Action": "sts:AssumeRole",
             
"Resource": "*"

             }
]
         
}

         

      2. See the Easily Replace or Attach an IAM Role to an Existing EC2 Instance by Using the EC2 Console blog of AWS Security Blog for information about creating an IAM role and attaching it to the Cisco SD-WAN Manager EC2 instance based on the policy created in Step 1.

         Note	On the Attach permissions policy window, choose the AWS managed policy that you created in Step 1.

         Note	The following set of permissions are allowed: AmazonEC2FullAccess IAMReadOnlyAccess AWSNetworkManagerFullAccess AWSResourceAccessManagerFullAccess For more information on creating an AWS IAM Role, refer Creating an AWS IAM Role.

   2. Create an IAM role on an AWS account that you want to use for the multicloud environment.

      1. See the Creating an IAM role (console) topic of AWS Documentation and create an IAM role by checking Require external ID and pasting the external Id that you noted in Step 2.

      2. See the Modifying a role trust policy (console) topic of AWS Documentation to change who can assume a role.

         In the IAM Roles window, scroll down and click the role you created in the previous step.

         In the Summary window, note the Role ARN that is displayed at the top.

         Note	You can enter this role ARN value when you choose the authentication model as IAM role in Step 7.

      3. After modifying the trust relationship, click JSON and enter the following JSON document. Save the changes.

         Note	The account Id in the following JSON document belongs to the Cisco SD-WAN Manager EC2 instance.

         {
           "Version": "2012-10-17",
           "Statement": [
             {
               "Effect": "Allow",
               "Principal": {
                 "AWS": "arn:aws:iam::[Account ID from Part 1]:root"
               },
               "Action": "sts:AssumeRole",
               "Condition": {
                 "StringEquals": {
                   "sts:ExternalId": "[vManage provided External ID]"
                }
               }
             }
           ]
         }
         

8. Click Add.

To view or update cloud account details, click ... on the Cloud Account Management page.

You can also remove the cloud account if there are no associated host VPC tags or cloud gateways.

Note

During Multicloud resource cleanup process, Cisco SD-WAN Manager compares the current database to running resources in the account with org name and account detail tags. If there are any resources that matches the tags, but not in the current database are deleted. Therefore, the AWS Multicloud resources of Cisco SD-WAN Manager can be deleted by another Cisco SD-WAN Manager, if the organization name and the associated AWS account details are same. We recommend that if you are using the same AWS account across different Cisco SD-WAN Manager overlays, ensure that you use different organization and overlay name for each Cisco SD-WAN Manager.

To configure cloud transit gateway global settings, perform the following steps:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for Multicloud. Click Cloud Global Settings in the Setup pane. The Cloud Global Settings window appears.

2. (Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.14.1)

   Enable the Enable Configuration Group option to use configuration groups to configure devices.

3. In the Cloud Provider field, choose Amazon Web Services.

4. Click Cloud Gateway Solution drop-down list to choose the AWS Transit Gateway and CSR in Transit VPC, or, beginning in Cisco IOS XE Catalyst SD-WAN Release 17.5.1a, one of the following options.

   Beginning in Cisco IOS XE Catalyst SD-WAN Release 17.5.1a, a combination of options is not supported. For example, if there are cloud gateways that were created using VPN connections, you must delete these cloud gateways before you can create AWS Transit Gateway Connect connections.

   • Transit Gateway–VPN based (using TVPC)—Allows connectivity of the cloud gateway to the VPCs in the cloud through the transit gateway that is instantiated in the AWS cloud. The cloud gateway consists of a pair of cloud services routers that are instantiated within a transit VPC. This option uses the AWS VPN connection (IPSec) approach.

   • Transit Gateway–Connect based (using TVPC)—Allows connectivity of the cloud gateway to the VPCs in the cloud through the transit gateway that is instantiated in the AWS cloud. The cloud gateway consists of a pair of cloud services routers that are instantiated within a transit VPC. This option uses the AWS TGW Connect (GRE tunnels) approach.

   • Transit Gateway–Branch-connect—Allows connectivity of different Cisco Catalyst SD-WAN edge devices to VPCs in the cloud through the transit gateway that is instantiated in the AWS cloud. This option uses the AWS VPN connection (IPSec) approach.

