For an organization using SD-WAN, a branch site typically routes SaaS application traffic by default over SD-WAN overlay links to a data center. From the data center, the SaaS traffic reaches the SaaS server.

For example, in a large organization with a central data center and branch sites, employees might use Office 365 at a branch site. By default, the Office 365 traffic at a branch site would be routed over SD-WAN overlay links to a centralized data center, and from there to the Office 365 cloud server.

Scenario 1: If the branch site has a direct internet access (DIA) connection, you may choose to improve performance by routing the SaaS traffic through that direct route, bypassing the data center.

Scenario 2: If the branch site connects to a gateway site that has DIA links, you may choose to enable SaaS traffic to use the DIA of the gateway site.

Scenario 3: Hybrid method.

Cloud onRamp for SaaS selects the best path for each application using an algorithm that takes input from the following sources.

A branch site may connect to the internet through one or more direct internet access (DIA) interfaces at the branch site itself, or through a gateway site, which might use a service VPN or VPN 0 to connect to the internet.

In addition to probing the DIA interfaces at a branch site, Cloud OnRamp for SaaS can probe interfaces at a gateway site, whether they use service VPNs (VPN 1, VPN 2, …) or the transport VPN (VPN 0), when determining the best path to use for the traffic of specified cloud applications. This is helpful when the branch site connects to the internet through a gateway site.

When configuring Cloud OnRamp for SaaS to use the gateway site, specify whether the gateway site uses service VPNs or VPN 0 to connect to the internet, as shown in the following illustrations.

The prerequisites for using Cloud onRamp for SaaS differ for Cisco vEdge devices and Cisco IOS XE SD-WAN devices. For information about using Cloud onRamp for SaaS with Cisco vEdge devices, see Cloud OnRamp Configuration Guide for vEdge Routers, Cisco SD-WAN Release 20.

For Cisco IOS XE SD-WAN devices, the requirements are:

• The devices must be running Cisco IOS XE Release 17.3.1a or later.

• The devices must be in vManage mode.

• All Cisco vSmart Controller instances must be in vManage mode.

• A centralized policy that includes an application-aware policy must be activated. You can configure more than one centralized policy in Cisco vManage, but only one can be active.

  Note	This is an important difference from using Cloud onRamp for SaaS with Cisco vEdge devices, which do not have this requirement.

• Cloud onRamp for SaaS is enabled (Administration > Settings).

To specify traffic by Office 365 traffic category, the following are also required:

• Cisco SD-AVC is enabled (Administration > Cluster Management).

• Cisco SD-AVC Cloud Connector is enabled (Administration > Settings). If Cloud Connector is not enabled, policies specifying Office 365 traffic cannot match the Office 365 traffic. The traffic uses the default path, rather than the best path selected by Cloud onRamp for SaaS.

Cloud onRamp for SaaS probing through VPN 0 interfaces at gateway sites presupposes that a branch site connects to the internet through a gateway site, and that the gateway site connects to the internet using a VPN 0 interface. The branch site may or may not also connect to the internet through one or more DIA connections.

Configuring Cloud onRamp for SaaS when a site is using a loopback as a transport locator (TLOC) interface is not supported.

Configuring Cloud OnRamp for SaaS on Cisco IOS XE SD-WAN devices is only through centralized app-aware policy using match condition "cloud-saas-app-list" and action "cloud-saas". For mixed deployments including Cisco SD-WAN and Cisco IOS XE SD-WAN devices, we recommend to have different app-aware policies for Cisco SD-WAN and Cisco IOS-XE SD-WAN devices.

Enable gateway probing through VPN 0 interfaces if the following conditions apply:

• A branch site connects to the internet through a gateway site. The branch site may or may not also connect to the internet through one or more DIA interfaces.

• The gateway site has internet exits that use the transport VPN (VPN 0) through one or more interfaces.

You can enable Cloud OnRamp for SaaS in your Cisco SD-WAN overlay network on sites with Direct Internet Access (DIA) and on DIA sites that access the internet. You can also enable Cloud OnRamp for SaaS on client sites that access the internet through another site in the overlay network, called a gateway site. Gateway sites can include regional data centers or carrier-neutral facilities. When you enable Cloud OnRamp for SaaS on a client site that accesses the internet through a gateway, you also enable Cloud OnRamp for SaaS on the gateway site.

Note

You can only enable Cloud OnRamp for SaaS features using the Cisco vManage procedures described in this document. We do not support configuring Cloud OnRamp for SaaS using CLI templates. Even when you configure other features on a device using a CLI template, you must nevertheless use Cisco vManage for configuring Cloud OnRamp for SaaS features.

1. Open Cloud onRamp for Saas.

   • From the Cisco vManage menu, choose Configuration > Cloud onRamp for SaaS.

     or

   • In Cisco vManage, click the cloud icon near the top right and choose Cloud onRamp for SaaS.

2. In the Manage Cloud OnRamp for SaaS drop-down list, choose Applications and Policy.

   The Applications and Policy window displays all SaaS applications.

3. Optionally, you can filter the list of applications by clicking an option in the App Type field.

   • Standard: Applications included by default for Cloud onRamp for SaaS.

   • Custom: User-defined SaaS application lists (see Information About SaaS Application Lists).

