SD-WAN Cloud OnRamp Detailed Configuration Guide¶
GUIDE 4: vMANAGE FEATURE TEMPLATES, VPN SEGMENTATION, ZTP, AND SITE DEPLOYMENT¶
Project: ABV-SECOPS-AI-2025
Date: January 2025
Platform: Cisco Catalyst SD-WAN | vManage 20.15.x | IOS-XE 17.15.x
Scope: Complete vManage template library, VPN design, SD-Access handoff, ZTP, site-by-site deployment
Document Purpose¶
This guide provides the full configuration depth not covered in Guide 3, delivering every vManage feature template, CLI equivalent, and deployment procedure required to build the complete SD-WAN fabric for all 19 Abhavtech sites.
New Content vs. Guide 3: - Complete vManage Feature Template library (all sub-features per device type) - VPN segmentation design (VPN 0 transport, VPN 1–4 service, VPN 512 OOB mgmt) - SD-Access to SD-WAN border handoff — full BGP and VRF configuration - Zero-Touch Provisioning (ZTP) for ISR 1100 branches - Per-site deployment runbooks (hub sites + 3 branch types) - Advanced BFD, OMP, and TLOC tuning - Configuration Groups (new vManage 20.12+ unified model)
Week 1: vMANAGE FEATURE TEMPLATE LIBRARY¶
Week 1 Day 1: System, AAA, and Banner Templates¶
Feature Template: System (Hub Sites)¶
Navigate: Configuration → Templates → Feature Templates → Add Template
Device Type: vedge-c8500-12X
Template Name: ABV-System-Hub-C8500
Template Type: System
Basic Configuration:
Hostname: {{system_hostname}} [device variable]
System IP: {{system_ip}} [device variable]
Site ID: {{site_id}} [device variable]
Organization Name: Abhavtech
vBond Address: vbond.abhavtech.com
Console Baud Rate: 9600
Max OMP Sessions: 8
Control Session PPS: 300
Timezone: Asia/Kolkata (India hubs) / Europe/London (EMEA) / America/New_York (Americas)
[Override per device using device variable: {{timezone}}]
GPS Location: [Optional — for map view]
Feature Template: System (Branch ISR 4331)¶
Template Name: ABV-System-Branch-ISR4331
Device Type: vedge-ISR-4331
System IP: {{system_ip}}
Site ID: {{site_id}}
Organization Name: Abhavtech
vBond Address: vbond.abhavtech.com
Max OMP Sessions: 2
Control Session PPS: 100
Feature Template: System (Branch ISR 1100)¶
Template Name: ABV-System-Branch-ISR1100
Device Type: vedge-ISR-1100-4G
System IP: {{system_ip}}
Site ID: {{site_id}}
Organization Name: Abhavtech
vBond Address: vbond.abhavtech.com
Max OMP Sessions: 2
Control Session PPS: 50
Feature Template: AAA¶
Template Name: ABV-AAA-Global
Device Type: All (multi-device template)
Authentication:
Order: local
Fallback: local (no RADIUS for WAN edge — use vManage auth)
Authorization:
Console: local
VTY: local
RADIUS for vManage integration: Disabled on device
(vManage provides centralized auth via REST API)
Local Users:
admin: privilege 15, encrypted password: {{admin_password}}
Logging:
Syslog Server: 10.252.31.50 (Splunk HEC receiver)
Syslog Level: informational
Syslog Source Interface: Loopback0
VPN: 512 (management VPN)
Feature Template: Banner¶
Template Name: ABV-Banner-Global
MOTD:
"Authorized access only. Abhavtech - ABV-SECOPS-AI-2025.
All activity monitored and logged. Disconnect immediately if unauthorized."
Login Banner:
"Abhavtech Internal Network - Authorized Use Only."
Week 1 Day 2: VPN 0 (Transport) Feature Templates¶
VPN 0 is the transport VPN — carries SD-WAN control plane and IPsec data tunnels.
