The following are the components required to configure a centralized policy. Each one is explained in more detail in the sections below.

policy lists color-list list-name color color prefix-list list-name ip-prefix prefix 
site-list list-name site-id site-id tloc-list list-name tloc address color color 
encap encapsulation [preference value] vpn-list list-name vpn vpn-id
control-policy policy-name
sequence number
match match-parameters
action reject accept export-to vpn accept set parameter
default-action (accept | reject) apply-policy site-list list-name control-policy policy-name (in | out)

Components for VPN Membership

The following are the components required to configure a VPN membership policy. Each one is explained in more detail in the sections that follow.

policy
  lists
    app-list list-name
      (app applications | app-family application-families)
    data-prefix-list list-name 
      ip-prefix prefix 
    site-list list-name 
      site-id site-id 
    tloc-list list-name
      tloc ip-address color color encap encapsulation [preference value]
    vpn-list list-name 
      vpn vpn-id 
  policer policer-name
    burst bytes
    exceed action
    rate bandwidth
  data-policy policy-name 
    vpn-list list-name 
      sequence number 
        match
          app-list list-name
          destination-data-prefix-list list-name
          destination-ip prefix/length
          destination-port port-numbers
          dscp number
          dns-app-list list-name
          dns (request | response)
          packet-length number
          protocol number
          icmp-msg
          icmp6-msg
          source-data-prefix-list list-name
          source-ip prefix/length
          source-port port-numbers
          tcp flag
        action
          cflowd (not available for deep packet inspection)
          count counter-name
          drop
          log
          redirect-dns (dns-ip-address | host)
          tcp-optimization
          accept
            nat [pool number] [use-vpn 0]
            set 
              dscp number
              forwarding-class class
              local-tloc color color [encap encapsulation] [restrict]
              next-hop ip-address
              policer policer-name
              service service-name local [restrict] [vpn vpn-id]
              service service-name [tloc ip-address | tloc-list list-name] [vpn vpn-id]
              tloc ip-address color color [encap encapsulation]
              tloc-list list-name
              vpn vpn-id
      default-action
        (accept | drop)
apply-policy site-list list-name 
  data-policy policy-name (all | from-service | from-tunnel)

Start the Policy Configuration Wizard

1. In Cisco vManage, select the Configuration > Policies screen.

2. Select the Centralized Policy tab.

3. Click Add Policy.

The policy configuration wizard appears, and the Create Groups of Interest screen is displayed.

Configure Groups of Interest

In Create Groups of Interest, create lists of groups to use in a centralized policy:

1. Create new lists as described in the following table:

   Table 13.

