Week 1 Day 1: Prerequisites and SaaS App Inventory¶
SaaS Application Registry¶
Document all SaaS applications before configuring probes:
# saas_app_inventory.yaml
applications:
office_365:
vendor: "Microsoft"
type: "saas_builtin" # vManage has native O365 support
users: 3200 # All 19 sites
traffic_types: [exchange, teams, sharepoint, onedrive, azure_ad]
priority: critical
sla:
latency_ms: 50
loss_pct: 0.5
jitter_ms: 10
preferred_transport: [azure_expressroute, mpls, dia]
webex_calling:
vendor: "Cisco"
type: "saas_builtin" # Native vManage support
users: 3200
traffic_types: [voice_media, signaling, meetings]
priority: critical
sla:
latency_ms: 30
loss_pct: 0.1
jitter_ms: 5
preferred_transport: [mpls, dia]
salesforce:
vendor: "Salesforce"
type: "saas_builtin"
users: 800
probe_fqdn: "login.salesforce.com"
priority: high
sla:
latency_ms: 100
loss_pct: 1.0
preferred_transport: [mpls, dia]
servicenow:
vendor: "ServiceNow"
type: "saas_builtin"
users: 400
probe_fqdn: "abhavtech.service-now.com"
priority: high
sla:
latency_ms: 100
loss_pct: 1.0
preferred_transport: [mpls, dia]
workday:
vendor: "Workday"
type: "saas_builtin"
users: 1200
probe_fqdn: "wd3.myworkday.com"
priority: high
sla:
latency_ms: 100
loss_pct: 1.0
preferred_transport: [mpls, dia]
zoom:
vendor: "Zoom"
type: "saas_custom"
users: 500
probe_fqdn: "zoom.us"
priority: medium
sla:
latency_ms: 80
loss_pct: 0.5
preferred_transport: [dia, mpls]
vManage Pre-Checks¶
## Verify vManage version and license
## Navigate to: Administration → About
## Required: vManage 20.12+ for full Cloud OnRamp feature set
## Verify SD-WAN Manager API access
curl -k -s -X POST \
https://vmanage.abhavtech.com/j_security_check \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "j_username=admin&j_password=<PASSWORD>" \
-c /tmp/cookies.txt
## Test API connectivity
curl -k -s -X GET \
https://vmanage.abhavtech.com/dataservice/device \
-b /tmp/cookies.txt | python3 -m json.tool | head -30
## Verify all WAN edges are connected and in operational state
curl -k -s -X GET \
"https://vmanage.abhavtech.com/dataservice/device?type=vedge" \
-b /tmp/cookies.txt | python3 -c "
import json, sys
devices = json.load(sys.stdin)['data']
for d in devices:
print(f'{d[\"host-name\"]:20} {d[\"reachability\"]:12} {d[\"status\"]}')
"
## Expected: All 19 WAN edges show reachability=reachable, status=normal
Verify Transport Color Labels¶
Each WAN transport must have a color label for policy matching:
TRANSPORT COLOR ASSIGNMENTS:
┌─────────────────────────────────────────────────────────────────┐
│ Transport Type │ Color Label │ Sites │
├─────────────────────────────────────────────────────────────────┤
│ MPLS (Tata MPLS) │ mpls │ Hub + Large Brnch│
│ Internet DIA (Tata/BT) │ dia │ All sites │
│ ExpressRoute (Azure) │ azure-expressroute │ Hub sites only │
│ LTE (Jio/Airtel) │ lte │ Branch sites │
└─────────────────────────────────────────────────────────────────┘
! Verify on a WAN edge device:
show sdwan control connections
! Look for color labels in output
! On C8500-12X hub:
show sdwan interface
! Expected output includes all transports with their color labels
Week 1 Day 2: vManage SaaS Probe Configuration¶
Step 1: Enable Cloud OnRamp for SaaS¶
Navigate: Configuration → Cloud OnRamp for SaaS
Enable: ON
Probe frequency: Every 2 minutes
Probe timeout: 3000ms
Best path threshold: 5% loss or 30ms latency difference
Step 2: Configure SaaS Application Probes (vManage UI)¶
Office 365 — Native Integration:
Navigate: Configuration → Cloud OnRamp for SaaS → Add App Cloud
Application: Office 365
Regions:
APAC (Primary):
Gateway: Mumbai (MUM-HUB-01)
Probe Sites: Mumbai, Chennai, Bangalore, Delhi, Noida + 9 India branches
EMEA (Primary):
Gateway: London (LON-HUB-01)
Probe Sites: London, Frankfurt
Americas (Primary):
Gateway: New Jersey (NJ-HUB-01)
Probe Sites: New Jersey, Dallas, Chicago
Probe Type: HTTP/HTTPS
Probe Interval: 2 minutes
Salesforce — Custom Probe:
Application: Salesforce
Custom probe URL: https://login.salesforce.com
Expected HTTP response: 200
Probe sites: All 19 sites
Gateway sites: Mumbai (APAC), London (EMEA), New Jersey (Americas)
ServiceNow — Custom Probe:
Application: ServiceNow
Custom probe URL: https://abhavtech.service-now.com/login.do
Expected HTTP response: 200
Probe sites: All 19 sites
Gateway sites: Mumbai (APAC), London (EMEA), New Jersey (Americas)
Step 3: Configure Probe via vManage API¶
For automated deployment, use the REST API:
#!/usr/bin/env python3
"""
Configure Cloud OnRamp SaaS probes via vManage API
"""
import requests
import json
import urllib3
urllib3.disable_warnings()
VMANAGE_HOST = "vmanage.abhavtech.com"
USERNAME = "admin"
PASSWORD = "<VMANAGE_PASSWORD>"
class VManageSession:
def __init__(self, host, username, password):
self.base_url = f"https://{host}"
self.session = requests.Session()
self.session.verify = False
self._login(username, password)
def _login(self, username, password):
resp = self.session.post(
f"{self.base_url}/j_security_check",
data={"j_username": username, "j_password": password},
headers={"Content-Type": "application/x-www-form-urlencoded"}
)
if resp.status_code != 200:
raise Exception(f"Login failed: {resp.status_code}")
## Get XSRF token
token_resp = self.session.get(f"{self.base_url}/dataservice/client/token")
self.session.headers.update({"X-XSRF-TOKEN": token_resp.text})
print("✅ Authenticated to vManage")
def get(self, endpoint):
return self.session.get(f"{self.base_url}/dataservice/{endpoint}")
def post(self, endpoint, payload):
return self.session.post(
f"{self.base_url}/dataservice/{endpoint}",
json=payload,
headers={"Content-Type": "application/json"}
)
def configure_saas_probes(vmanage):
"""Configure Cloud OnRamp SaaS probes for all applications"""
## Get list of all WAN edge devices
devices_resp = vmanage.get("device?type=vedge")
devices = devices_resp.json()["data"]
device_ids = {d["host-name"]: d["system-ip"] for d in devices}
