Prerequisites

• Download the latest container image for the SD-AVC network service. Save the file to an accessible location on the server hosting Cisco SD-WAN Manager. This container is required for the procedure. To download the container, open the Cisco Software Download page  and enter "SD-WAN". Select "Software-Defined WAN (SD-WAN)" from the results, then "SD-WAN" in the results. In the software packages available for download, select SD-AVC.

• Ensure that routers in the network that are included in the SD-WAN topology have a DNS server configured.

• The virtual machine in which Cisco SD-WAN Manager operates must have the following resources available to dedicate to the SD-AVC network service:

  • vCPU: 4

  • RAM: 5 GB

  • Storage: 40 GB

Procedure

1. Ensure that the downloaded SD-WAN image is compatible with your version of Cisco SD-WAN Manager.

   1. Display the checksum for the compatible image, using the following API:

      https://[vManage-IP-address]/dataservice/sdavc/checksum

      Example: https://10.0.0.1/dataservice/sdavc/checksum

   2. Verify that the checksum of the downloaded image matches this.

2. To upload the SD-AVC virtual service package to Cisco SD-WAN Manager:

   1. From the Cisco SD-WAN Manager menu, choose Maintenance > Software Repository.

   2. Click Virtual Images and select Upload Virtual Image to upload the SD-AVC package.

3. From the Cisco SD-WAN Manager menu, choose Administration > Cluster Management page.

4. For the desired host (the Cisco SD-WAN Manager portal on which you are enabling SD-AVC), click … and choose Edit.

5. In the Edit Cisco SD-WAN Manager dialog box, enter the username and password, using Cisco SD-WAN Manager credentials.

6. Select the checkbox for Enable SD-AVC. Click Update.

7. Cisco SD-WAN Manager prompts you to confirm before rebooting the device to apply the changes to the device. Click OK to confirm.

8. After the reboot, Cisco SD-WAN Manager comes up automatically and displays progress on the SD-AVC activation. Wait for the activation to complete.

9. (Optional) After installation is complete, you can verify that Cisco SD-WAN Manager has the SD-AVC virtual service installed and operating correctly.

   1. From the Cisco SD-WAN Manager menu, choose Administration > Cluster Management.

   2. In Service Configuration, in Cisco SD-WAN Manager row of the table, verify that the SD-AVC shows a green checkmark.

For information about Cisco SD-WAN Manager commands, see Cisco SD-WAN Manager Command Reference documentation.

Prerequisites

• A template exists for the Cisco IOS XE Catalyst SD-WAN device (example: Cisco ASR 1001-X, Cisco ISR 4321).

• TCP port 10501 destination traffic must be permitted.

Procedure

1. From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

2. Click Localized Policy.

3. To add a policy and enable Application, follow the steps below:

   1. Click Add Policy.

   2. Click Next on the several screens (Create Groups of Interest, Configure Forwarding Classes/QOS, Configure Access Control Lists, Configure Route Policy) until the Policy Overview screen.

   3. In the Policy Overview screen, enter a policy name and policy description.

   4. Select Application.

   5. Save the policy.

4. To add the localized Policy to the device template, follow the steps below:

   1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

   2. For the device on which you have to enable SD-AVC, click … and select Edit from the menu.

   3. Click Additional Templates.

   4. Add the localized policy created in an earlier step of this procedure.

   5. Click Update and proceed through the next screens to push the updated template to the device.

5. (Optional) After pushing the update to the device, you can check the status of SD-AVC on the device with one of the following commands.

   show avc sd-service info summary

   or

   show avc sd-service info connectivity

Prerequisites

Ensure that routers in the network that are included in the Cisco Catalyst SD-WAN topology have a DNS server configured.

Note	Cisco SD-AVC must operate on only one Cisco SD-WAN Manager instance. In a Cisco SD-WAN Manager cluster, enable Cisco SD-AVC on only one instance of Cisco SD-WAN Manager.

To enable Cisco SD-AVC, perform the following steps.

1. From the Cisco SD-WAN Manager menu, choose Administration > Cluster Management.

2. For the desired host (the portal on which you are enabling SD-AVC), click ... and select Edit.

3. In the Edit Manager pop-up window, select the checkbox for Enable SD-AVC.

   Note	The Edit Manager pop-up window provides an option for disabling the application server. After disabling the application server, you cannot later enable other services using this method. If you need to disable the application server, do not do this at the same time that you enable other features.

4. Enter the username and password, using Cisco SD-WAN Manager credentials. Reboot the device to apply the changes.

5. After the reboot, Cisco SD-WAN Manager comes up automatically and displays progress on the SD-AVC activation. Wait for the activation to complete.

6. (optional) After installation is complete, you can verify that Cisco SD-WAN Manager has the SD-AVC virtual service installed and operating correctly.