   List Type	Procedure
   Application	In the left bar, click Application. Click New Application List. Enter a name for the list. Click either the Application or Application Family button. From the Select drop-down, select the desired applications or application families. Click Add. Two application lists are preconfigured. You cannot edit or delete these lists. Microsoft_Apps—Includes Microsoft applications, such as Excel, Skype, and Xbox. To display a full list of Microsoft applications, click the list in the Entries column. Google_Apps—Includes Google applications, such as gmail, Google maps, and YouTube. To display a full list of Google applications, click the list in the Entries column.
   Color	In the left bar, click Color. Click New Color List. Enter a name for the list. From the Select Color drop-down, select the desired colors. Click Add.
   Data Prefix	In the left bar, click Data Prefix. Click New Data Prefix List. Enter a name for the list. Select either IPv4 or IPv6. In the Add Data Prefix field, enter one or more data prefixes separated by commas. Click Add.
   Policer	In the left bar, click Policer. Click New Policer List. Enter a name for the list. Define the policing parameters: In the Burst field, enter the maximum traffic burst size, a value from 15,000 to 10,000,000 bytes. In the Exceed field, select the action to take when the burst size or traffic rate is exceeded. It can be drop, which sets the packet loss priority (PLP) to low. You can use the remark action to set the packet loss priority (PLP) to high. In the Rate field, enter the maximum traffic rate, a value from 0 through 264 – 1 bits per second (bps). Click Add.
   Prefix	In the left bar, click Prefix. Click New Prefix List. Enter a name for the list. In the Add Prefix field, enter one or more data prefixes separated by commas. Click Add.
   Site	In the left bar, click Site. Click New Site List. Enter a name for the list. In the Add Site field, enter one or more site IDs separated by commas. Click Add.
   SLA Class	In the left bar, click SLA Class. Click New SLA Class List. Enter a name for the list. Define the SLA class parameters: In the Loss field, enter the maximum packet loss on the connection, a value from 0 through 100 percent. In the Latency field, enter the maximum packet latency on the connection, a value from 0 through 1,000 milliseconds. In the Jitter field, enter the maximum jitter on the connection, a value from 1 through 1,000 milliseconds. Click Add.
   TLOC	In the left bar, click TLOC. Click New TLOC List. The TLOC List popup displays. Enter a name for the list. In the TLOC IP field, enter the system IP address for the TLOC. In the Color field, select the TLOC's color. In the Encap field, select the encapsulation type. In the Preference field, optionally select a preference to associate with the TLOC. Click Add TLOC to add another TLOC to the list. Click Save.
   VPN	In the left bar, click VPN. Click New VPN List. Enter a name for the list. In the Add VPN field, enter one or more VPN IDs separated by commas. Click Add.

2. Click Next to move to Configure Topology and VPN Membership in the wizard.

Configure Topology and VPN Membership

When you first open the Configure Topology and VPN Membership screen, the Topology tab is selected by default.

To configure topology and VPN membership:

Hub-and-Spoke

1. In the Add Topology drop-down, select Hub-and-Spoke.

2. Enter a name for the hub-and-spoke policy.

3. Enter a description for the policy.

4. In the VPN List field, select the VPN list for the policy.

5. In the left pane, click Add Hub-and-Spoke. A hub-and-spoke policy component containing the text string My Hub-and-Spoke is added in the left pane.

6. Double-click the My Hub-and-Spoke text string, and enter a name for the policy component

7. In the right pane, add hub sites to the network topology:

   1. Click Add Hub Sites.

   2. In the Site List field, select a site list for the policy component.

   3. Click Add.

   4. Repeat these steps to add more hub sites to the policy component.

8. In the right pane, add spoke sites to the network topology:

   1. Click Add Spoke Sites.

   2. In the Site List Field, select a site list for the policy component.

   3. Click Add.

   4. Repeat these steps to add more spoke sites to the policy component.

9. Repeat steps as needed to add more components to the hub-and-spoke policy.

10. Click Save Hub-and-Spoke Policy.

Mesh

1. In the Add Topology drop-down, select Mesh.

2. Enter a name for the mesh region policy component.

3. Enter a description for the mesh region policy component.

4. In the VPN List field, select the VPN list for the policy.

5. Click New Mesh Region.

6. In the Mesh Region Name field, enter a name for the individual mesh region.

7. In the Site List field, select one or more sites to include in the mesh region.

8. Click Add.

9. Repeat these steps to add more mesh regions to the policy.

10. Click Save Mesh Topology.

Custom Control (Route & TLOC): Centralized route control policy (for matching OMP routes)

1. In the Add Topology drop-down, select Custom Control (Route & TLOC).

2. Enter a name for the control policy.

3. Enter a description for the policy.

4. In the left pane, click Sequence Type. The Add Custom Control Policy popup displays.

5. Select Route. A policy component containing the text string Route is added in the left pane.

6. Double-click the Route text string, and enter a name for the policy component.

7. In the right pane, click Sequence Rule. The Match/Actions box opens, and Match is selected by default.

8. From the boxes under the Match box, select the desired policy match type. Then select or enter the value for that match condition. Configure additional match conditions for the sequence rule, as desired.

9. Click Actions. The Reject radio button is selected by default. To configure actions to perform on accepted packets, click the Accept radio button. Then select the action or enter a value for the action.

