Before You Begin

Ensure that you have the following:

• An active Cisco Smart Account.

• An active Cisco Virtual Account.

• The SA-Admin role for your Cisco Smart Account. (Required to access the Cisco Catalyst SD-WAN Portal for the first time and to create a fabric. Not required thereafter.)

• A valid order for controllers on Cisco Commerce (formerly CCW).

Procedure

1. Go to the URL that you received in the email from Cisco to access the Cisco Catalyst SD-WAN Portal, and log in.

2. From the Cisco Catalyst SD-WAN Portal menu, choose Create Overlay.

   The Create Cisco Hosted Fabric page appears.

3. From the Smart Account drop-down list, choose the name of the Cisco Smart Account to which you want to associate the fabric.

4. From the Virtual Account drop-down list, choose the name of the Cisco Virtual Account to which you want to associate the fabric.

5. Click Assign Controllers and perform the following actions in the Assign Controllers area:

   1. Configure the options for the number of controller types in a dedicated fabric, as described in following table.

      Option	Description
      Assign (for the vManage controller type)	Enter the number of Cisco SD-WAN Manager controllers in your deployment. Valid values are 1, 3, or 6.
      Assign (for the vBond controller type)	Enter the number of Cisco SD-WAN Validators in your deployment. The minimum value is 2.
      Assign (for the vSmart controller type)	Enter the number of Cisco SD-WAN Controllers in your deployment. The minimum value is 2.
      Enable Cluster	Applies only if you choose a value of 3 or 6 for the number of Cisco SD-WAN Manager controllers. Turn on this option to create a Cisco SD-WAN Manager cluster.
      Cluster Type	Applies only if you turn on the Enable Cluster option. Choose Single Tenant Cluster to enable a single tenant cluster.

   2. Click Assign.

6. In the Fabric field, enter a name for your fabric.

7. Under Cloud Provider, choose AWS as the cloud provider at which you want Cisco to host the controllers for your fabric.

8. From the SD-WAN Version drop-down list, choose the version of Cisco Catalyst SD-WAN that you want to use on your controllers.

   Choose the recommended version unless there are specific features that you need and these features are available only in another version. For information about recommended versions, go to Cisco Software Central. For information about Cisco Catalyst SD-WAN releases, see the Cisco Catalyst SD-WAN Release Notes in the Release Information area in User Documentation for Cisco IOS XE (SD-WAN) Release 17.

9. Under Locations, perform these actions:

   1. From the Primary Location drop-down list, choose the geographical location where the Cisco SD-WAN Manager controllers are provisioned.:

      We recommend that you choose a location that is relatively close to your network.

   2. From the Secondary Location drop-down list, choose the geographical location for backed up data storage and load balancing. If you choose the same region for both primary and secondary, then SSP automatically places the instances in two different Zones within the same region.

      Note	Cisco recommends that you choose a location that is closest to the primary location.

   3. From the Data Location drop-down list, choose the geographical location for Cisco Catalyst SD-WAN Analytics data storage.

      We recommend that you choose the location that is closest to the primary location.

10. Enter the following information under Contacts:

    • In the Fabric Admins field, enter one or more comma separated email addresses or mailer list names to which the Cisco Catalyst SD-WAN Portal sends notifications about the fabric.

    • In the Cisco Contact Email field, enter the email address of a contact at Cisco that can be reached if there is an urgent issue and the administrator of the fabric cannot be reached.

    • In the Enter Contract number of service field, enter the number of your Cisco Catalyst SD-WAN Portal service contract.

    • In the Enter CCO ID of Service Requester field, enter the Cisco ID of the person who created the ticket for your Cisco Catalyst SD-WAN Portal.

    Alert Notifications: SSP sends alert notifications to customers for various reasons such as expiring subscription, maintenance windows, feature changes, etc. SSP notifications are sent to the registered 'Overlay Admin' contact email addresses configured under overlay details. It is customer responsibility to keep this email addresses updated. Customers can register multiple email addresses. Perform the following steps to update email addresses:

    1. Login to SSP at https://ssp.sdwan.cisco.com. You must have Cisco PNP Smart Account Administrator role to be able to login.

       Alternately, if your Smart Account Administrator has already setup IDP on SSP, then you can login with the role provided by your Administrator.

    2. Go to Overlay Details > Description > Overlay Admin

    3. Click on the pencil icon to edit.

    4. Type in your email address and hit Tab.

    5. Click on the check mark icon to save.

11. Configure the following Advanced Options, as needed.

    For detailed information about these options, see Configure Advanced Options for a Cisco Catalyst SD-WAN Cloud Hosted Fabric.

    • Custom Subnets: Options for configuring private IP addresses to be used for controller interface IP addresses.

    • Custom Domain Settings: Options for configuring custom domains for accessing Cisco SD-WAN Validator and Cisco SD-WAN Manager controllers.