VPN 0 Feature Template: Hub C8500-12X¶
Template Name: ABV-VPN0-Hub-C8500
Device Type: vedge-c8500-12X
VPN: 0
DNS Servers: (none — transport VPN uses ISP DNS for BFD only)
Routes:
0.0.0.0/0 via {{mpls_next_hop}} [device variable: MPLS gateway]
0.0.0.0/0 via {{dia_next_hop}} [device variable: DIA gateway]
[Individual interface configs are in separate Interface Feature Templates]
Interface Feature Template: MPLS WAN (Hub)¶
Template Name: ABV-IF-VPN0-MPLS-Hub
Device Type: vedge-c8500-12X
Interface Name: TenGigabitEthernet0/0/0
Description: MPLS-WAN-PRIMARY
VPN: 0 (Transport)
IP Address: {{mpls_ip}} / {{mpls_prefix}} [device variables]
Shutdown: No
Tunnel:
Color: mpls
Carrier: default
Restrict: Disabled [allow fallback to other colors]
Max Control Connections: 2
TLOC Extension: Disabled
Allow Service: all
BFD:
Multiplier: 7
Min Transmit: 1000ms (1-second BFD for MPLS)
Interface Feature Template: Internet DIA (Hub)¶
Template Name: ABV-IF-VPN0-DIA-Hub
Device Type: vedge-c8500-12X
Interface Name: GigabitEthernet0/0/4
Description: INTERNET-DIA
VPN: 0 (Transport)
IP Address: {{dia_ip}} / {{dia_prefix}}
Shutdown: No
Tunnel:
Color: dia
Carrier: default
Restrict: Disabled
Max Control Connections: 2
NAT: Disabled (hub sites have static IPs)
BFD:
Multiplier: 7
Min Transmit: 1000ms
Interface Feature Template: ExpressRoute (Hub)¶
Template Name: ABV-IF-VPN0-ER-Hub
Device Type: vedge-c8500-12X
Interface Name: TenGigabitEthernet0/0/2
Description: EXPRESSROUTE-PRIMARY
VPN: 0 (Transport)
Sub-interface: TenGigabitEthernet0/0/2.{{er_vlan}} [device variable: VLAN 4001/4002/4003]
IP Address: {{er_primary_ip}} / 30 [device variable: 169.254.200.2 etc.]
Shutdown: No
Tunnel:
Color: azure-expressroute
Carrier: default
Restrict: Enabled [only O365/Azure traffic on this color]
Max Control Connections: 0 [ExpressRoute is data-only, no SD-WAN control]
BFD:
Disabled (ExpressRoute uses BGP keepalives, not BFD)
Interface Feature Template: MPLS WAN (Branch ISR 4331)¶
Template Name: ABV-IF-VPN0-MPLS-Branch-ISR4331
Device Type: vedge-ISR-4331
Interface Name: GigabitEthernet0/0/2
Description: MPLS-WAN
VPN: 0
IP Address: {{mpls_ip}} / {{mpls_prefix}}
Shutdown: No
Tunnel:
Color: mpls
Restrict: Disabled
Max Control Connections: 2
BFD:
Multiplier: 7
Min Transmit: 1000ms
Interface Feature Template: DIA (Branch ISR 1100)¶
Template Name: ABV-IF-VPN0-DIA-Branch-ISR1100
Device Type: vedge-ISR-1100-4G
Interface Name: GigabitEthernet0
Description: INTERNET-DIA-PRIMARY
VPN: 0
IP Address: DHCP (ISP-assigned)
Shutdown: No
Tunnel:
Color: dia
Restrict: Disabled
Max Control Connections: 2
NAT: Enabled [branch sites often behind NAT]
NAT Type: Loopback (use Loopback0 as TLOC address)
BFD:
Multiplier: 7
Min Transmit: 1000ms
Interface Feature Template: LTE (Branch ISR 1100)¶
Template Name: ABV-IF-VPN0-LTE-Branch-ISR1100
Device Type: vedge-ISR-1100-4GLTENA
Interface Name: Cellular0
Description: LTE-BACKUP
VPN: 0
IP Address: DHCP (carrier-assigned)
Shutdown: No
Tunnel:
Color: lte
Carrier: default
Restrict: Disabled