   1. From the Cisco SD-WAN Manager menu, choose Administration > Cluster Management.

   2. Click Service Configuration, in the Cisco SD-WAN Manager row of the table, verify that SD-AVC shows a green checkmark.

Prerequisites

• A template exists for the Cisco IOS XE Catalyst SD-WAN device (example: Cisco ASR 1001-X, Cisco ISR 4321).

• TCP port 10501 destination traffic must be permitted.

Procedure

1. From the Cisco SD-WAN Manager menu, choose Configuration > Policies.

2. Click Localized Policy.

3. To add a policy and enable Application, follow the steps below:

   1. Click Add Policy.

   2. Click Next on the several screens (Create Groups of Interest, Configure Forwarding Classes/QOS, Configure Access Control Lists, Configure Route Policy) until the Policy Overview screen.

   3. In the Policy Overview screen, enter a policy name and policy description.

   4. Select Application.

   5. Save the policy.

4. To add the localized Policy to the device template, follow the steps below:

   1. From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

   2. For the device on which you have to enable SD-AVC, click … and select Edit from the menu.

   3. Click Additional Templates.

   4. Add the localized policy created in an earlier step of this procedure.

   5. Click Update and proceed through the next screens to push the updated template to the device.

5. (Optional) After pushing the update to the device, you can check the status of SD-AVC on the device with one of the following commands.

   show avc sd-service info summary

   or

   show avc sd-service info connectivity

Before Cisco Catalyst SD-WAN Manager Release 20.14.1, client ID, client secret credentials, and sometimes a cloud gateway URL and OTP were required to enable Cloud Connector. From Cisco Catalyst SD-WAN Manager Release 20.14.1, you can configure Cisco SD-AVC Cloud Connector using the Cloud Services page. With this feature, you need not retrieve an OTP or create a TAC case separately to enable SD-AVC Cloud Connector.

Prerequisites

Enable Cisco SD-AVC under Administration > Cluster Management to enable Cloud Connector.

Enable Cisco SD-AVC Cloud Connector Using Cloud Services

1. From the Cisco SD-WAN Manager menu, choose Administration > Settings.

2. Click Cloud Services.

3. Enable Cloud Services in the Cloud Services tab.

4. Enter your Smart Account credentials in the fields.

5. (Optional) Enable Analytics.

   Note	Enable this option only if you have deployed Cisco Catalyst SD-WAN Analytics, and have confirmed that it is reachable by Cisco SD-WAN Manager.

6. Enable SD-AVC Cloud Connector.

   Note	If Cisco SD-WAN Manager is cloud-hosted by Cisco, this option does not appear and Cloud Connector is enabled automatically after you enable the Cloud Services option.

7. Click Save.

Before You Begin

• Before Cisco vManage Release 20.10.1, enabling Cloud Connector required client ID and client secret credentials. From Cisco vManage Release 20.10.1, it requires a cloud gateway URL and OTP. An advantage to using an OTP is that, in contrast to a client secret, it does not expire. See the following table for details about the credentials required for different releases, upgrade scenarios, and hosting options.

• Cisco SD-AVC Cloud Connector is a necessary component for Cloud onRamp for SaaS to manage Office 365 traffic according to the Office 365 traffic category.

Enable Cisco SD-AVC Cloud Connector

1. From the Cisco SD-WAN Manager menu, choose Administration > Settings.

2. Click SD-AVC and enable Cloud Connector.

   (If you are using Cisco vManage Release 20.10.x, Cisco vManage Release 20.11.x, or Cisco Catalyst SD-WAN Manager Release 20.12.x, click Edit and enable Cloud Connector.)

   (In Cisco vManage Release 20.9.x and earlier releases, the option is called SD-AVC Cloud Connector. In these releases, click Edit and enable Cloud Connector.)

   Note	If Cisco SD-WAN Manager is cloud-hosted by Cisco, this option does not appear and Cloud Connector is enabled automatically.

3. (This step applies to Cisco vManage Release 20.10.1 and later, and is handled automatically if Cisco SD-WAN Manager is Cisco-hosted.)

   See the Before You Begin section that precedes these steps for details about the requirements for enabling the SD-AVC Cloud Connector in different scenarios. As noted there, enable SD-AVC in cluster management before enabling the Cloud Connector.

   If you need to enter the cloud gateway URL, use: https://datamanagement-us-01.sdwan.cisco.com/validate_sdavc/

   If you need to use the Cisco Catalyst SD-WAN Portal to get the OTP, see the Cisco Catalyst SD-WAN Portal Configuration Guide for details.

   If you need to open a TAC case to receive the OTP, open https://mycase.cloudapps.cisco.com/case. The workflow for receiving the OTP requires the following:

   • Entitlement information.

   • Smart Account.

   • Virtual Account.

   • The organization name configured in Cisco SD-WAN Manager.