print(f"✅ Found {len(device_ids)} WAN edge devices")
## Get all sites for probe assignment
hub_sites = [
device_ids.get("MUM-HUB-01"),
device_ids.get("LON-HUB-01"),
device_ids.get("NJ-HUB-01"),
]
all_sites = list(device_ids.values())
## Configure Office 365 Cloud OnRamp
o365_config = {
"name": "Office365-CloudOnRamp",
"description": "Office 365 SaaS optimization",
"cloudGatewayEnabled": True,
"application": "Office365",
"interfaces": [],
"probeFrequency": 2, # minutes
"probeTimeout": 3000, # ms
"cloudGateways": [
{"systemIp": device_ids["MUM-HUB-01"], "region": "APAC"},
{"systemIp": device_ids["LON-HUB-01"], "region": "EMEA"},
{"systemIp": device_ids["NJ-HUB-01"], "region": "Americas"},
],
"probeSites": all_sites
}
resp = vmanage.post("cloudonramp/saas/apps", o365_config)
if resp.status_code in [200, 201]:
print("✅ Office 365 Cloud OnRamp configured")
else:
print(f"❌ Office 365 config failed: {resp.text}")
## Configure Salesforce Cloud OnRamp
sfdc_config = {
"name": "Salesforce-CloudOnRamp",
"description": "Salesforce CRM optimization",
"application": "Salesforce",
"probeUrl": "https://login.salesforce.com",
"probeFrequency": 2,
"probeTimeout": 3000,
"cloudGateways": [
{"systemIp": device_ids["MUM-HUB-01"], "region": "APAC"},
{"systemIp": device_ids["LON-HUB-01"], "region": "EMEA"},
{"systemIp": device_ids["NJ-HUB-01"], "region": "Americas"},
],
"probeSites": all_sites
}
resp = vmanage.post("cloudonramp/saas/apps", sfdc_config)
if resp.status_code in [200, 201]:
print("✅ Salesforce Cloud OnRamp configured")
else:
print(f"❌ Salesforce config failed: {resp.text}")
## Configure ServiceNow
snow_config = {
"name": "ServiceNow-CloudOnRamp",
"description": "ServiceNow ITSM optimization",
"application": "ServiceNow",
"probeUrl": "https://abhavtech.service-now.com/login.do",
"probeFrequency": 5,
"probeTimeout": 3000,
"cloudGateways": [
{"systemIp": device_ids["MUM-HUB-01"], "region": "APAC"},
{"systemIp": device_ids["LON-HUB-01"], "region": "EMEA"},
{"systemIp": device_ids["NJ-HUB-01"], "region": "Americas"},
],
"probeSites": all_sites
}
resp = vmanage.post("cloudonramp/saas/apps", snow_config)
if resp.status_code in [200, 201]:
print("✅ ServiceNow Cloud OnRamp configured")
else:
print(f"❌ ServiceNow config failed: {resp.text}")
## Configure Workday
wd_config = {
"name": "Workday-CloudOnRamp",
"description": "Workday HCM optimization",
"application": "Workday",
"probeUrl": "https://wd3.myworkday.com",
"probeFrequency": 5,
"probeTimeout": 3000,
"cloudGateways": [
{"systemIp": device_ids["MUM-HUB-01"], "region": "APAC"},
{"systemIp": device_ids["LON-HUB-01"], "region": "EMEA"},
{"systemIp": device_ids["NJ-HUB-01"], "region": "Americas"},
],
"probeSites": all_sites
}
resp = vmanage.post("cloudonramp/saas/apps", wd_config)
if resp.status_code in [200, 201]:
print("✅ Workday Cloud OnRamp configured")
else:
print(f"❌ Workday config failed: {resp.text}")
if __name__ == "__main__":
print("🔧 Configuring Cloud OnRamp SaaS probes...")