Max Control Connections: 1 [LTE: only 1 control connection to save bandwidth]
BFD:
Multiplier: 10
Min Transmit: 2000ms [2-second BFD — appropriate for LTE latency]
Week 1 Day 3: VPN 1–4 (Service) Feature Templates¶
VPN Design for Abhavtech¶
VPN ASSIGNMENT:
┌────────┬──────────────────────────────────────────────────────────────┐
│ VPN ID │ Purpose │
├────────┼──────────────────────────────────────────────────────────────┤
│ 0 │ Transport (WAN) — SD-WAN control + IPsec data tunnels │
│ 1 │ Corporate / Users (maps to SD-Access VN_CORPORATE) │
│ 2 │ Voice / Webex (maps to VN_VOICE) │
│ 3 │ Guest (maps to VN_GUEST — limited internet only) │
│ 4 │ IoT (maps to VN_IOT — MQTT/CoAP to cloud only) │
│ 512 │ Out-of-Band Management (SSH to devices, vManage reach) │
└────────┴──────────────────────────────────────────────────────────────┘
CLOUD ONRAMP VPN MAPPING:
O365 / SaaS apps → VPN 1 (Corporate) users
Azure VNet → VPN 1 (Corporate) → hub SD-WAN border → Azure Virtual WAN
GCP Vertex AI → VPN 1 (Corporate) → hub DIA → GCP APIs
Guest Internet → VPN 3 → DIA (no backhaul to corporate)
IoT MQTT → VPN 4 → DIA to IoT cloud platform
Feature Template: VPN 1 (Corporate)¶
Template Name: ABV-VPN1-Corporate
Device Type: All
VPN: 1
VPN Name: VN_CORPORATE
DNS Server 1: 10.252.1.100 (Mumbai DNS — on-premise AD)
DNS Server 2: 10.252.1.101
Routes (hub sites only):
Summarized LAN routes advertised via OMP:
Mumbai hub: 10.100.1.0/24, 10.100.2.0/24, 10.100.3.0/24
London hub: 10.100.16.0/24
NJ hub: 10.100.32.0/24
[Branch routes are advertised per device template variable]
Interface Feature Template: LAN (Hub C8500-12X, VPN 1)¶
Template Name: ABV-IF-VPN1-LAN-Hub
Device Type: vedge-c8500-12X
Interface Name: GigabitEthernet0/0/7 [Internal LAN / SD-Access handoff]
Description: SD-ACCESS-HANDOFF-VN_CORPORATE
VPN: 1
Sub-interface: GigabitEthernet0/0/7.{{corp_vlan}} [device variable]
IP Address: {{corp_handoff_ip}} / {{corp_handoff_prefix}}
Shutdown: No
VRRP: Not applicable (SD-Access provides HA at border node level)
Interface Feature Template: LAN (Branch ISR 4331)¶
Template Name: ABV-IF-VPN1-LAN-Branch-ISR4331
Device Type: vedge-ISR-4331
Interface Name: GigabitEthernet0/0/1
Description: LAN-ACCESS-CORPORATE
VPN: 1
IP Address: {{lan_ip}} / {{lan_prefix}} [e.g., 192.168.50.1/24]
Shutdown: No
DHCP Server: Enabled (branches run local DHCP)
Pool: {{lan_prefix}}
Default GW: {{lan_ip}}
DNS: 10.252.1.100, 10.252.1.101
Lease: 86400 seconds
Excluded: {{lan_ip}} - {{lan_excluded_end}}
Interface Feature Template: LAN (Branch ISR 1100)¶
Template Name: ABV-IF-VPN1-LAN-Branch-ISR1100
Device Type: vedge-ISR-1100-4G
Interface Name: GigabitEthernet0/0/1
Description: LAN-ACCESS
VPN: 1
IP Address: {{lan_ip}} / {{lan_prefix}}
Shutdown: No
DHCP Server: Enabled
Pool: {{lan_prefix}}
Default GW: {{lan_ip}}
DNS: 10.252.1.100, 10.252.1.101
Lease: 86400
Feature Template: VPN 2 (Voice)¶
Template Name: ABV-VPN2-Voice
Device Type: All
VPN: 2
VPN Name: VN_VOICE
DNS Server: 10.252.1.100 (shared with Corporate)
Note: Voice VPN carries only Webex Calling, CUCM, and IP Phone traffic.