10. Click Save Match and Actions.

11. Click Sequence Rule to configure more sequence rules, as desired. Drag and drop to re-order them.

12. Click Sequence Type to configure more sequences, as desired. Drag and drop to re-order them.

13. Click Save Control Policy.

Custom Control (Route & TLOC): Centralized TLOC control policy (for matching TLOC routes)

1. In the Add Topology drop-down, select Custom Control (Route & TLOC).

2. Enter a name for the control policy.

3. Enter a description for the policy.

4. In the left pane, click Sequence Type. The Add Custom Control Policy popup displays.

5. Select TLOC. A policy component containing the text string TLOC is added in the left pane.

6. Double-click the TLOC text string, and enter a name for the policy component.

7. In the right pane, click Sequence Rule. The Match/Actions box opens, and Match is selected by default.

8. From the boxes under the Match box, select the desired policy match type. Then select or enter the value for that match condition. Configure additional match conditions for the sequence rule, as desired.

9. Click Actions. The Reject radio button is selected by default. To configure actions to perform on accepted packets, click the Accept radio button. Then select the action or enter a value for the action.

10. Click Save Match and Actions.

11. Click Sequence Rule to configure more sequence rules, as desired. Drag and drop to re-order them.

12. Click Sequence Type to configure more sequences, as desired. Drag and drop to re-order them.

13. Click Save Control Policy.

Import Existing Topology

1. In the Add Topology drop-down, click Import Existing Topology. The Import Existing Topology popup appears.

2. Select the type of topology.

3. For Policy Type, choose the name of the topology you want to import.

4. In the Policy drop-down, select a policy to import.

5. Click Import.

Click Next to move to Configure Traffic Rules in the wizard.

Create a VPN Membership Policy

1. In the Topology bar, click VPN Membership.

2. Click Add VPN Membership Policy.

   The Update VPN Membership Policy popup displays.

3. Enter a name and description for the VPN membership policy.

4. In the Site List field, select the site list.

5. In the VPN Lists field, select the VPN list.

6. Click Add List to add another VPN to the VPN membership.

7. Click Save.

8. Click Next to move to Configure Traffic Rules in the wizard.

Configure Traffic Rules

When you first open the Configure Traffic Rules screen, the Application-Aware Routing tab is selected by default. For more information on configuring traffic rules for deep packet inspection, see Deep Packet Inspection.

To configure traffic rules for a centralized data policy:

1. Click the Traffic Data tab.

2. Click the Add Policy drop-down.

3. Click Create New. The Add Data Policy screen displays.

4. Enter a name and a description for the data policy.

5. In the right pane, click Sequence Type. The Add Data Policy popup opens.

6. Select the type of data policy you want to create, Application Firewall, QoS, Service Chaining, Traffic Engineering, or Custom.

7. A policy sequence containing the text string Application, Firewall, QoS, Service Chaining, Traffic Engineering, or Custom is added in the left pane.

8. Double-click the text string, and enter a name for the policy sequence. The name you type is displayed both in the Sequence Type list in the left pane and in the right pane.

9. In the right pane, click Sequence Rule. The Match/Action box opens, and Match is selected by default. The available policy match conditions are listed below the box.