   • (Minimum supported releases: Cisco Catalyst SD-WAN Manager Release 20.12.1)

     Cloud WAN–VPN based (using TVPC)—Allows connectivity of the cloud gateway to the VPCs in the cloud through AWS Cloud Wan. The cloud gateway consists of a pair of cloud services routers that are instantiated within a transit VPC. This option uses the AWS VPN connection (IPSec) approach.

   • (Minimum supported releases: Cisco Catalyst SD-WAN Manager Release 20.12.1)

     Cloud WAN–Connect based (using TVPC)—Allows connectivity of the cloud gateway to the VPCs in the cloud through AWS Cloud Wan. The cloud gateway consists of a pair of cloud services routers that are instantiated within a transit VPC. This option uses the AWS Connect attachments (supporting GRE tunnels) approach.

5. Beginning with Cisco vManage Release 20.8.1, the following fields are available:

   • Click the Reference Account Name drop-down list to choose the reference account name. Cisco SD-WAN Manager discovers the software images and instance sizes using this reference account name.

     Note	You can still choose a different account, if required, at the time of a cloud gateway creation.

   • Click the Reference Region drop-down list to choose the reference region. Cisco SD-WAN Manager discovers the software images and instance sizes in this reference region under the referenced account name.

6. In the Software Image field, do the following:

   1. Click BYOL to use a bring your own license software image or PAYG to use a pay as you go software image.

   2. From the drop-down list, select a software image.

7. Click the Instance Size drop-down list to choose the required size.

8. Enter the IP Subnet Pool.

9. Enter the Cloud Gateway BGP ASN Offset.

10. Choose the Intra Tag Communication. The options are Enabled or Disabled.

11. Choose the Default Route. The options are Enabled or Disabled.

12. Click Update.

Global IP Subnet Pool – can only be updated if there is no cloud gateway using global subnet pool. A cloud gateway uses global subnet pool whether it has custom setting or not. The subnet pool value is similar to the one in global setting (you can compare after splitting the list of CIDRs by comma; for example, 10.0.0.0/8, 10.255.255.254/8 and 10.255.255.254/8, 10.0.0.0/8 are similar).

If there is no cloud gateway using global subnet pool, the updated subnet pool in the global setting should not overlap with any of the existing custom subnet pools.

Custom IP Subnet Pool – when a custom setting is created, its subnet pool should not overlap with any of the existing custom subnet pools. It cannot partially overlap with the configured global subnet pool.

You can discover host VPCs in all the accounts across all the respective regions of the account that are available. When the Host VPC Discovery is invoked, the discovery of the VPCs is performed without any cache.

1. From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for Multicloud. Click Host Private Networks under Discover. The Discover Host Private Networks window appears with the list of available VPCs.

   The host VPC table includes the following columns:

   • Cloud Region

   • Account Name

   • Host VPC Name

   • Host VPC Tag

   • Account ID

   • Host VPC ID

   Click a column to sort the VPCs, as required.

2. Click the Region drop-down list to select the VPCs based on particular region.

3. Click Tag Actions to perform the following actions:

   • Add Tag - group the selected VPCs and tag them together.

   • Edit Tag - migrate the selected VPCs from one tag to another.

   • Delete Tag - remove the tag for the selected VPCs.

   A number of host VPCs can be grouped under a tag. All VPCs under the same tag are considered as a singular unit. A tag ensures connectivity and is essential to view the VPCs in Intent Management.

Cloud gateway is an instantiation of Transit VPC (TVPC), CSRs within TVPC and transit gateway in the cloud. To create a cloud gateway, perform the following steps.

Note	Before beginning this procedure, ensure that you have two devices with templates attached, which have the same type of license (BYOL or PAYG).

1. From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for Multicloud. Click Create Cloud Gateway under Manage. The Manage Cloud Gateway - Create window appears.

2. In the Cloud Provider field, choose Amazon Web Services from the drop-down list.

3. In the Cloud Gateway Name field, enter the cloud gateway name.

4. (Optional) In the Description, enter the description.

5. Choose the account name from the Account Name drop-down list.

6. Choose the region from the Region drop-down list.

7. (Optional) Choose the SSH Key from the drop-down list.