Separate VPN allows QoS, routing, and security policy independent of data.
Routes (hub sites): Webex Calling media ranges (advertised via OMP)
Feature Template: VPN 512 (OOB Management)¶
Template Name: ABV-VPN512-Management
Device Type: All
VPN: 512
VPN Name: OOB-MGMT
DNS Server: 10.252.1.100
Purpose: Out-of-band management access to WAN edge devices
- SSH from vManage (10.252.31.10)
- SNMP polling from ThousandEyes / Splunk
- NetFlow/IPFIX export to Splunk (10.252.31.50)
Interface: Management0 (dedicated OOB port)
IP: {{mgmt_ip}} / {{mgmt_prefix}}
Static Routes:
10.252.31.0/24 via {{mgmt_gateway}} [Management server subnet]
Week 1 Day 4: Routing Feature Templates¶
Feature Template: BGP (Hub Sites — OMP-BGP Redistribution)¶
Template Name: ABV-BGP-Hub-VPN1
Device Type: vedge-c8500-12X
VPN: 1
Router BGP AS: 65000 [Mumbai hub — varies per site: 65000/65001/65002]
BGP Router ID: {{system_ip}}
Networks to Advertise:
{{hub_lan_subnet_1}} [device variable: e.g. 10.100.1.0/24]
{{hub_lan_subnet_2}} [device variable]
OMP Redistribution:
Redistribute OMP → BGP: Enabled
[This distributes Azure VNet routes (learned via OMP) into BGP VRF]
Redistribute BGP → OMP: Enabled
[This pushes on-premise LAN routes into OMP fabric]
Aggregate:
10.252.0.0/16 summary-only [Summarize all on-premise to Azure/GCP]
IOS-XE Equivalent (for reference / manual verification)¶
! Hub VPN1 BGP — equivalent CLI configuration
! (vManage generates this via device template)
router bgp 65000
bgp router-id 10.252.1.1
!
! VPN 1 — Corporate (VRF)
address-family ipv4 vrf 1
redistribute omp
network 10.100.1.0 mask 255.255.255.0
network 10.100.2.0 mask 255.255.255.0
aggregate-address 10.252.0.0 255.255.0.0 summary-only
exit-address-family
Feature Template: OSPF (Branch — Internal LAN redistribution)¶
Template Name: ABV-OSPF-Branch-VPN1
Device Type: vedge-ISR-4331
VPN: 1
Router OSPF Process: 1
Router ID: {{system_ip}}
Areas:
Area 0:
Interface: GigabitEthernet0/0/1 (LAN)
Network Type: Broadcast
Cost: 1
Redistribution:
Redistribute OMP into OSPF: Enabled (metric 20, type E2)
[Azure + corporate routes from OMP into OSPF for downstream switches]
Redistribute OSPF into OMP: Enabled
[Local LAN routes into SD-WAN fabric]
Feature Template: Static Routes (Hub)¶
Template Name: ABV-Static-Hub-VPN1
Device Type: vedge-c8500-12X
VPN: 1
Static Routes:
0.0.0.0/0 → vpn 0 [Internet default — handed to VPN 0 for DIA]
Week 1 Day 5: Security Feature Templates (UTD, Zone-Based FW)¶
Feature Template: Unified Threat Defense (UTD)¶
Template Name: ABV-UTD-Branch
Device Type: vedge-ISR-4331, vedge-ISR-1100-4G
UTD Mode: Inline
Threat Detection:
IPS/IDS:
Mode: Detection (alert only — change to Prevention after 30-day tuning)
Signature Set: Connectivity (balanced signatures — not maximum)
Alert Log: Enabled → VPN 512 → Syslog → Splunk
URL Filtering:
Mode: Alert (monitor first 30 days, then block)
Block Categories:
- Malware sites
- Phishing
- Command and Control
- Newly Registered Domains (<14 days)
Allow Categories:
- Business Applications
- Cloud Storage
- Collaboration
File Inspection:
Enabled: Yes
File Types: exe, pdf, doc, docx, xls, zip, js
Action: Alert + Forward to AMP
Fail Behavior: Fail-open (traffic passes if UTD engine fails)
Feature Template: Zone-Based Firewall (Hub C8500-12X)¶
Template Name: ABV-ZBFW-Hub
Device Type: vedge-c8500-12X
Zones:
TRUST: VPN 1 (Corporate), VPN 2 (Voice)
UNTRUST: VPN 0 (Transport / Internet)
DMZCLOUD: VPN 4 (IoT)
MGMT: VPN 512
Zone Pairs and Actions:
TRUST → UNTRUST:
Inspect TCP/UDP/ICMP [stateful — return traffic allowed]
Drop: all others
UNTRUST → TRUST:
Permit established sessions only (return traffic)
Drop: all initiated from outside
DMZCLOUD → TRUST:
Deny (IoT cannot initiate to corporate)
TRUST → DMZCLOUD:
Permit TCP/UDP to 10.x.x.x (MQTT/CoAP targets only)
MGMT → TRUST:
Permit SSH (22), SNMP (161/162) from 10.252.31.0/24
Global:
Log Dropped Packets: Enabled → Splunk
Half-Open Session Limit: 100 per destination
Week 2: VPN Segmentation and SD-Access Handoff¶
Week 2 Day 1: VPN Design and OMP Route Propagation¶
OMP Route Advertisement Design¶
OMP ROUTE EXCHANGE RULES:
┌──────────────────────────────────────────────────────────────────────────┐
│ Route Type │ Source │ Destination │
├──────────────────────────────────────────────────────────────────────────┤
│ Corporate subnets │ All 19 sites (VPN 1) │ All other sites (VPN 1) │
│ Azure VNet routes │ Hub via Azure VPN GW │ All branches (VPN 1) │
│ GCP API routes │ Hub (static) │ All sites (VPN 1) │
│ Voice subnets │ All sites (VPN 2) │ All other sites (VPN 2) │
│ Guest routes │ Per site (VPN 3) │ None (guest = local only) │
│ IoT routes │ Per site (VPN 4) │ IoT cloud only │
└──────────────────────────────────────────────────────────────────────────┘
Control Policy: Inter-VPN Isolation¶
Navigate: Configuration → Policies → Control Policy
Policy Name: ABV-Control-VPN-Isolation
Purpose: Prevent guest VPN routes from leaking into corporate VPN
Sequences:
SEQ 10: Block Guest Routes from Spreading
Match:
VPN: 3 (Guest)
Action: Reject
Comment: Guest routes stay local — no inter-site guest routing
SEQ 20: Block IoT Routes Except to Hub
Match:
VPN: 4 (IoT)
Source: Branch sites (site-id 10-25)
Destination: Branch sites (site-id 10-25)
Action: Reject
Comment: IoT-to-IoT communication not permitted; only IoT-to-cloud via hub
SEQ 30: Permit Corporate Routes (Hub-to-Branch)
Match:
VPN: 1 (Corporate)
Prefix: 10.252.0.0/16 (corporate network)
Action: Accept
SEQ 40: Permit Azure VNet Routes
Match:
VPN: 1 (Corporate)
Prefix: 10.100.0.0/16, 10.101.0.0/16
Action: Accept
SEQ 999: Default Accept
Match: All
Action: Accept
Week 2 Day 2: SD-Access to SD-WAN Border Handoff¶
Architecture: SD-Access Border to C8500-12X Hub¶
SD-ACCESS BORDER NODE (C9500-48Y4C) C8500-12X HUB