   Match Condition	Procedure	IPv4 Fields	IPv6 Fields
   None (match all packets)	Do not specify any match conditions.	—	—
   Applications /Application Family List	In the Match conditions, click Applications/Application Family List. In the drop-down, select the application family. To create an application list: Click New Application List. Enter a name for the list. Click Application to create a list of individual applications. Click Application Family to create a list of related applications. In the Select Application drop-down, select the desired applications or application families. Click Save.	app-list	—
   Destination Data Prefix	In the Match conditions, click Destination Data Prefix. To match a list of destination prefixes, select the list from the drop-down. To match an individual destination prefix, enter the prefix in the Destination: IP Prefix field.	source/ destination-data-prefix-list	source/ destination-data-prefix-list
   Destination Port	In the Match conditions, click Destination Port. In the Destination: Port field, enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).	src/dst ip	src/dst ip
   DNS Application List	Add an application list to enable split DNS. In the Match conditions, click DNS Application List. In the drop-down, select the application family.	dns-app-list	—
   DNS	Add an application list to process split DNS. In the Match conditions, click DNS. In the drop-down, select Request to process DNS requests for the DNS applications, and select Response to process DNS responses for the applications.	dns-request dns-response	—
   DSCP	In the Match conditions, click DSCP. In the DSCP field, type the DSCP value, a number from 0 through 63.	dscp	dscp
   Packet Length	In the Match conditions, click Packet Length. In the Packet Length field, type the length, a value from 0 through 65535.	packet-len	packet-len
   PLP	In the Match conditions, click PLP to set the Packet Loss Priority. In the PLP drop-down, select Low or High. To set the PLP to High, apply a policer that includes the exceed remark option.	—	—
   Protocol	In the Match conditions, click Protocol. In the Protocol field, type the Internet Protocol number, a number from 0 through 255.	Protocol	Protocol
   ICMP Message	To match ICMP messages, in the Protocol field, set the Internet Protocol Number to 1, or 58, or both. Note  This field is available from , Cisco SD-WAN Release 20.4.1 Cisco vManage Release 20.4.1.	ICMP Message	ICMP Message
   Source Data Prefix	In the Match conditions, click Source Data Prefix. To match a list of source prefixes, select the list from the drop-down. To match an individual source prefix, enter the prefix in the Source field.	source/ destination-data-prefix-list	source /destination-data-prefix-list
   Source Port	In the Match conditions, click Source Port. In the Source field, enter the port number. Specify a single port number, a list of port numbers (with numbers separated by a space), or a range of port numbers (with the two numbers separated with a hyphen [-]).	ports	ports
   TCP	In the Match conditions, click TCP. In the TCP field, syn is the only option available.	tcp flag	—

10. For QoS and Traffic Engineering data policies: From the Protocol drop-down list, select IPv4 to apply the policy only to IPv4 address families, IPv6 to apply the policy only to IPv6 address families, or Both to apply the policy to IPv4 and IPv6 address families.

11. To select one or more Match conditions, click its box and set the values as described.

    Note	Not all match conditions are available for all policy sequence types.

12. To select actions to take on matching data traffic, click the Actions box.

13. To drop matching traffic, click Drop. The available policy actions are listed to the right of the button.

14. To accept matching traffic, click Accept. The available policy actions are listed to the right of the button.

15. Set the policy action as described.

    Note	Not all actions are available for all match conditions.

    Match Condition	Description	Procedure
    Counter	Count matching data packets.	In the Action conditions, click Counter. In the Counter Name field, enter the name of the file in which to store packet counters.
    DSCP	Assign a DSCP value to matching data packets.	In the Action conditions, click DSCP. In the DSCP field, type the DSCP value, a number from 0 through 63.
    Forwarding Class	Assign a forwarding class to matching data packets.	In the Match conditions, click Forwarding Class. In the Forwarding Class field, type the class value, which can be up to 32 characters long.
    Log	Place a sampled set of packets that match the SLA class rule into system logging (syslog) files. In addition to logging the packet headers, a syslog message is generated the first time a packet header is logged and then every 5 minutes thereafter, as long as the flow is active.	In the Action conditions, click Log to enable logging.
    Policer	Apply a policer to matching data packets.	In the Match conditions, click Policer. In the Policer drop-down field, select the name of a policer.
    Loss Correction	Apply loss correction to matching data packets. Forward Error Correction (FEC) recovers lost packets on a link by sending redundant data, enabling the receiver to correct errors without the need to request retransmission of data. FEC is supported only for IPSEC tunnels, it is not supported for GRE tunnels. FEC Adaptive – Corresponding packets are subjected to FEC only if the tunnels that they go through have been deemed unreliable based on measured loss. Adaptive FEC starts to work at 2% packet loss; this value is hard-coded and is not configurable. FEC Always – Corresponding packets are always subjected to FEC. Packet Duplication – Sends duplicate packets over a single tunnel. If more than one tunnel is available, duplicated packets will be sent over the tunnel with the best parameters.	In the Match conditions, click Loss Correction. In the Loss Correction field, select FEC Adaptive, FEC Always, or Packet Duplication.
    Click Save Match and Actions.

