Components of Access Lists

Following are the structural components required to configure access lists.

policy
   implicit-acl-logging
   log-frequency number
   mirror mirror-name 
      remote-dest ip-address source ip-address
   policer policer-name
      rate bandwidth
      burst bytes
      exceed action
policy ipv6
   access-list list-name
      sequence number
         match match-parameters
         action
            drop
            user counter-name
            log
            accept
               class class-name
               mirror mirror-name
               policer policer-name
     default-action (accept | drop)
vpn vpn-id
   interface interface-name
      ipv6 access-list list-name (in | out)

Start the Policy Configuration Wizard

To start the policy configuration wizard:

1. In Cisco vManage, select the Configuration > Policies screen.

2. Select the Localized Policy tab.

3. Click Add Policy.

The policy configuration wizard opens, and the Create Groups of Interest screen is displayed.

Configure Groups of Interest

In Create Groups of Interest, create lists of groups to use in localized policy:

1. Create new lists, as described in the following table:

Click Next to move to Configure Forwarding Classes/QoS in the wizard.

Configure Forwarding Classes/QoS

When you first open the Forwarding Classes/QoS screen, the QoS Map tab is selected by default:

To configure forwarding classes for use by QoS Map:

1. To create a new QoS mapping:

   1. In the QoS tab, click the Add QoS Map drop-down.

   2. Select Create New.

   3. Enter a name and description for the QoS mapping.

   4. Click Add Queue. The Add Queue popup displays.

   5. Select the queue number from the Queue drop-down.

   6. Select the maximum bandwidth and buffer percentages, and the scheduling and drop types.

   7. Enter the Forwarding Class.

   8. Click Save Queue.

2. To import an existing QoS mapping:

   1. In the QoS tab, click the Add QoS Map drop-down.

   2. Select Import Existing. The Import Existing Application QoS Map Policy popup displays.

   3. Select a QoS Map policy.

   4. Click Import.

3. To view or copy a QoS mapping or to remove the mapping from the localized policy, click the More Actions icon to the right of the row, and select the desired action.

4. To configure policy rewrite rules for the QoS mapping:

   1. In the Policy Rewrite tab, click the Add Rewrite Policy drop-down.

   2. Select Create New.

   3. Enter a name and description for the rewrite rule.

   4. Click Add Rewrite Rule. The Add Rule popup displays.

   5. Select a class from the Class drop-down.

   6. Select the priority (Low or High) from the Priority drop-down.

   7. Enter the DSCP value (0 through 63) in the DSCP field.

   8. Enter the class of service (CoS) value (0 through 7) in the Layer 2 Class of Service field.

   9. Click Save Rule.

5. To import an existing rewrite rule:

   1. In the QoS tab, click the Add Rewrite Policy drop-down..

   2. Select Import Existing. The Import Existing Policy Rewrite popup displays.

   3. Select a rewrite rule policy.

   4. Click Import.

6. Click Next to move to Configure Access Lists in the wizard.

Configure ACLs

1. In the Configure Access Control Lists screen, configure ACLs.

2. To create a new ACL, click the Add Access Control List Policy drop-down. Select one from the following options:

   • Add IPv4 ACL Policy - to configure IPv4 ACL policy

   • Add IPv6 ACL Policy - to configure IPv6 ACL policy

   • Import Existing - to import existing ACL policy

3. If you click Add IPv4 ACL Policy, the Add IPv4 ACL Policy screen displays.

   or

   If you click Add IPv6 ACL Policy, the Add IPv6 ACL Policy screen displays.

4. Enter a name and description for the ACL in the ACL Policy screen.

5. In the left pane, click Add ACL Sequence. An Access Control List box is displayed in the left pane.

6. Double-click the Access Control List box, and type a name for the ACL.

7. In the right pane, click Add Sequence Rule to create a single sequence in the ACL. The Match tab is selected by default.

8. Click a match condition.

9. On the left, enter the values for the match condition.

   1. On the right enter the action or actions to take if the policy matches.

10. Repeat Steps 6 through 8 to add match–action pairs to the ACL.

11. To rearrange match–action pairs in the ACL, in the right pane drag them to the desired position.

12. To remove a match–action pair from the ACL, click the X in the upper right of the condition.

13. Click Save Match and Actions to save a sequence rule.

14. To rearrange sequence rules in an ACL, in the left pane drag the rules to the desired position.

15. To copy, delete, or rename an ACL sequence rule, in the left pane, click More Options next to the rule's name and select the desired option.

16. If no packets match any of the ACL sequence rules, the default action is to drop the packets. To change the default action:

    1. Click Default Action in the left pane.

    2. Click the Pencil icon.

    3. Change the default action to Accept.

    4. Click Save Match and Actions.

    5. Click Save Access Control List Policy.

17. Click Next to move to Configure Route Policy in the wizard.

To configure Device Access Policy, see Device Access Policy section.

Configure Route Policies

In Configure Route Policies, configure the routing policies:

1. In the Add Route Policy tab, select Create New.

2. Enter a name and description for the route policy.

3. In the left pane, click Add Sequence Type. A Route box is displayed in the left pane.

4. Double-click the Route box, and type a name for the route policy.

5. In the right pane, click Add Sequence Rule to create a single sequence in the policy. The Match tab is selected by default.