│ │
│ Sub-interfaces (one per VN/VPN) │
│ 802.1Q VLAN tags │
├──────────── VLAN 3001 (VN_CORPORATE) ─────►│ GigE0/0/7.3001 → VPN 1
├──────────── VLAN 3002 (VN_VOICE) ──────────►│ GigE0/0/7.3002 → VPN 2
├──────────── VLAN 3003 (VN_GUEST) ─────────►│ GigE0/0/7.3003 → VPN 3
├──────────── VLAN 3004 (VN_IOT) ────────────►│ GigE0/0/7.3004 → VPN 4
└──────────── VLAN 3005 (MGMT) ──────────────►│ GigE0/0/7.3005 → VPN 512
eBGP PEERING per VRF:
VN_CORPORATE (VRF 1): ASN 65001 (border) ↔ ASN 65000 (hub)
VN_VOICE (VRF 2): ASN 65001 ↔ ASN 65000
VN_GUEST (VRF 3): ASN 65001 ↔ ASN 65000
VN_IOT (VRF 4): ASN 65001 ↔ ASN 65000
SD-Access Border Node Configuration (C9500-48Y4C)¶
! ============================================================================
! MUMBAI SD-ACCESS BORDER NODE — SD-WAN HANDOFF CONFIGURATION
! Hostname: MUM-BN-01 (C9500-48Y4C)
! ============================================================================
! Physical interface to SD-WAN hub (trunk)
interface TenGigabitEthernet1/0/1
description SD-WAN-HANDOFF-TO-MUM-HUB-01
switchport mode trunk
switchport trunk allowed vlan 3001-3005
no shutdown
! VN_CORPORATE handoff (VLAN 3001)
interface Vlan3001
description HANDOFF-VN_CORPORATE-TO-SDWAN
vrf forwarding VN_CORPORATE
ip address 10.240.1.1 255.255.255.252
no shutdown
! VN_VOICE handoff (VLAN 3002)
interface Vlan3002
description HANDOFF-VN_VOICE-TO-SDWAN
vrf forwarding VN_VOICE
ip address 10.240.2.1 255.255.255.252
no shutdown
! VN_GUEST handoff (VLAN 3003)
interface Vlan3003
description HANDOFF-VN_GUEST-TO-SDWAN
vrf forwarding VN_GUEST
ip address 10.240.3.1 255.255.255.252
no shutdown
! VN_IOT handoff (VLAN 3004)
interface Vlan3004
description HANDOFF-VN_IOT-TO-SDWAN
vrf forwarding VN_IOT
ip address 10.240.4.1 255.255.255.252
no shutdown
! BGP peering to SD-WAN hub — VN_CORPORATE
router bgp 65001
bgp router-id 10.250.1.1
bgp log-neighbor-changes
!
address-family ipv4 vrf VN_CORPORATE
redistribute lisp metric 100
neighbor 10.240.1.2 remote-as 65000 ! SD-WAN hub (MUM-HUB-01)
neighbor 10.240.1.2 description SDWAN-HUB-VPN1-CORPORATE
neighbor 10.240.1.2 activate
neighbor 10.240.1.2 soft-reconfiguration inbound
! Advertise SD-Access fabric summary to SD-WAN
network 10.100.1.0 mask 255.255.255.0 ! Mumbai corporate LAN
network 10.100.2.0 mask 255.255.255.0
aggregate-address 10.100.0.0 255.255.0.0 summary-only
exit-address-family
!
address-family ipv4 vrf VN_VOICE
redistribute lisp metric 100
neighbor 10.240.2.2 remote-as 65000
neighbor 10.240.2.2 description SDWAN-HUB-VPN2-VOICE
neighbor 10.240.2.2 activate
network 10.190.1.0 mask 255.255.255.0 ! Voice subnet
exit-address-family
!
address-family ipv4 vrf VN_GUEST
redistribute lisp metric 100
neighbor 10.240.3.2 remote-as 65000
neighbor 10.240.3.2 description SDWAN-HUB-VPN3-GUEST
neighbor 10.240.3.2 activate
network 10.180.1.0 mask 255.255.255.0 ! Guest VLAN
exit-address-family
!
