Other Profile

Cyber Vision

Cisco SD-WAN Manager supports integration with Cisco Cyber Vision, which is a network security solution. Cisco Cyber Vision provides visibility into the security status of your global network, indicates when devices in the network require attention to maintain a secure posture, helps you to configure security policies, and more. The browser-based manager is called Cisco Cyber Vision Center.

See Create a Configuration Group Profile with a Cyber Vision Feature.

Table 1. Name and Description

Field

Description

Name

Name for the Cisco Cyber Vision Center.

Description

Optionally, add a description.
Table 2. Base Configuration

Field

Description

Cyber Vision Center

From the drop-down list, choose a Cisco Cyber Vision Center connection from the list of previously configured connections. See Configure a Connection to a Cisco Cyber Vision Center in the Network Hierarchy.

Monitoring Source Interface

Click Add and enter the interface for the device to use for monitoring traffic. Your choice depends on your network and the traffic that you want the device to monitor.

Examples: VLAN interface, cellular interface, WAN interface

The Advanced Configuration area appears only if you are configuring a Cyber Vision feature for the SD-WAN solution option. It does not appear for the SD-Routing solution option.

The fields in this area are preconfigured to use variables that enable you to enter device-specific information for each device when deploying the configuration group. See Deploy a Configuration Group with a Cisco Cyber Vision Feature. But you can configure global device values instead of using the variables.

Table 3. Advanced Configuration

Field

Description

Capture Interface IP

IP address of the interface that captures the traffic for analysis.

Capture Interface Subnet Mask

Subnet mask for the interface that captures the traffic for analysis.

Collection Interface (Sensor to Center) IP

Enter an IP address for the collection interface that sends the captured traffic to Cisco Cyber Vision Center. Ensure that the IP address is within the subnet mask defined in the Collection Interface Subnet Mask field.

Note

 

For each device connecting to Cisco Cyber Vision Center through the same service VPN, enter a unique collection interface IP address.

It is necessary for each interface within a single service VPN to use a unique IP address.

To view the service VPN configured for communication with Cisco Cyber Vision Center, see Configure a Connection to a Cisco Cyber Vision Center in the Network Hierarchy.

Collection Interface Subnet Mask

Subnet mask for the collection interface that sends the captured traffic to Cisco Cyber Vision Center. The subnet mask defines an address space for the service VPN used for communication between device and Cisco Cyber Vision Center.

VPG5 (Virtual Port Group) IP Address

IP address within the subnet mask defined in the Collection Interface Subnet Mask field. This is an address with the same network as the collection interface.

Note

 

For each device connecting to Cisco Cyber Vision Center through the same service VPN, enter a unique VPG5 IP address.

It is necessary for each interface within a single service VPN to use a unique IP address.

VPG6 (Virtual Port Group) IP Address

This field is preset and not configurable.

ThousandEyes

Cisco ThousandEyes is a SaaS application that provides you an end-to-end view across networks and services that impact your business. It monitors the network traffic paths across internal, external, and carrier networks and the internet in real time to provide network performance data. Cisco ThousandEyes provides intelligent insights into your WAN and the cloud and helps you optimize application delivery and end-user experience.

For each parameter of the feature that has a default value, the scope is set to Default (indicated by a check mark), and the default setting or value is shown. To change the default or to enter a value, click the scope drop-down to the left of the parameter field and choose one of the following:

Parameter Scope

Scope Description

Device Specific (indicated by a host icon)

Use a device-specific value for the parameter. For device-specific parameters, you cannot enter a value in the feature template. You enter the value when you attach a Cisco Catalyst SD-WAN device to a device template.

When you click Device Specific, the Enter Key box opens. This box displays a key, which is a unique string that identifies the parameter in a CSV file that you create. This file is an Excel spreadsheet that contains one column for each key. The header row contains the key names (one key per column), and each row after that corresponds to a device and defines the values of the keys for that device. You upload the CSV file when you attach a Cisco Catalyst SD-WAN device to a device template.

To change the default key, type a new string and move the cursor out of the Enter Key box.

Examples of device-specific parameters are system IP address, host name, GPS location, and site ID.

Global (indicated by a globe icon)

Enter a value for the parameter and apply that value to all devices.

Examples of parameters that you might apply globally to a group of devices are DNS server, syslog server, and interface MTUs.