vmanage = VManageSession(VMANAGE_HOST, USERNAME, PASSWORD)
configure_saas_probes(vmanage)
print("\n✅ SaaS Probe Configuration Complete")
Week 1 Day 3: Office 365 Cloud OnRamp Policy¶
vManage UI: Application-Aware Routing Policy for O365¶
Step 1: Create O365 App List
Navigate: Configuration → Policies → Lists → App List
App List Name: OFFICE365-APPS
Applications:
✅ office365-exchange (Exchange Online mail)
✅ office365-sharepoint (SharePoint, OneDrive)
✅ ms-teams (Teams voice, video, meetings)
✅ ms-teams-media (Teams media UDP)
✅ microsoft-365 (General M365 services)
✅ azure-active-directory (AAD authentication)
Step 2: Create SLA Classes
Navigate: Configuration → Policies → Lists → SLA Class
## SLA Class Definitions
sla_class_teams_voice:
name: "SLA-TEAMS-VOICE"
latency_ms: 10
loss_pct: 0.5
jitter_ms: 5
description: "Teams real-time voice and video"
sla_class_o365_interactive:
name: "SLA-O365-INTERACTIVE"
latency_ms: 50
loss_pct: 1.0
jitter_ms: 15
description: "Exchange, SharePoint, OneDrive"
sla_class_business_apps:
name: "SLA-BUSINESS-APPS"
latency_ms: 100
loss_pct: 1.0
jitter_ms: 20
description: "Salesforce, ServiceNow, Workday"
sla_class_best_effort:
name: "SLA-BEST-EFFORT"
latency_ms: 300
loss_pct: 3.0
jitter_ms: 50
description: "General internet, background"
Step 3: Hub Site App-Aware Routing Policy
Navigate: Configuration → Policies → Application-Aware Routing Policy → New Policy
Policy Name: Abhavtech-Hub-CloudOnRamp-AAR
Description: Hub site traffic steering for multi-cloud
Applies to: Hub site device templates (MUM, LON, NJ, CHN, DAL)
Sequences (in priority order):
SEQ 10: Teams Voice (Highest Priority — EF)
Match:
App-List: ms-teams-media
Protocol: UDP
Action:
SLA Class: SLA-TEAMS-VOICE
Preferred Color: azure-expressroute (O365 via ER)
Fallback: mpls → dia (in that order)
DSCP Set: EF (46)
Log: Disabled (high volume)
SEQ 20: Teams Signaling
Match:
App-List: ms-teams
Protocol: TCP
Destination Port: 443
Action:
SLA Class: SLA-O365-INTERACTIVE
Preferred Color: azure-expressroute
Fallback: mpls → dia
DSCP Set: CS3 (24)
SEQ 30: Exchange Online (Email)
Match:
App-List: office365-exchange
Action:
SLA Class: SLA-O365-INTERACTIVE
Preferred Color: azure-expressroute
Fallback: mpls → dia
DSCP Set: AF21 (18)
SEQ 40: SharePoint and OneDrive
Match:
App-List: office365-sharepoint
Action:
SLA Class: SLA-O365-INTERACTIVE
Preferred Color: azure-expressroute
Fallback: mpls → dia
DSCP Set: AF11 (10)
SEQ 50: Azure Active Directory
Match:
Destination IP: 20.190.128.0/18, 40.126.0.0/18
Action:
SLA Class: SLA-O365-INTERACTIVE
Preferred Color: azure-expressroute
Fallback: mpls → dia
DSCP Set: CS3
SEQ 60: Corporate App (MPLS Primary)
Match:
Destination IP: 10.252.0.0/16
Action:
SLA Class: SLA-BUSINESS-APPS
Preferred Color: mpls
Fallback: dia
DSCP Set: AF21
SEQ 70: Azure VNet (Virtual WAN)
Match:
Destination IP: 10.100.0.0/16, 10.101.0.0/16
Action:
SLA Class: SLA-BUSINESS-APPS
Preferred Color: dia (IPsec to Virtual WAN via DIA)
Fallback: mpls
SEQ 80: GCP Vertex AI
Match:
Destination IP: 34.0.0.0/8, 35.0.0.0/8
App-List: google-apis
Action:
SLA Class: SLA-BUSINESS-APPS
Preferred Color: dia (via Umbrella)
Fallback: mpls
SEQ 90: Salesforce
Match:
App-List: salesforce
Action:
SLA Class: SLA-BUSINESS-APPS
CloudOnRamp: Salesforce (use probe results)
Preferred Color: (auto-selected by probe)
Fallback: dia
SEQ 100: ServiceNow
Match:
App-List: servicenow