16. Create additional sequence rules as desired. Drag and drop to re-arrange them.

17. Click Save Data Policy.

18. Click Next to move to Apply Policies to Sites and VPNs in the wizard.

Apply Policies to Sites and VPNs

In the Apply Policies to Sites and VPNs screen, apply a policy to sites and VPNs:

1. In the Policy Name field, enter a name for the policy. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.

2. In the Policy Description field, enter a description of the policy. It can contain up to 2048 characters. This field is mandatory, and it can contain any characters and spaces.

3. Associate the policy with VPNs and sites. The choice of VPNs and sites depends on the type of policy block:

   1. For a Topology policy block, click New Site List, Inbound Site List, Outbound Site List, or VPN List. Some topology blocks might have no Add buttons. Choose one or more site lists, and choose one or more VPN lists. Click Add.

   2. For an Application-Aware Routing policy block, click New Site List and VPN list. Choose one or more site lists, and choose one or more VPN lists. Click Add.

   3. For a Traffic Data policy block, click New Site List and VPN List. Choose the direction for applying the policy (From Service, From Tunnel, or All), choose one or more site lists, and choose one or more VPN lists. Click Add.

   4. For a cflowd policy block, click New Site List. Choose one or more site lists, and click Add.

4. Click Preview to view the configured policy. The policy appears in CLI format.

5. Click Save Policy. The Configuration > Policies screen appears, and the policies table includes the newly created policy.

Activate a Centralized Policy

Activating a centralized policy sends that policy to all connected Cisco vSmart Controllers. To activate a centralized policy:

1. In Cisco vManage, select the Configuration > Policies screen. When you first open this screen, the Centralized Policy tab is selected by default.

2. Choose a policy.

3. Click the More Actions option to the right of the row, and click Activate. The Activate Policy popup appears. It lists the IP addresses of the reachable Cisco vSmart Controllers to which the policy must be applied.

4. Click Activate.

This topic provides some examples of configuring a centralized data policy to influence traffic flow across the Cisco SD-WAN domain and to configure a Cisco SD-WAN device to be an internet exit point.

General Centralized Policy Example

This section shows a general example of a centralized data policy to illustrate that you configure centralized data policy on a Cisco vSmart Controller and that after you commit the configuration, the policy itself is pushed to the required Cisco SD-WAN device.

Here we configure a simple data policy on the Cisco vSmart Controller vm9:

vm9# show running-config policy
policy
 data-policy test-data-policy
  vpn-list test-vpn-list
   sequence 10
    match
     destination-ip 209.165.201.0/27
    !
    action drop
     count test-counter
    !
   !
   default-action drop
  !
 !
 lists
  vpn-list test-vpn-list
   vpn 1
  !
  site-list test-site-list
   site-id 500
  !
 !
!

Immediately, after you activate the configuration on the Cisco vSmart Controller, it pushes the policy configuration to the Cisco vEdge devices in site 500. One of these devices is vm5, where you can see that the policy has been received:

vm5# show policy from-vsmart 
policy-from-vsmart
 data-policy test-data-policy
  vpn-list test-vpn-list
   sequence 10
    match
     destination-ip 209.165.201.0/27
    !
    action drop
     count test-counter
    !
   !
   default-action drop
  !
 !
 lists
  vpn-list test-vpn-list
   vpn 1
  !
 !
!