address-family ipv4 vrf VN_IOT
redistribute lisp metric 100
neighbor 10.240.4.2 remote-as 65000
neighbor 10.240.4.2 description SDWAN-HUB-VPN4-IOT
neighbor 10.240.4.2 activate
network 10.150.1.0 mask 255.255.255.0 ! IoT subnet
exit-address-family
SD-WAN Hub C8500-12X: SD-Access Handoff Configuration¶
! ============================================================================
! MUMBAI C8500-12X — SD-ACCESS HANDOFF SUB-INTERFACES
! Note: vManage generates this via device template
! ============================================================================
interface GigabitEthernet0/0/7
description SD-ACCESS-BORDER-HANDOFF
no ip address
no shutdown
! VPN 1 — Corporate
interface GigabitEthernet0/0/7.3001
description SDA-HANDOFF-VN_CORPORATE-VPN1
encapsulation dot1Q 3001
vrf forwarding 1
ip address 10.240.1.2 255.255.255.252
no shutdown
! VPN 2 — Voice
interface GigabitEthernet0/0/7.3002
description SDA-HANDOFF-VN_VOICE-VPN2
encapsulation dot1Q 3002
vrf forwarding 2
ip address 10.240.2.2 255.255.255.252
no shutdown
! VPN 3 — Guest
interface GigabitEthernet0/0/7.3003
description SDA-HANDOFF-VN_GUEST-VPN3
encapsulation dot1Q 3003
vrf forwarding 3
ip address 10.240.3.2 255.255.255.252
no shutdown
! VPN 4 — IoT
interface GigabitEthernet0/0/7.3004
description SDA-HANDOFF-VN_IOT-VPN4
encapsulation dot1Q 3004
vrf forwarding 4
ip address 10.240.4.2 255.255.255.252
no shutdown
! BGP on SD-WAN hub (VPN 1 — Corporate)
router bgp 65000
address-family ipv4 vrf 1
neighbor 10.240.1.1 remote-as 65001
neighbor 10.240.1.1 description SDA-BORDER-VN_CORPORATE
neighbor 10.240.1.1 activate
neighbor 10.240.1.1 soft-reconfiguration inbound
redistribute omp ! Azure VNet routes (learned via OMP) into BGP VRF 1
exit-address-family
!
address-family ipv4 vrf 2
neighbor 10.240.2.1 remote-as 65001
neighbor 10.240.2.1 activate
redistribute omp
exit-address-family
!
address-family ipv4 vrf 3
neighbor 10.240.3.1 remote-as 65001
neighbor 10.240.3.1 activate
! Guest: do NOT redistribute OMP (guest cannot reach corporate)
exit-address-family
!
address-family ipv4 vrf 4
neighbor 10.240.4.1 remote-as 65001
neighbor 10.240.4.1 activate
redistribute omp ! IoT cloud routes
exit-address-family
Week 2 Day 3: VRF-Aware Cloud OnRamp Policies¶
Data Policy: Per-VPN Traffic Steering¶
Policy Name: ABV-Data-Per-VPN-Steering
SEQ 10: VPN 3 Guest — Deny Corporate Destinations
Match:
VPN: 3
Destination: 10.252.0.0/16, 10.100.0.0/16
Action: Drop + Log
SEQ 20: VPN 3 Guest — Permit Internet via DIA Only
Match:
VPN: 3
Destination: 0.0.0.0/0
Action:
Preferred Color: dia
Fallback: none [guest traffic NEVER backhauled via MPLS]
NAT: Enabled (PAT to DIA interface IP)
SEQ 30: VPN 4 IoT — Permit MQTT to Cloud Only
Match:
VPN: 4
Protocol: TCP
Destination Port: 1883, 8883 (MQTT)
Action:
Preferred Color: dia
Set DSCP: CS1 (IoT is low-priority)
SEQ 40: VPN 4 IoT — Block All Other Destinations
Match:
VPN: 4
Not matching SEQ 30 destinations
Action: Drop
SEQ 50: VPN 2 Voice — Always Use Best Real-Time Path
Match:
VPN: 2
Protocol: UDP
DSCP: EF
Action:
SLA Class: SLA-TEAMS-VOICE
Preferred Color: mpls (for PSTN-quality voice)
Fallback: dia
FEC: Enabled (Forward Error Correction for voice)
SEQ 999: VPN 1 Corporate — Default AAR Policy
Match:
VPN: 1
Destination: All
Action:
Apply Policy: Abhavtech-Hub-CloudOnRamp-AAR (from Guide 3)
Week 2 Day 4: BFD and OMP Tuning¶
BFD Configuration Per Transport Type¶
! Apply via vManage SD-WAN Policy → Interface Feature Template