   • Cisco SD-WAN Manager geographic location: Americas, European Union (EU), or Asia-Pacific (APAC).

   • Technology: Use Cisco Catalyst SD-WAN On-Prem for an on-prem installation or Cisco Catalyst SD-WAN - Cisco-Hosted for a Cisco-hosted installation.

   • SubTechnology: Use SDWAN Cloud Infra.

4. (For Cisco vManage Release 20.9.x and earlier releases) Enter the following credentials:

   • Client ID

     Note	Click (i) for Client ID and open the Cisco API Console page in a browser window to create Cloud Connector credentials if you do not already have credentials.

   • Client Secret

   • Organization Name: Use the descriptive name that you entered on the Cisco API Console page in the Name of your application field.

5. (Releases earlier than Cisco vManage Release 20.10.1) For Affinity, you can select a geographical location for storing the Cloud Connector data. For organizations located in Europe, it is recommended to change the location to Europe, in accordance with EU General Data Protection Regulation (GDPR) regulations.

6. For Telemetry, you can optionally disable the collection of telemetry data.

   Note	If Cisco SD-WAN Manager is cloud-hosted by Cisco, this option does not appear and telemetry is enabled automatically.

Create Credentials on the Cisco API Console

The following steps show how to create credentials in the Cisco API Console. These steps are provided here for convenience, and are subject to change.

1. On the Cisco API Console page, sign in using your Cisco credentials.

2. Click My Apps and keys. A page opens for registering a new application.

3. To register SD-AVC, follow the steps below:

   1. Name of your application: Use any descriptive name. Save this name for a later step.

   2. In the Application Type area, click Service.

   3. In the Grant Type area, check the Client Credentials check box.

   4. Check the Hello API check box.

   5. In the Terms of Service section, check the check box to agree with the terms.

   6. Click Register. The Cisco API Console page displays the Client ID and Client Secret details. Keep this page open to complete the procedure.

      Note	These credentials expire after 90 days. When you receive a message in Cisco SD-WAN Manager indicating that SD-AVC credentials are expiring, return to the Cisco API Console and create new Cloud Connector credentials.

Before you deploy an IOS XE router in the overlay network, review the following:

• The controller devices—Cisco SD-WAN Validators, Cisco SD-WAN Manager instances, and Cisco SD-WAN Controllers—are running Cisco Catalyst SD-WAN Software Release 18.3.

• If you deploy both IOS XE and vEdge routers in the overlay network, the vEdge routers are running Release 17.2.1 or higher of the Cisco Catalyst SD-WAN software. With these software versions, the vEdge and IOS XE software can interoperate, allowing BFD tunnels to be established between vEdge routers and IOS XE routers.

• If you deploy both IOS XE and vEdge routers in the same site, the vEdge routers are running Cisco Catalyst SD-WAN Software Release 18.3.

• The ISR 4000 series router has at least 4 gigabytes (GB) of DRAM installed. It is recommended that the router have 8 GB of DRAM.

• The ASR 1000 Cisco SD-WAN Validator series router has at least 8 GB of DRAM installed. The ASR 1002-HX router has at least 16 GB of DRAM installed.

• The router bootflash has a minimum of 1.5 GB space available for the XE SD-WAN image or, beginning with Cisco IOX SD-WAN Release 17.10, the router bootflash has a minimum of one half of its disk space available for the XE SD-WAN image.

• If using your enterprise root certificate to authenticate the router, the certificate is copied to the router's bootflash before installing the XE SD-WAN software.

• All unsupported modules are removed from the router before installing the XE SD-WAN software. For a list of supported modules, see Supported Interface Modules and Supported Crypto Modules.

• For information about deploying a Cisco ASR 1006-X with an RP3 module, see Cisco ASR 1006-X with an RP3 Module.

• The updated device list is uploaded to Cisco SD-WAN Manager and sent to the Cisco SD-WAN Validator. To do so:

  1. Obtain the router's chassis and board ID serial number by issuing the show crypto pki certificates CISCO_IDEVID_SUDI command at the system prompt. If running Release 16.6.1 or earlier on an ASR series router, issue the show sdwan certificate serial command.

  2. Add the router's serial number to Plug and Play (PnP) Connect portal. See Add the IOS XE Router to the PnP Portal section for more details..

  3. From the Cisco SD-WAN Manager menu, choose Configuration > Devices. Click Sync Smart Account to download the updated device list to Cisco SD-WAN Manager and send it to the Cisco SD-WAN Validator.

• Device configuration templates are created and attached to the router using Cisco SD-WAN Manager Configuration > Templates. This ensures that the router can obtain a configuration and establish full control connections when it comes up.

• If the router exceeds the unidirectional encrypted bandwidth of 250 Mbps and if the HSECK9 license is not already installed, the license file is copied to the router's bootflash and license installed on the router license install file path.