Control Access

This example shows a data policy that limits the type of packets that a source can send to a specific destination. Here, the host at source address 192.0.2.1 in site 100 and VPN 100 can send only TCP traffic to the destination host at 203.0.113.1. This policy also specifies the next hop for the TCP traffic sent by 192.0.2.1, setting it to be TLOC 209.165.200.225, color gold. All other traffic is accepted as a result of the default-action statement.

policy
  lists
     site-list north
       site-id 100
     vpn-list vpn-north
       vpn 100
  !
  data-policy tcp-only
     vpn-list vpn-north
       sequence 10
         match
           source-ip 192.0.2.1/32
           destination-ip 198.51.100.1/32
           protocol tcp
         action accept
           set tloc 203.0.113.1 gold
       !
       default-action accept
   !
!
apply-policy
   site north data-policy tcp-only

Restrict Traffic

This examples illustrates how to disallow certain types of data traffic from being sent from between VPNs. This policy drops data traffic on port 25, which carries SMTP mail traffic, that originates in 209.165.201.0/27. However, the policy accepts all other data traffic, including non-SMTP traffic from 209.165.201.0/27.

policy
  lists
    data-prefix-list north-ones
      ip-prefix 209.165.201.0/27
      port 25
    vpn-list all-vpns
      vpn 1
      vpn 2
    site-list north
      site-id 100
  !
  data-policy no-mail
   vpn-list all-vpns
     sequence 10
       match
         source-data-prefix-list north-ones
       action drop
     !
     default-action accept
  !
!
apply-policy
  site north data-policy no-mail

Allow Traffic to Exit from a Cisco vEdge Device to the Internet

The following example allows data traffic destined for two prefixes on the Internet to exit directly from the local Cisco vEdge device to the internet destination. Configure this policy on the Cisco vSmart Controller.

polcy
 lists
  vpn-list vpn-1
    vpn 1
  !
  site-list nat-sites
    site-id 100,200
  !
data-policy accept-nat
  vpn-list vpn-1
   sequence 100
    match
     source-ip      10.20.24.0/24
     destination-ip 10.0.12.12/32
    !
    action accept
     count nat
     nat use-vpn 0
    !
   !
   sequence 101
    match
     source-ip      10.20.24.0/24
     destination-ip 10.1.15.13/32
    !
    action accept
     count nat_inet
     nat use-vpn 0
    !
   !
   default-action accept
  !
 !
apply-policy
  site-list nat-sites data-policy accept-nat 

Using the destination port instead of a destination IP prefix allows greater flexibility for traffic exiting to the internet. Here, traffic can go to all HTTP and HTTPS sites (ports 80 and 443, respectively). Configure this policy on a Cisco vSmart Controller.

data-policy accept-nat
  vpn-list vpn-1
   sequence 100
    match
     source-ip      10.20.24.0/24
     destination-port 80
    !
    action accept
     count nat
     nat use-vpn 0
    !
   !
   sequence 101
    match
     source-ip      10.20.24.0/24
     destination-port 443
    !
    action accept
     count nat_inet
     nat use-vpn 0
    !
   !
   default-action accept
  !
 !

Traffic Engineering

This example of traffic engineering forces all traffic to come to a Cisco SD-WAN device using a device hub instead of directly.

One common way to design a domain in a Cisco SD-WAN overlay network is to route all traffic destined for branches through a hub router, which is typically located in a data center, rather than sending the traffic directly from one Cisco SD-WAN device to another. You can think of this as a hub-and-spoke design, where one device is acting as a hub and the devices are the spokes. With such a design, traffic between local branches travels over the IPsec connections that are established between the spoke routers and the hub routers when the devices are booted up. Using established connections means that the devices do not need to expend time and CPU cycles to establish IPsec connections with each other. If you were to imagine that this were a large network with many devices, having a full mesh of connections between each pair of routers would require a large amount of CPU from the routers. Another attribute of this design is that, from an administrative point of view, it can be simpler to institute coordinated traffic flow policies on the hub routers, both because there are fewer of them in the overlay network and because they are located in a centralized data center.