The following table describes the options for configuring the ThousandEyes feature.

Field

Description

Type

Choose a feature from the drop-down list.

Feature Name

Enter a name for the feature.

Description

Enter a description of the feature. The description can contain any characters and spaces.

Account Group Token

Enter the Cisco ThousandEyes Account Group Token.

VPN

Transport or service VPN. The Default setting indicates transport VPN (VPN 0). The Global or the Device Specific setting indicates service VPN.

When you set the VPN configuration as a Global or a Device Specific setting, enter the ID of the service VPN in which you want to provision the Cisco ThousandEyes Enterprise agent.

Management IP

Enter an IP address for the Cisco ThousandEyes Enterprise agent. This field is available only when you specify the service VPN.

Management Subnet

Choose a subnet mask from the drop-down list for the Cisco ThousandEyes Enterprise agent. This field is available only when you specify the service VPN.

Note

 

This IP-prefix address (Management IP and Management Subnet) must be unique within the fabric and must not overlap with the IP addresses of other branch agents.

Agent Default Gateway

Enter a default gateway address. This IP address is assigned to the virtual port group of the router. This field is available only when you specify the service VPN.

Name Server IP

Enter the IP address of your preferred DNS server.

This server can exist within or outside the Cisco Catalyst SD-WAN fabric but must be reachable from the service VPN.

Host Name

Enter the hostname that the agent must use when registering with the Cisco ThousandEyes portal. By default, the agent uses the hostname of the Cisco IOS XE Catalyst SD-WAN device.

Proxy Type

If the Cisco ThousandEyes Enterprise agent must use proxy server for external access, choose one of the following as proxy type:

  • static

  • pac

  • none

Static proxy settings:

  • Proxy Host: Set the configuration as a Global setting and enter the hostname of the proxy server.

  • Proxy Port: Set the configuration as a Global setting and enter the port number of the proxy server.

PAC settings:

  • PAC URL: Set the configuration as a Global setting and enter the URL of the proxy auto-configuration (PAC) file.

UCSE

Use the UCSE feature to connect a UCS-E interface with a UCS-E server.

Some parameters have a scope drop-down list that enables you to choose Global, Device Specific, or Default for the parameter value. Choose one of the following options, as described in the table below:

Parameter Scope

Scope Description

Global (Indicated by a globe icon)

Enter a value for the parameter and apply that value to all devices.

Examples of parameters that you might apply globally to a group of devices are DNS server, syslog server, and interface MTUs.

Device Specific (Indicated by a host icon)

Use a device-specific value for the parameter.

Choose Device Specific to provide a value for the key in the Enter Key field. The key is a unique string that helps identify the parameter. To change the default key, type a new string in the Enter Key field.

Examples of device-specific parameters are system IP address, host name, GPS location, and site ID.

Default (indicated by a check mark)

The default value is shown for parameters that have a default setting.

The following tables describe the options for configuring the UCSE feature.

Field

Description

Type

Choose a feature from the drop-down list.

Feature Name*

Enter a name for the feature. The name can be up to 128 characters and can contain only alphanumeric characters.

Description

Enter a description of the feature. The description can be up to 2048 characters and can contain only alphanumeric characters.

Basic Configuration

Field

Description

Bay*

 Specify the number for the SAS drive bays. The input value must be an integer.

Slot*

 Specify the slot numbers for the mezzanine adapters. The input value must be an integer.

IMC

Field

Description

Access Port

Configure the interface as an access port. You can configure only one VLAN on an access port, and the port can carry traffic for only one VLAN.

Not all hardware models have a dedicated access port. See the release notes for your Cisco Catalyst SD-WAN release for the supported hardware.

Available options:

  • Dedicated

  • Shared

    Configure the appropriate port (GE or TE) based on the hardware module.

IPv4 Address*

 Provide the UCS-E management port address.

Default Gateway*

Gateway tracking determine, for static routes, whether the next hop is reachable before adding that route to the device’s route table.

Default: Enabled.

VLAN ID

 Provide the VLAN number, which can be a value from 1 through 4094.

Assign Priority

 Assign the priority.

Advanced

Field

Description

Interface Name*

 Specify the name of the interface.

Layer

 Specify the layer details necessary for traffic exchange between different VLANs.

UCSE Interface VPN

Specify the details of the UCS-E interface VPN.
IPv4 Address

Provide the UCS-E management port address.