4. Enable applications and configure.

   Column	Description
   Applications	Applications that can be used with Cloud onRamp for SaaS.
   Monitoring	Enabled: Enables Cloud OnRamp for SaaS to initiate the Quality of Experience probing to find the best path. Disabled: Cloud onRamp for SaaS stops the Quality of Experience probing for this application.
   VPN	(Cisco vEdge devices) Specify one or more VPNs.
   Policy/Cloud SLA	(Cisco IOS XE SD-WAN devices) Select Enable to enable Cloud onRamp for SaaS to use the best path for this application. Note  You can select Enable only if there is a centralized policy that includes an application-aware policy has been activated.
   	(Cisco IOS XE SD-WAN devices) For Microsoft 365 (M365), select one of the following to specify which types of M365 traffic to include for best path determination: Optimize: Include only M365 traffic categorized by Microsoft as “optimize” – the traffic most sensitive to network performance, latency, and availability. Optimize and Allow: Include only M365 traffic categorized by Microsoft as “Optimize” or “Allow”. The “Allow” category of traffic is less sensitive to network performance and latency than the “Optimize” category. All: Include all M365 traffic.
   	Starting from Cisco IOS XE Release 17.5.1a, you can choose the service area that your M365 application belongs to. This allows you to apply the policy to only those applications in the specified service area. Microsoft allows the following service area options: Common: M365 Pro Plus, Office in a browser, Azure AD, and other common network endpoints. Exchange: Exchange Online and Exchange Online Protection. SharePoint: SharePoint Online and OneDrive for Business. Skype: Skype for Business and Microsoft Teams. See the Microsoft documentation for information about updates to the service areas.

5. Click Save Applications and Next.

   The Application Aware Routing Policy window appears, showing the application-aware policy for the current active centralized policy.

   • You can select the application-aware policy and click Review and Edit to view the policy details. The match conditions of the policy show the SaaS applications for which monitoring has been enabled.

   • For an existing policy, you cannot edit the site list or VPN list.

   • You can create a new policy for sites that are not included in existing centralized policies. If you create a new policy, you must add a VPN list for the policy.

   • You can delete one or more new sequences that have been added for the SaaS applications, or change the order of the sequences.

6. Click Save Policy and Next. This saves the policy to the Cisco vSmart Controller.

Configure two types of sites:

• Client sites

• Direct internet access (DIA) sites

1. From the Cisco vManage menu, choose Configuration > Cloud onRamp for SaaS.

2. Click Manage Cloud OnRamp for SaaS and choose Applications and Policy.

   The Applications and Policy window displays all SaaS applications.

3. In the row of the application that you are verifying, check that the Monitoring column and the Policy/Cloud SLA column both show Enabled.

1. Open Cloud onRamp for SaaS.

   • From the Cisco vManage menu, choose Configuration > Cloud onRamp for SaaS.

     or

   • In Cisco vManage, click the cloud icon at the top right and click Cloud onRamp for SaaS.

   The page includes a tile for each monitored application, with the following information:

   • How many sites are operating with Cloud onRamp for SaaS.

   • A color-coded rating of the Quality of Experience (vQoE) score for the application (green=good score, yellow=moderate score, red=poor score) on the devices operating at each site.

2. Optionally, you can click a tile to show details of Cloud onRamp for SaaS activity for the application, including the following:

   Field	Description
   vQoE Status	A green checkmark indicates that the vQoE score for the best path meets the criteria of an acceptable connection. The vQoE is calculated based on average loss and average latency. For Office 365 traffic, other connection metrics are also factored in to the vQoE score.
   vQoE Score	For each site, this is the vQoE score of the best available path for the cloud application traffic. The vQoE score is determined by the Cloud onRamp for SaaS probe. Depending on the type of routers at the site, you can view details of the vQoE Score as follows: Cisco IOS XE SD-WAN devices: To show a chart of the vQoE score history for each available interface, click the chart icon. In the chart, each interface vQoE score history is presented as a colored line. A solid line indicates that Cloud onRamp for SaaS has designated the interface as the best path for the cloud application at the given time on the chart. You can place the cursor over a line, at a particular time on the chart, to view details of the vQoE score of an interface at that time. From Cisco vManage Release 20.8.1, for the Office 365 application, the chart includes an option to show the vQoE score history for a specific service area, such as Exchange, Sharepoint, or Skype. For each service area, a solid line in the chart indicates the interface chosen as the best path at a given time. If you have enabled Cloud onRamp for SaaS to use Microsoft traffic metrics for Office 365 traffic, the choice of best path takes into account the Microsoft traffic metrics. Cisco vEdge devices: To show a chart of the vQoE score history, click the chart icon. The chart shows the vQoE score for the best path chosen by Cloud onRamp for SaaS.
   DIA Status	The type of connection to the internet, such as local (from the site), or through a gateway site.
   Selected Interface	The interface providing the best path for the cloud application. Note  If the DIA status is Gateway, this field displays N/A.
   Activated Gateway	For a site that connects to the internet through a gateway site, this indicates the IP address of the gateway site. Note  If the DIA status is Local, this field displays N/A.
   Local Color	For a site that connects to the internet through a gateway site, this is the local color identifier of the tunnel used to connect to the gateway site. Note  If the DIA status is Local, this field displays N/A.
   Remote Color	For a site that connects to the internet through a gateway site, this is the remote (gateway site) color identifier of the tunnel used to connect to the gateway site. Note  If the DIA status is Local, this field displays N/A.
   SDWAN Computed Score	This field is applicable only if the site uses Cisco IOS XE SD-WAN devices. It does not apply for Cisco vEdge devices. From Cisco vManage Release 20.8.1, for the Microsoft Office 365 application, an SDWAN Computed Score column provides links to view charts of the path scores (OK, NOT-OK, or INIT) provided by Microsoft telemetry for each Microsoft service area, including Exchange, Sharepoint, and Skype. The chart shows the scores over time for each available interface. The scores are defined as follows: OK: Acceptable path NOT-OK: Unacceptable path INIT: Insufficient data These charts provide visibility into how Cloud onRamp for SaaS chooses a best path for each type of Microsoft Office 365 traffic. A use case for viewing the path score history is for determining whether Microsoft consistently rates a particular interface as NOT-OK for some types of traffic, such as Skype traffic.