One way to direct all the device spoke router traffic to a Cisco hub router is to create a policy that changes the TLOC associated with the routes in the local network. Let’s consider the topology in the figure here:

This topology has two devices in different branches:

• The Device West in site ID 1. The TLOC for this device is defined by its IP address (192.0.2.1), a color (gold), and an encapsulation (here, IPsec). We write the full TLOC address as {192.0.2.1, gold, ipsec}. The color is simply a way to identify a flow of traffic and to separate it from other flows.

• The Device East in site ID 2 has a TLOC address of {203.0.113.1, gold, ipsec}.

The devices West and East learn each other’s TLOC addresses from the OMP routes distributed to them by the Cisco vSmart Controller. In this example, the Device East advertises the prefix 209.165.201.0/27 as being reachable at TLOC {203.0.113.1, gold, }. In the absence of any policy, the Device West could route traffic destined for 209.165.201.0/27 to TLOC {203.0.113.1, gold, ipsec}, which means that the Device West would be sending traffic directly to the Device East.

However, our design requires that all traffic from West to East be routed through the hub router, whose TLOC address is {209.165.200.225, gold, ipsec}, before going to the Device East. To effect this traffic flow, you define a policy that changes the route's TLOC. So, for the prefix 1209.165.201.0/27, you create a policy that changes the TLOC associated with the prefix 209.165.201.0/27 from {203.0.113.1, gold, ipsec}, which is the TLOC address of the Device East, to {209.165.200.225, gold, ipsec}, which is the TLOC address of the hub router. The result is that the OMP route for the prefix 209.165.201.0/27 that the Cisco vSmart Controller advertises to the Device West that contains the TLOC address of the hub router instead of the TLOC address of the Device East. From a traffic flow point of view, the Device West then sends all traffic destined for 209.165.201.0/27 to the hub router.

The device also learns the TLOC addresses of the West and East devices from the OMP routes advertised by the Cisco vSmart Controller. Because, devices must use these two TLOC addresses, no policy is required to control how the hub directs traffic to the devices.

Here is a policy configuration on the Cisco vSmart Controller that directs the Device West (and any other devices in the network domain) to send traffic destined to prefix 209.165.201.0/27 to TLOC 209.165.200.225, gold, which is the device:

policy
  lists
    prefix-list east-prefixes
      ip-prefix 209.165.201.0/27
    site-list west-sites
      site-id 1
  control-policy change-tloc
    sequence 10
      match route
        prefix-list east-prefixes
        site-id 2
      action accept
        set tloc 209.165.200.225 color gold encap ipsec
apply-policy
  site west-sites control-policy change-tloc out

A rough English translation of this policy is:

Create a list named “east-prefixes” that contains the IP prefix “209.165.201.0/27”
  Create a list named “west-sites” that contains the site-id “1”
  Define a control policy named “change-tloc”
    Create a policy sequence element that:
      Matches a prefix from list “east-prefixes”, that is, matches “209.165.201.0/27”
      AND matches a route from site-id “2”
    If a match occurs:
      Accept the route
      AND change the route’s TLOC to “209.165.200.225” with a color of "gold" and an encapsulation of "ipsec"
  Apply the control policy “change-tloc” to OMP routes sent by the vSmart
    controller to “west-sites”, that is, to site ID 1

This control policy is configured on the Cisco vSmart Controller as an outbound policy, as indicated by the out option in the apply-policy site command. This option means the Cisco vSmart Controller applies the TLOC change to the OMP route after it distributes the route from its route table. The OMP route for prefix 209.165.201.0/27 that the Cisco vSmart Controller distributes to the Device West associates 209.165.201.0/27 with TLOC 209.165.200.225, gold. This is the OMP route that the Device West installs it in its route table. The end results are that when the Device West sends traffic to 209.165.201.0/27, the traffic is directed to the hub; and the Device West does not establish a DTLS tunnel directly with the Device East.