• The ASR 1000 series, ISR 1000 series, and ISR 4000 series router is running the required version of the ROM monitor software (ROMMON), as shown in the following table. To verify the ROMMON version running on the router, issue the show rom-monitor or show platform command at the system prompt.

• The ISRv router is running the minimum required version of the CIMC and NFVIS software, as shown in the following table:

Download the Cisco IOS XE Catalyst SD-WAN Software

To download the Cisco IOS XE Catalyst SD-WAN software from the Cisco site:

1. Go to https://www.cisco.com.

2. Click Support & Downloads from the menu on the left side.

3. In the Products and Downloads page, in the Downloads search box, choose Software-Defined WAN (SD-WAN).

4. In the Select a Product page, from the right-most pane, choose XE SD-WAN Routers.

5. From the right-most pane, select your router model.

6. Click the desired software release version to download it. The software image name has the format router-model-ucmk9.​release-number

7. Copy the software image to an HTTP or FTP file server in your local network.

All new Cisco IOS XE Catalyst SD-WAN devices ships with the Cisco IOS XE Catalyst SD-WAN software already installed.

If you have an existing Cisco IOS XE Catalyst SD-WAN device, follow these steps to install the Cisco IOS XE Catalyst SD-WAN software. The router reboots with the Cisco IOS XE Catalyst SD-WAN image.

1. Download the Cisco IOS XE Catalyst SD-WAN software image from the Cisco site. 

2. Upload the Cisco IOS XE Catalyst SD-WAN software image from the file server to the bootflash of the device. Sample syntax for FTP is given below:

   Device# (config)# ip ftp source-interface interface 
   Device# copyftp:// username:password@server-IP/file-location bootflash:
   TFTP:
   Device(config)# ip tftp source-interface interface
   Device(config)# ip tftp blocksize 8192
   Device(config)#exit
   Device#copy tftp: bootflash:  
   SCP (assumes SSH is enabled):
   Device# configure terminal
   Device# (config)# ip scp server enable
   FileServer$ scp filenameusername@router-IP:/filename
   

3. Ensure that the device is connected to a management console.

4. Create a backup of the current configuration that can be saved in the bootflash of the device.

   Device# copy run bootflash:original-xe-config
   

5. Remove all existing boot statements and save the configuration.

   ISR4K# (config)# no boot system ... 
   ISR4K# wr mem
   

6. Verify that the BOOT variable is blank in the following output.

   ISR4K# show bootvar 
   BOOT variable = 
   CONFIG_FILE variable does not exist 
   BOOTLDR variable does not exist 
   Configuration register is 0x2102 
   Standby not ready to show bootvar

7. Add a boot variable that points to the Cisco IOS XE Catalyst SD-WAN image.

   Device(config)# boot system flash bootflash:
   SDWAN-image 
   Device(config)# exit
   ISR4K# write memory
   

8. Verify that the BOOT variable points to the Cisco IOS XE Catalyst SD-WAN image.

   Device# show bootvar
   BOOT variable =  bootflash:isr4300-ucmk9.16.10.1a.SPA.bin,1; 
   CONFIG_FILE variable does not exist 
   BOOTLDR variable does not exists 
   Configuration register is 0x2102
   Standby not ready to show bootvar

9. Remove all existing configurations from the router.

   Device# write erase
   

10. Set the config-register to 0x2102.

    Device# configure terminal 
    Deovce(config)# config-register 0x2102 
    Device(config)# end
    

11. Verify that the config-register is set to 0x2102 or that it will be set to 0x2102 at the next reboot.

    Device# show bootvar
    

12. Reboot the router.

    ISR4K# reload
    Proceed with reload? [confirm] Yes
    If prompted to save the configuration, enter No. The router reboots with the XE SD-WAN image.

13. If prompted to enter the initial configuration dialog, enter No.

    --- System Configuration Dialog --- 
    Would you like to enter the initial configuration dialog? [Yes/No]: No
    

14. If prompted to terminate auto-install, enter Yes.

    Would you like to terminate auto-install? [Yes/No]: Yes
    

15. At the login prompt, log in with the default username and password as  admin.

    The default password can be used once and then must be changed. If the initial configuration session times out or if the session is interrupted or terminated before the password is changed and saved, subsequent login attempts fail. To restore login access to the device, you must reset the password to its default value through the local console in ROMMON mode. Then the initial provision process must be restarted. For information about restoring the password, see Recover the Default Password.

16. Stop PnP and allow the Cisco IOS XE Catalyst SD-WAN packages to install:

    ISR4K# pnpa service discovery stop
    

17. Configure the upgrade on Cisco IOS XE Catalyst SD-WAN device using request platform software sdwan software upgarde-confirm.