6. Select a desired protocol from the Protocol drop-down list. The options are: IPv4, IPv6 or Both.

7. Click a match condition.

8. On the left, enter the values for the match condition.

9. On the right enter the action or actions to take if the policy matches.

10. Repeat Steps 6 through 8 to add match–action pairs to the route policy.

11. To rearrange match–action pairs in the route policy, in the right pane drag them to the desired position.

12. To remove a match–action pair from the route policy, click the X in the upper right of the condition.

13. Click Save Match and Actions to save a sequence rule.

14. To rearrange sequence rules in an route policy, in the left pane drag the rules to the desired position.

15. To copy, delete, or rename an route policy sequence rule, in the left pane, click More Options next to the rule's name and select the desired option.

16. If no packets match any of the route policy sequence rules, the default action is to drop the packets. To change the default action:

    1. Click Default Action in the left pane.

    2. Click the Pencil icon.

    3. Change the default action to Accept.

    4. Click Save Match and Actions.

17. Click Save Route Policy.

18. Click Next to move to Policy Overview in the wizard.

Configure Policy Settings

In Policy Overview, configure policy settings:

1. In the Enter name and description for your localized master policy pane, enter name and description for the policy.

2. In the Policy Settings pane, select the policy application checkboxes that you want to confirgure. The options are:

   • Netflow - to perform traffic flow monitoring on IPv4 traffic.

   • Netflow IPv6- to perform traffic flow monitoring on IPv6 traffic.

   • Application - to track and monitor IPv4 applications.

   • Application IPv6- to track and monitor IPv6 applications.

   • Cloud QoS- to enable QoS scheduling.

   • Cloud QoS Service Side- to enable QoS scheduling on the service side.

   • Implicit ACL Logging- to log the headers of all packets that are dropped because they do not match a service perform traffic flow monitoring.

3. To configure how often packets flows are logged, click Log Frequency. Packet flows are those that match an access list (ACL), a cflowd flow, or an application-aware routing flow.

4. Click Preview to view the full policy in CLI format.

5. Click Save Policy.

Apply Localized Policy in a Device Template

1. In Cisco vManage, select the Configuration > Templates screen.

2. If you are creating a new device template:

   1. In the Device tab, click Create Template.

   2. From the Create Template drop-down, select From Feature Template.

   3. From the Device Model drop-down, select one of the Cisco vEdge devices.

   4. In the Template Name field, enter a name for the device template. This field is mandatory and can contain only uppercase and lowercase letters, the digits 0 through 9, hyphens (–), and underscores (_). It cannot contain spaces or any other characters.

   5. In the Description field, enter a description for the device template. This field is mandatory, and it can contain any characters and spaces.

   6. Continue with Step 4.

3. If you are editing an existing device template:

   1. In the Device tab, click the More Actions icon to the right of the desired template, and click the Pencil icon.

   2. Click the Additional Templates tab. The screen scrolls to the Additional Templates section.

   3. From the Policy drop-down, select the name of a policy that you have configured.

4. Click the Additional Templates tab located directly beneath the Description field. The screen scrolls to the Additional Templates section.

5. From the Policy drop-down, select the name of the policy you configured in the above procedure.

6. Click Create (for a new template) or Update (for an existing template).

Activate a Localized Policy

1. In the title bar, click the Custom Options drop-down.

2. In the Localized Policy tab, and then select a policy.

3. Click More Actions and click Activate.

4. In the Activate Policy popup, click Activate to push the policy to all reachable Cisco vSmart Controllers in the network.

5. Click OK to confirm activation of the policy on all Cisco vSmart Controllers.

6. To deactivate the centralized policy, select the = tab, and then select a policy.

7. 6. Click More Actions and click Deactivate.

8. In the Deactivate Policy popup, click Deactivate to confirm that you want to remove the policy from all reachable Cisco vSmart Controllers.

This topic provides some straightforward examples of configuring localized data policy to help you get an idea of how to use policy to influence traffic flow across the Cisco SD-WAN domain. Localized data policy, also known as access lists, is configured directly on the local Cisco vEdge devices.

QoS

You can configure quality of service (QoS) to classify data packets and control how traffic flows out of and in to the interfaces on a Cisco vEdge device and on the interface queues. For examples of how to configure a QoS policy, see Forwarding and QoS Configuration Examples.

Mirroring Example

This example illustrates how to configure a mirror instance to automatically send a copy of certain types of data packet to a specified destination for analysis. After you configure the mirror instance, include it in an access list. Here, "mirror-m1" is configured with the host at source address 10.20.23.16 and destination host at 10.2.2.11. The mirror instance is then included in the access list "acl2," which is configured so that data packets originating from the host at source address 10.20.24.17 and going to the destination host at 10.20.25.18 are mirrored to the destination host at 10.2.2.11 with the source address of the originating host as 10.20.23.16.

policy
 mirror m1
  remote-dest 10.2.2.11 source 10.20.23.16
 !
!

vm5# show running-config policy access-list acl2
policy
 access-list acl2
  sequence 1
   match
    source-ip      10.20.24.17/32
    destination-ip 10.20.25.18/32
   !
   action accept
    mirror m1
   !
  !
  default-action drop
 !
!

ICMP Message Example

This example displays the configuration for localized data policy for ICMP messages.

policy
access-list acl_1
 sequence 100
  match
   protocol 1
   icmp-msg administratively-prohibited
  !
  action accept
   count administratively-prohibited
  !
  !