If the West side of the network had many sites instead of just one and each site had its own device, it would be straightforward to apply this same policy to all the sites. To do this, you simply add the site IDs of all the sites in the site-list west-sites list. This is the only change you need to make in the policy to have all the West-side sites send traffic bound for the prefix 209.165.201.0/27 through the device. For example:

policy
  lists
    prefix-list east-prefixes
      ip-prefix 209.165.201.0/27
    site-list west-sites
      site-id 1
      site-id 11
      site-id 12
      site-id 13
  control-policy change-tloc
    sequence 10
      match route
        prefix-list east-prefixes
        site-id 2
      action accept
        set tloc 209.165.200.225 color gold encap ipsec
apply-policy
  site west-sites control-policy change-tloc out

Creating Arbitrary Topologies

To provide redundancy in the hub-and-spoke-style topology discussed in the previous example, you can add a second Cisco hub to create a dual-homed hub site. The following figure shows that site ID 10 now has two Device hubs. We still want all inter-branch traffic to be routed through a device hub. However, because we now have dual-homed hubs, we want to share the data traffic between the two hub routers.

• Device Hub West, with TLOC 209.165.200.225, gold. We want all data traffic from branches on the West side of the overlay network to pass through and be processed by this device.

• Device Hub East, with TLOC 198.51.100.1, gold. Similarly, we all East-side data traffic to pass through the Device Hub East.

Here is a policy configuration on the Cisco vSmart Controller that would send West-side data traffic through the Cisco hub, and West and East-side traffic through the Device Hub East:

policy
  lists
    site-list west-sites
      site-id 1
    site-list east-sites
      site-id 2
    tloc-list west-hub-tlocs
      tloc-id 209.165.200.225 gold
    tloc-list east-hub-tlocs
      tloc-id 198.51.100.1 gold
  control-policy prefer-west-hub
    sequence 10
      match tloc
        tloc-list west-hub-tlocs
      action accept
        set preference 50
  control-policy prefer-east-hub
    sequence 10
      match tloc
        tloc-list east-hub-tlocs
      action accept
        set preference 50
apply-policy
  site west-sites control-policy prefer-west-hub out
  site east-sites control-policy prefer-east-hub out

Here is an explanation of this policy configuration:

Create the site lists that are required for the apply-policy configuration command:

• site-list west-sites lists all the site IDs for all the devices in the West portion of the overlay network.

• site-list east-sites lists the site IDs for the devices in the East portion of the network.

Create the TLOC lists that are required for the match condition in the control policy:

• west-hub-tlocs lists the TLOC for the Device West Hub, which we want to service traffic from the West-side device.

• east-hub-tlocs lists the TLOC for the Device East Hub, to service traffic from the East devices.

Define two control policies:

• prefer-west-hub affects OMP routes destined to TLOC 209.165.200.225, gold, which is the TLOC address of the Device West hub router. This policy modifies the preference value in the OMP route to a value of 50, which is large enough that it is likely that no other OMP routes will have a larger preference. So setting a high preference value directs traffic destined for site 100 to the Device West hub router.

• Similarly, prefer-east-hub sets the preference to 50 for OMP routes destined TLOC 198.51.100.1, gold, which is the TLOC address of the Device East hub router, thus directing traffic destined for site 100 site to the Device East hub 198.51.100.1 router.

Apply the control policies:

• The first line in the apply-policy configuration has the Cisco vSmart Controller apply the prefer-west-hub control policy to the sites listed in the west-sites list, which here is only site ID 1, so that the preference in their OMP routes destined to TLOC 209.165.200.225 is changed to 50 and traffic sent from the Device West to the hub site goes through the Device West hub router.

• The Cisco vSmart Controller applies the prefer-east-hub control policy to the OMP routes that it advertises to the devices in the east-sites list, which changes the preference to 50 for OMP routes destined to TLOC 198.51.100.1, so that traffic from the Device East goes to the Device East hub router.