    Router# request platform software sdwan software upgrade-confirm 
    Router#
    *Sep 21 00:26:29.242: %INSTALL-5-INSTALL_START_INFO: R0/0: install_engine: Started install commit PACKAGE
    *Sep 21 00:26:30.153: %INSTALL-5-INSTALL_COMPLETED_INFO: R0/0: install_engine: Completed install commit PACKAGE
    Router#
    
    

18. Ensure output of show sdwan software shows CONFIRMED state as user and no other value.

    Router# sh sdwan software 
    VERSION       ACTIVE  DEFAULT  PREVIOUS  CONFIRMED  TIMESTAMP                  
    -------------------------------------------------------------------------------
    16.12.1b.0.4  true    true     true      user       2019-09-21T00:24:22-00:00  
    
    Total Space:388M Used Space:86M Available Space:298M
    

19. Configure the Cisco IOS XE Catalyst SD-WAN device using request platform software sdwan software reset.

    Router# request platform software sdwan software reset
    
    *Sep 21 00:27:20.025: %INSTALL-5-INSTALL_START_INFO: R0/0: install_engine: Started install activate bootflash:isr4300-ucmk9.16.12.1b.SPA.bin
    *Sep 21 00:27:43.105: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
    Router#
    *Sep 21 00:28:47.233: %INSTALL-5-INSTALL_COMPLETED_INFO: R0/0: install_engine: Completed install activate PACKAGESep 21 00:28:54.240: %PMAN-5-EXITACTION: R0/0: pvp: Process manager

Note	Once you have installed this image, remember to use the command config-transaction to open CLI configuration mode. The config terminal command is not supported on Cisco Catalyst SD-WAN routers.

Note

Downgrading to fresh install of old image versions is not supported. You can only downgrade to a previous existing version of old image. For example, if you have never installed Cisco IOS XE Catalyst SD-WAN 16.10.3 on your Cisco IOS XE Catalyst SD-WAN device, and if you try to downgrade from Cisco IOS XE Catalyst SD-WAN 16.11.1 release to Cisco IOS XE Catalyst SD-WAN 16.10.3 release then this operation is unsupported and results in unpredictable behavior. However, if you had a 16.10.3 image installed previously, then you could reactivate it by using the request platform software sdwan activate command.

Note

Data is migrated from an existing Cisco Catalyst SD-WAN image to a new Cisco Catalyst SD-WAN image only during an upgrade. After an upgrade is completed, there is no migration of data between different versions of installed images for both Cisco IOS XE Catalyst SD-WAN and Cisco vEdge devices. For example, if you had installed 19.2.4 previously, and 20.3.2 is your current active image, then if you activate the 19.2.4 image, the additional configurations from 20.3.2 will not be migrated to 19.2.4.

If your Cisco IOS XE Catalyst SD-WAN device is connected to a DHCP server, PnP runs automatically and Cisco SD-WAN Manager automatically configures the device after the control connections are up. To verify that the control connections are up and the device is validated, enter the following command at the system prompt:

Device# show sdwan control connections

If your IOS Ex router is connected to a DHCP server and you are not using PnP, or if your IOS XE router is not connected to a DHCP server on the WAN, configure the router manually using the CLI as shown in the following steps.

You also can configure the hostname by using the system host-name hostname command. Configuring the hostname is optional, but it is recommended because this name in included as part of the prompt in the CLI and it is used on various Cisco SD-WAN Manager screens to refer to the device. This command is not available on the device CLI but it is available when using the CLI device template.

1. Connect to the router using a management console.

2. Stop PnP to allow access to the CLI:

   Device# pnpa service discovery stop
   

3. Enter configuration mode:

   Device# config-transaction
   Device(config)#

4. Configure the system IP address.

   Device(config-system)# system-ip  ip-address
   

   Cisco SD-WAN Manager uses the system IP address to identify the device so that the NMS can download the full configuration to the device.

5. Configure the numeric identifier of the site where the device is located:

   Device(config-system)# site-id site-id
   

6. Configure the IP address of the Cisco SD-WAN Validator or a DNS name that points to the Cisco SD-WAN Validator. The Cisco SD-WAN Validator's IP address must be a public IP address, to allow the router to reach the Cisco SD-WAN Validator.

   Device(config-system)# vbond (dns-name | ip-address)

7. Configure the organization name, which is the name that is included in the certificates on all devices in the overlay network. This name must be the same on all devices.

   Device(config-system)# organization-name name
   

8. Configure the tunnel interface to use for overlay connectivity. Ensure that the tunnel interface ID does not conflict with any other interface IDs that may be auto-assigned by Cisco SD-WAN Manager. You can verify this in configuration preview.