    • Snapshot Settings: Option for configuring how often the system takes a snapshot ofCisco SD-WAN Manager instances in your deployment.

    • Custom Organization Name: Option for configuring a unique organization name to identify your network.

    • Dual Stack: Option for enabling IPv6 dual stack.

12. Click Click here to review and agree to Terms & Conditions before proceeding, and in the Terms and Conditions dialog box, review the information that is shown and click I Agree.

13. Click Create Fabric.

    The system creates the fabric. This process can take up to 60 minutes. Information about the progress of this process appears in the Create Fabric Progress area.

    In addition, a password appears in the Cisco Catalyst SD-WAN Portal Notification page. Use this password to access the fabric for the first time.

    To secure your environment, we recommend that you immediately change this password after logging in.

    Note	The system-provided controller password is no longer visible in the Cisco Catalyst SD-WAN Portal after seven days. We recommend that you keep a copy of the password if you want to retain it.

14. After you receive a notification that your fabric is ready:

    • Install the controller certificates on your devices. For information about installing controller certificates, see Use Case: Cisco-Hosted Cloud Overlays with Software Version 19.x and Above.

    • Install web server certificates. For information about installing web server certificates, see Web Server Certificates.

Custom Subnets

The Custom Subnets area includes options for configuring private IP addresses to be used for controller interface IP addresses.

For use cases such as connecting to an enterprise TACACS; connecting to an authentication, authorization, and accounting (AAA) server; sending messages to a syslog server; or management access to instances over the fabric, you may want to deploy the controllers with their private IP addresses in specific prefixes. These prefixes are unique and unused elsewhere within your fabric.

Custom Domain Settings

The Custom Domain Settings area includes options for configuring custom domains for accessing Cisco SD-WAN Validator and Cisco SD-WAN Manager controllers.

By default, the domain name is cisco.com. You can specify another domain, if needed, for your deployment.

If you specify a custom domain, you must create your own domain name systems for the Cisco SD-WAN Validator and Cisco SD-WAN Manager because Cisco does not have access to your domains.

After you configure a custom domain, make the following mappings to allow controller certificates to come up:

• Map the Cisco SD-WAN Validator DNS to all VPN 0 IP addresses.

• Map the Cisco SD-WAN Manager DNS to all VPN 512 IP addresses.

Snapshot Settings

The Snapshot Settings area includes an option for configuring how often the system takes a snapshot of Cisco SD-WAN Manager instances in your deployment.

By default, the network overlay configuration is backed up once a day and ten snapshots are stored.

For more detailed information about snapshots, see Information About Snapshots.

Custom Organization Name

The Custom Organization Name area includes an option for configuring a unique organization name to identify your network.

Dual Stack

The Dual Stack area includes an option for enabling IPv6 for controllers.

Enabling this option is required if your enterprise network is configured with IPv6. After this option is enabled, the fabric subnets are configured with both IPv4 and IPv6. IPv6 addresses are assigned by your cloud service provider.

Note	After this option is enabled for a fabric, it cannot be disabled.

Information About Predefined Inbound Rules

With this feature you can create inbound rules, each of which specifies trusted IP addresses. These IP addresses are applied to any new overlay that you create under the Smart Account for which you configure this feature. These IP addresses can also be applied to existing overlays under the Smart Account for which you configure this feature.

An inbound rule includes the rule name, protocol and port range to which the rule applies, and source IP address or prefix information. You can create up to 200 inbound rules.

Use Cases for Predefined Inbound Rules

Predefined inbound rules provide a convenient way to add the same group of trusted IP addresses to existing and new overlays. By creating predefined inbound rules, you avoid having to configure trusted IP address for each overlay manually.

Configure Predefined Inbound Rules

1. From the Cisco Catalyst SD-WAN Portal menu, choose Admin Settings.

2. Click … adjacent to the Smart Account for which you want to configure a predefined inbound rule and click Manage Predefined Inbound Rules.

   A list of the inbound rules that have been configured appears.

3. Click Add Predefined Inbound Rules.

4. In the Add Inbound Rule area, perform these actions:

   1. In the Name field, enter a unique name for the rule.

   2. From the Rule Type drop-down list, choose the type of protocol to which the rule applies (All, SSH, HTTPS, Custom TCP rule, or Custom UDP rule).

   3. If you choose a rule type of Custom TCP rule or Custom UDP rule, in the Port Range field, enter a port range to which the rule applies.

   4. In the Source field, enter an IP address or IP address prefix.

   5. In the Description field, enter a descriptions of the predefined inbound rule.

   6. (Optional) Click Automatically add this rule to ALL overlays to add this new rule to existing overlays under this Smart Account, in addition to future overlays that are created under this Smart Account.

      If you do not click this option, this rule is added to future overlays only.

   7. Click Add.