8. (Minimum release: Cisco vManage Release 20.10.1) From the Site Name drop-down list, choose a site for which you want to create the cloud gateway.

9. In the Software Image field, do the following:

   1. Choose a licensing option: BYOL for bring your own license or PAYG for pay as you go.

   2. In the drop-down menu, choose a software image.

      Note	The software image options are determined by the selection of BYOL or PAYG.

      Note	For information about onboarding a Cisco Catalyst 8000V without using Cisco Cloud OnRamp for Multicloud, see the Cisco SD-WAN Getting Started Guide.

10. Click the Instance Size drop-down list to choose the required size. Pick the size of the WAN edge based on the capacity needs.

11. Enter the IP Subnet Pool. Subnet pool is used for transit VPC creation, needs between /16 to /24.System allocates /27 per transit VPC 8 subnet(s).

12. (Minimum supported release: Cisco Catalyst SD-WAN Manager Release 20.14.1)

    If you enabled the Enable Configuration Group option when you created a cloud gateway or configured global settings for AWS, from the Configuration Group drop-down list, perform one of these actions:

    • Choose a configuration group.

    • To create and use a new configuration group, choose Create New. In the Create Configuration Group dialog box, enter a name for a new configuration group and click Done. Choose the new configuration group from the drop-down list. The configuration group that you choose is used to configure devices in the multicloud workflow.

    Note	When you enable configuration groups here, configuration groups are enabled for all cloud providers. For example, enabling this option here also enables configuration groups for all other multicloud and interconnect providers.

    1. Select the Chassis number to associate a pair of chassis to the configuration group.

    2. Click Configure Device Parameters and enter the following:

       1. System IP

       2. Hostname

       3. TLOC Color

       4. Username

       5. User Password

    3. Click Create Gateway.

13. The option is applicable only to configuration using device templates.

    Choose the UUID details in the UUID (specify 2) drop-down list.

    Note	Only logical devices (UUIDs) with a template attached appear in the list. From Cisco vManage Release 20.10.1, the UUIDs are auto-populated when you choose a site from the Site Name drop-down list.

14. (Minimum release: Cisco vManage Release 20.10.1) In the Multi-Region Fabric Settings area, for MRF Role, choose Border or Edge.

    This option is available only when Multi-Region Fabric is enabled.

15. Click Add to create a new cloud gateway.

Note

Creating cloud gateways for AWS Cloud WAN can take over an hour depending on the resources deployed. The first deployment in a region can fail if AWS verifying and validating the resources in this region. You cannot create cloud gateways in regions that do not support AWS Cloud WAN. For information about currently supported regions, see the AWS documentation.

Perform the following steps to attach sites to a cloud gateway:

1. From the Cisco SD-WAN Manager menu, choose Configuration > Cloud OnRamp for Multicloud. Click Gateway Management under Manage. The Cloud Gateways window appears. A table displays the list of cloud gateways with cloud account name, ID, cloud type, transit gateway.

   For each of the cloud gateways, you can view, delete, or attach more sites.

2. For the desired cloud gateway, click ... and choose Cloud Gateway.

3. Click Attachment.

4. Click Attach Sites.

5. In the Circuit Color drop-down list, choose a circuit color. A circuit color defines the search criteria for the sites you want to connect to your cloud gateway.

6. Click Next. The Attach Sites - Select Sites window appears. The table shows the sites with the selected circuit color.

7. Choose one or more sites from Available Sites and move them to Selected Sites.

8. Click Next.

9. On the Attach Sites - Site Configuration window, enter the Tunnel Count. The tunnel count ranges from 1 to 8 and each tunnel gives a bandwidth of 2.5 Gbps.

10. For the Accelerated VPN option, choose Enabled or Disabled. AWS Global Accelerator helps in optimized connectivity to the cloud.

11. Click Next. The Attach Sites - Configuration Override window appears. You can override the configuration that you performed in previous step, if required. You can alter the values for tunnel count and accelerated VPN status.

12. Click Next. The Next Steps window appears, where you can save the attachments you’ve added and exit the flow.

13. Click Save and Exit. If the configuration is successful, you see a message that indicates that the branch endpoints were successfully attached.

Note	To view the tunnel status, go to the Cloud OnRamp for Multicloud Dashboard or the Site Details window.