   Device(config)# interface Tunnel #    
   Device(config-if)# ip unnumbered wan-physical-interface   
   Device(config-if)# tunnel source wan-physical-interface    
   Device(config-if)# tunnel mode sdwan
   

   Note

   If you are using Cisco SD-WAN Manager feature templates for your configuration, a tunnel interface is automatically assigned based on the WAN interface used. If you switch to Cisco SD-WAN Manager mode from CLI mode, the tunnel interface you configured may change because Cisco SD-WAN Manager automatically assigns a tunnel interface number based on the WAN interface used. This change in tunnel number can cause the tunnel to go down before it comes up again when the configuration is pushed.

9. If the router is not connected to a DHCP server, configure the IP address of the WAN interface:

   Device(config)# interface GigabitEthernet  #    
   Device(config)# ip address  ip-address mask   
   Device(config)# no shut   
   Device(config)# exit
   

10. Configure tunnel parameters:

    Device(config)# sdwan    
    Device(config-sdwan)# interface  WAN-interface-name    
    Device(config-interface-interface-name)# tunnel-interface   
    Device(config-tunnel-interface)# color color/path-name    
    Device(config-tunnel-interface)# encapsulation  ipsec
    

11. If an IP address is manually configured on the router, configure a default route:

    Device(config)# ip route 0.0.0.0 0.0.0.0 next-hop-ip-address
    

12. If the Cisco SD-WAN Validator address was defined as a hostname, configure DNS:

    Device(config)# ip domain lookup 
    Device(config)# ip name-server dns-server-ip-address 

13. Save the changes and exit configuration mode:

    Device(config)# commit and-quit 
    Device# exit
    

14. If you are using a certificate signed by your enterprise root CA, install the certificate:

    Device# request platform software sdwan root-cert-chain install bootflash: certificate
    

15. Verify that the control connections are up and the router is validated.

    Device# show sdwan control connections 
    
    PEER    PEER PEER         SITE  DOMAIN  PEER         PEER PRIV  PEER        PEER PUB                                            
    TYPE    PORT SYSTEM IP    ID    ID      PRIVATE IP   PORT       PUBLIC IP   PORT     LOCAL COLOR               
    --------------------------------------------------------------------------------------------------
    vsmart  dtls 192.168.1.2  10    1       172.1.1.3    12346      172.1.1.3   12346     biz-internet                    
    vbond   dtls -             0    0       172.1.1.4    12346      172.1.1.4   12346     biz-internet                     
    vmanage dtls 192.168.1.3  10    0       172.1.1.2    12346      172.1.1.2   12346     biz-internet       
                             
                              CONTROLLER
                              GROUP
    PROXY STATE  UPTIME       ID
    ------------------------------------       
      up         1:19:51:40   0
      up         1:19:51:45   0
      up         1:19:51:38   0
                                 

You can now configure SD-WAN features on the router using Cisco SD-WAN Manager templates.

To add a device to the Plug and Play portal:

• If the device can reach the PNP portal, see Cisco Plug and Play Support Guide for ​Cisco Catalyst SD-WAN Products.

• If the device does not have access to the PNP portal, see Start the Enterprise ZTP Server and Prepare Routers for ZTP sections in the ​Cisco Catalyst SD-WAN Overlay Network Bring-Up Process chapter.

Note	When devices are due for Return Materials Authorization (RMA), the device details are with Cisco PNP. However, you cannot delete these devices from the RMA list in Cisco SD-WAN Manager. Instead Cisco SD-WAN Manager administrator can mark the devices returned as invalidated as per RMA.

For information abour Cisco IOS XE Release 17.2 and later, see Install and Upgrade Cisco IOS XE Release 17.2 and Later.

This section describes how to upgrade or downgrade the ROM monitor (ROMmon) version that is running on a device. Perform this procedure if you need to change a ROMmon version to a required version that is shown in the “Before You Begin” section.

To determine the ROMmon version that is running on a device, enter the following command:

Device# Show rom-monitor R0  

To upgrade or downgrade ROMmon, follow these steps:

1. Take either of these actions:

   1. Load the ROMmon file into the device bootflash using a method such as SCP, FTP, TFTP, or a USB drive.

   2. If you do not have out-of-band management access to the router, transfer the ROMmon file by using Cisco SD-WAN Manager CLI, as shown in the following example:

      vManage# request execute vpn 0 scp -P 830 C1100-rommon-16-1r-SPA.pkg 
      admin@router-ip-address:/bootflash/vmanage-admin/C1100-rommon-169-1r-SPA.pkg

2. Take either of these actions to verify that the ROMmon file that you loaded or transferred appears in the directory output:

   1. If you loaded the ROMmon file into the device bootflash, enter the following command:

      Device# dir bootflash
      

   2. If you transferred the ROMmon file by using the Cisco SD-WAN Manager CLI, enter the following command:

      vManage# dir bootflash:vmanage-admin
      

3. Enter the following command to set config-register to 0x2102:

   Device# config-register 0x2102
   

4. Upgrade (or downgrade) the ROMmon file on your device by using the upgrade command as shown in the following examples:

   • Example upgrade command if you loaded the ROMmon file into the device bootflash:

     Device# upgrade rom-monitor filename bootflash: C1100-rommon-169-1r-SPA.pkg R0
     

   • Example upgrade command if you transferred the ROMmon file by using Cisco SD-WAN Manager CLI:

     vManage# upgrade rom-monitor filename bootflash:vmanage-admin/C1100-rommon-169-1r-SPA.pkg R0
     

5. After a series of messages pertaining to the upgrade display and the router prompt displays, enter the following command to reload the router:

   Device# Reload
   

6. Enter the following command and verify that the output shows the new ROMmon version:

   ISR4K# Show rom-monitor R0
   

This section describes the Factory Reset feature and how it can be used to protect or restore a router to an earlier fully functional state. For information on factory reset procedures on different platforms, see:

• Cisco ASR 1000 Series Aggregation Services Routers

• Cisco 4000 Series Integrated Services Routers

• Cisco Cloud Services Router 1000V Series

Note	To perform factory-reset on a Cisco IOS XE Catalyst SD-WAN ASR 1000 router, ensure that the router is booted in subpackages mode. Execute show version command and check the output for system image file to determine the booted image.

Device# show version
Cisco IOS XE Software, Version BLD_POLARIS_DEV_LATEST_20200303_002119_V17_X_X_XX
Cisco IOS Software [Amsterdam], ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), 
Copyright (c) 1986-2020 by Cisco Systems, Inc.
Compiled Tue 03-Mar-20 00:29 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2020 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: IOS-XE ROMMON

2KP-CEDGE uptime is 3 minutes
Uptime for this control processor is 5 minutes
System returned to ROM by Reload Command
System image file is "bootflash:packages.conf"

SMU Image Files

Each SMU image filename in the software repository includes a base image version and the defect ID related to the fix. In the image name:

• base_image_version is the Cisco IOS XE image version.

• defect_id is the identifier of the defect for which the SMU package has the fix.

SMU Types

An SMU type describes the effect of an installed SMU package on a Cisco IOS XE Catalyst SD-WAN device. The following are the SMU package types:

• Hot SMU (non-reload): Enables an SMU package to take effect after an SMU image activation without rebooting (reloading) the Cisco IOS XE Catalyst SD-WAN device.

• Cold SMU (reload): Enables an SMU package to take effect after rebooting (reloading) the Cisco IOS XE Catalyst SD-WAN device.

Benefits of Software Maintenance Upgrades

• Allow you to address a network issue quickly while reducing the time and scope of the testing required. The Cisco IOS XE Catalyst SD-WAN device internally validates the SMU image compatibility and does not allow you to install non-compatible SMU packages.

• Allow you to install or activate only one SMU package on devices at a time to simplify the initial implementation process.

• Allow you to install an SMU package on multiple Cisco IOS XE Catalyst SD-WAN devices at the same time when installing using Cisco SD-WAN Manager. To install an SMU package on multiple devices using the CLI, ensure that you repeat the install process on multiple devices.

Add, View, and Activate an SMU Image

1. Add an SMU image using the Cisco SD-WAN Manager software repository.

   See the Cisco SD-WAN Manager Add Software Images to Repository procedure in the ​Cisco Catalyst SD-WAN Monitor and Maintain Configuration Guide.

2. View SMU images using the Cisco SD-WAN Manager software repository.

   See theCisco SD-WAN Manager View Software Images procedure in the ​Cisco Catalyst SD-WAN Monitor and Maintain Configuration Guide. Note the following points when viewing SMU images:

   • The Available SMU Versions column displays the number of SMU images available for the current base image version (Cisco IOS XE image version).

   • View the defects that are associated with an SMU image by clicking a desired entry in the Available SMU Versions column. In the Available SMU Versions dialog box, you can view the defect ID, the corresponding SMU version, and the SMU types, such as non-reload or reload.

   • In the Available SMU Versions dialog box, delete an SMU version by clicking the delete icon next to an SMU version.

3. Upgrade an SMU image using the Cisco SD-WAN Manager software upgrade window.

   See the Cisco SD-WAN Manager Upgrade the Software Image on a Device procedure in the ​Cisco Catalyst SD-WAN Monitor and Maintain Configuration Guide. Note the following points about the SMU image that you choose to upgrade:

   • In the devices table, the Available SMUs column displays the number of SMU images that are available for the current base image version.

   • View a list of all available SMU versions and the upgrade images for a device by clicking a desired entry under the Available SMUs column. In the Available SMUs dialog box, you can view the SMU versions, SMU types, and the state of an SMU version.

     The SMU version is in the format base_image_version.cdet_id.