Action:
SLA Class: SLA-BUSINESS-APPS
CloudOnRamp: ServiceNow
Preferred Color: (auto-selected)
Fallback: dia
SEQ 110: Workday
Match:
App-List: workday
Action:
SLA Class: SLA-BUSINESS-APPS
CloudOnRamp: Workday
Preferred Color: (auto-selected)
Fallback: dia
SEQ 999: Default (Internet)
Match: All remaining traffic
Action:
SLA Class: SLA-BEST-EFFORT
Preferred Color: dia
Fallback: mpls
Week 1 Day 4: Branch Site SaaS Policy¶
Branch Policy: Abhavtech-Branch-CloudOnRamp-AAR
Branch sites use DIA as primary for SaaS (not backhauled to hub):
SEQ 10: Teams Voice — Direct Internet (DIA)
Match: ms-teams-media, Protocol UDP
Action:
SLA Class: SLA-TEAMS-VOICE
Preferred Color: dia (local breakout)
Fallback: mpls (backhaul to hub)
DSCP Set: EF
SEQ 20: Office 365 — Direct Internet
Match: OFFICE365-APPS
Action:
SLA Class: SLA-O365-INTERACTIVE
Preferred Color: dia
Fallback: mpls
DSCP Set: AF21
SEQ 30: Salesforce / ServiceNow / Workday
Match: App-List salesforce, servicenow, workday
Action:
SLA Class: SLA-BUSINESS-APPS
CloudOnRamp: Enabled (use hub probe results)
Preferred Color: dia
Fallback: mpls
SEQ 40: Corporate Network
Match: Destination 10.252.0.0/16
Action:
SLA Class: SLA-BUSINESS-APPS
Preferred Color: mpls
Fallback: dia (via hub)
SEQ 50: Azure VNet (via hub backhaul)
Match: Destination 10.100.0.0/16
Action:
SLA Class: SLA-BUSINESS-APPS
Preferred Color: mpls (backhaul to hub → Azure Virtual WAN)
Fallback: dia
SEQ 999: Default Internet
Match: All
Action:
SLA Class: SLA-BEST-EFFORT
Preferred Color: dia
Fallback: lte
Week 1 Day 5: SaaS Monitoring and Validation¶
Verify SaaS Probe Results in vManage¶
Navigate: Monitor → Cloud OnRamp for SaaS
## Verify via vManage API
curl -k -s -X GET \
"https://vmanage.abhavtech.com/dataservice/cloudonramp/saas/apps" \
-b /tmp/cookies.txt | python3 -c "
import json, sys
apps = json.load(sys.stdin)
for app in apps.get('data', []):
print(f'App: {app[\"appName\"]:20} Status: {app.get(\"status\", \"unknown\")}')
"
## Check probe results per site
curl -k -s -X GET \
"https://vmanage.abhavtech.com/dataservice/cloudonramp/saas/gateway/apps" \
-b /tmp/cookies.txt | python3 -m json.tool | grep -E "appName|gateway|latency|loss"
Verify Traffic Steering¶
! On MUM-HUB-01 — verify O365 traffic using ExpressRoute
show sdwan policy app-route-policy
show sdwan app-fwd cflowd flows | include teams
! Expected: Teams flows show azure-expressroute color
! Check SLA statistics
show sdwan policy app-route-stats
! Expected: SLA compliance >99% for Office 365 traffic
! Verify on branch (BLR-ISR-01) — traffic going DIA not backhaul
show sdwan policy app-route-stats | include office
! Expected: office365 preferred-path = dia
! Check if cloud onramp probe is switching paths
show sdwan cloud-onramp saas path
Validation Checklist — Week 1¶
CLOUD ONRAMP FOR SaaS:
□ All 6 SaaS apps have probes configured (O365, Webex, Salesforce, ServiceNow, Workday, Zoom)
□ Hub gateway probes: Mumbai (APAC), London (EMEA), NJ (Americas) all active
□ Branch probes: All 19 sites reporting probe results
□ O365 Teams traffic: Using azure-expressroute (EF DSCP marked)
□ O365 Exchange/SharePoint: Using azure-expressroute (AF21 DSCP)
□ Salesforce/ServiceNow: Using best path per probe results
□ Branch O365: Local DIA breakout (not backhauled)
□ SLA compliance: >99% for critical apps
□ Automatic path switching: Verified by simulating transport failure