   • In the Upgrade dialog box, optionally check Activate and Reboot to activate an SMU image and perform a reboot of the Cisco IOS XE Catalyst SD-WAN device automatically.

     After you check the Activate and Reboot check box, Cisco SD-WAN Manager installs and activates the SMU image on a device and triggers a reload based on the SMU type. For more Information about activating a software image, see the Cisco SD-WAN Manager Activate a Software Image procedure in the ​Cisco Catalyst SD-WAN Monitor and Maintain Configuration Guide.

   After a successful upgrade of an SMU image, the Cisco IOS XE Catalyst SD-WAN device sends a corresponding success message.

Deactivate or Remove an SMU Image

Deactivate an SMU image and remove the image from a device using the Delete a Software Image procedure in the ​Cisco Catalyst SD-WAN Monitor and Maintain Configuration Guide.

Onboarding ISR1100 to Cisco SD-WAN Manager

1. Do not enable the Cisco IOS XE Catalyst SD-WAN device interface on the ISR1100 device.

2. Add the serial.viptela file to Cisco SD-WAN Manager to add the device.

3. From the Cisco SD-WAN Manager menu, choose Configuration > Devices > Migrate Device to migrate from viptela operating system to Cisco IOS XE operating system.

4. Enable the Cisco IOS XE Catalyst SD-WAN device interface to bring up the control connections.

5. Verify the device sync up in Cisco SD-WAN Manager.

Install and Activate an SMU Image Using the CLI

1. Upload the SMU image from the file server to the bootflash of the device.

   Use the copy command to upload an SMU image. For information about the copy command, see Step 2 of the Install the Cisco IOS XE Software topic.

2. If not already configured, configure the time limit for confirming that a SMU image activation is successful.

   The time limit can be 1 through 60 minutes. We recommend that you configure the time limit to be at least 15 minutes.

   Device# config-transaction 
   Device(config)# system 
   Device(config-system)# upgrade-confirm minutes 

3. Install an SMU image from the bootflash of your device and perform a compatibility check for the device and SMU package version.

   Device# request platform software sdwan smu install file-path

4. Activate the SMU image on a Cisco IOS XE Catalyst SD-WAN device.

   Device# request platform software sdwan smu activate build-number.smu-defect-id

5. Confirm the upgrade of the SMU image within the configured confirmation time limit.

   Device# request platform software sdwan smu upgrade-confirm

   Note	If you don’t issue this command on the device within the time limit that is specified in the upgrade-confirm minutes command, the device automatically reverts to the state that it was in before the SMU image activation.

Deactivate and Remove an SMU Image Using the CLI

1. If not already configured, configure the time limit for confirming that a SMU image deactivation is successful.

   The time limit can be 1 through 60 minutes. We recommend that you configure the time limit to at least 15 minutes.

   Device# config-transaction 
   Device(config)# system 
   Device(config-system)# upgrade-confirm minutes 

2. Deactivate an SMU image on a Cisco IOS XE Catalyst SD-WAN device.

   Device# request platform software sdwan smu deactivate build-number.smu-defect-id

3. Confirm that the SMU image can be deactivated.

   Device# request platform software sdwan smu upgrade-confirm

   Note	If you do not issue this command on the device within the time limit specified in the upgrade-confirm minutes command, the image deactivation fails and the device automatically reverts to the state that it was in before the SMU image deactivation.

4. Remove an SMU image from a Cisco IOS XE Catalyst SD-WAN device.

   Device# request platform software sdwan smu remove build-number.smu-defect-id

The following examples show commands that you can use to manage the SMU image operations.

• Check the upgrade and confirm the configuration:

  show sdwan running system

• Add and upgrade the confirm timer:

  config-transaction
  system
  upgrade-confirm 15
  commit

• Execution commands:

  • request platform software sdwan smu install bootflash:c8000v-universalk9.2022-08-17_23.44_mcpre.24042.CSCvq24042.SSA.smu.bin

  • request platform software sdwan smu activate 17.09.01a.0.247.CSCvq24042

  • request platform software sdwan smu upgrade-confirm

  • request platform software sdwan smu deactivate 17.09.01a.0.247.CSCvq24042

  • request platform software sdwan smu upgrade-confirm

  • request platform software sdwan smu remove 17.09.01a.0.247.CSCvq24042

Monitor SMU Status Using Cisco SD-WAN Manager

1. From the Cisco SD-WAN Manager menu, choose Maintenance > Software Upgrade.

2. For the desired Cisco IOS XE Catalyst SD-WAN device, click an SMU image link (hyperlink) under Available SMUs.

   In the Available SMUs dialog box, you can view the state of an SMU image.

If no SMU images are available for the current base image version (Cisco IOS XE image version), the SMU image link is not available under Available SMUs and Cisco SD-WAN Manager displays 0.

Verify SMU Status Using the CLI