! MPLS (dedicated, low-latency):
sdwan
interface TenGigabitEthernet0/0/0
tunnel-interface
encapsulation ipsec preference 200 ! Prefer MPLS for encrypted tunnels
color mpls
hello-interval 1000 ! 1-second BFD hello
no allow-service bgp
allow-service dhcp
allow-service dns
allow-service icmp
allow-service sshd
allow-service netconf
allow-service ntp
allow-service ospf
allow-service stun
no allow-service https
! DIA (internet, variable latency):
interface GigabitEthernet0/0/4
tunnel-interface
encapsulation ipsec preference 100
color dia
hello-interval 1000
multiplier 7 ! Declare down after 7 missed hellos (7s)
! LTE (branch backup — conservative timers):
interface Cellular0
tunnel-interface
encapsulation ipsec preference 50 ! Lowest preference
color lte
hello-interval 2000 ! 2-second hello (LTE jitter tolerance)
multiplier 10 ! 20 seconds before declaring down
restrict ! Only use LTE if DIA fails
OMP Tuning¶
vManage: Configuration → Templates → Feature Templates → OMP
Template Name: ABV-OMP-Global
OMP Send Backup Paths: 4 [Hub sites: 4 ECMP paths]
OMP Max OMP Sessions: 8 [Hub sites connect to 2 vSmart controllers]
OMP Hold Time: 60 seconds
OMP Advertisement Interval: 1 second
OMP Graceful Restart Timer: 43200 (12 hours)
Send Path Limit: 4 [Advertise up to 4 TLOCs per prefix]
Receive Path Limit: 4
OMP and TLS: Enabled (all control messages encrypted via TLS 1.2+)
Week 2 Day 5: Segmentation Validation¶
#!/bin/bash
## vpn_segmentation_validation.sh
echo "=== VPN SEGMENTATION VALIDATION ==="
## Test 1: Corporate VPN (VPN 1) routing
echo ""
echo "[1] VPN 1 Corporate — Route Table"
ssh admin@mum-hub-01 "show sdwan omp routes vpn 1 | head -30"
## Expected: Corporate subnets + Azure VNets (10.100.0.0/16) + GCP routes
## Test 2: Voice VPN (VPN 2) isolation
echo ""
echo "[2] VPN 2 Voice — Routes present, not mixing with corporate"
ssh admin@mum-hub-01 "show sdwan omp routes vpn 2"
## Expected: Only voice subnets (10.190.x.x) — no corporate or Azure routes
## Test 3: Guest VPN (VPN 3) isolation
echo ""
echo "[3] VPN 3 Guest — Only internet, no corporate routes"
GUEST_ROUTES=$(ssh admin@mum-hub-01 "show sdwan omp routes vpn 3 | grep 10.252" | wc -l)
[[ "$GUEST_ROUTES" -eq 0 ]] && echo "✅ Guest VPN: No corporate routes (isolated)" \
|| echo "❌ Guest VPN: LEAK DETECTED — corporate routes in guest VPN"
## Test 4: SD-Access BGP peering
echo ""
echo "[4] SD-Access Border BGP Sessions"
ssh admin@mum-hub-01 "show bgp vpnv4 unicast all summary | grep 65001"
## Expected: 10.240.1.1 (corporate), 10.240.2.1 (voice), 10.240.3.1 (guest), 10.240.4.1 (IoT)
## Test 5: Cross-site reachability (corporate)
echo ""
echo "[5] Cross-Site Corporate Reachability"
ssh admin@mum-hub-01 "ping vrf 1 192.168.50.100 repeat 5"
## Expected: Bangalore branch (192.168.50.100) reachable from Mumbai hub VPN 1
## Test 6: Guest cannot reach corporate
echo ""
echo "[6] Guest VPN Isolation — Cannot Reach Corporate"
ssh admin@mum-hub-01 "ping vrf 3 10.252.1.100 repeat 3"
## Expected: All timeouts (guest VPN 3 has no route to 10.252.0.0/16)
echo ""
echo "=== SEGMENTATION VALIDATION COMPLETE ==="
Week 3: Zero-Touch Provisioning and Site Deployment¶
Week 3 Day 1: ZTP Infrastructure Setup¶
ZTP Architecture for ISR 1100 Branches¶
ZERO-TOUCH PROVISIONING FLOW:
1. ISR 1100 ships to branch site (box is unopened)
2. On-site staff connects:
- WAN port → ISP modem/router
- LAN port → existing switch
- Power on device
3. ISR 1100 auto-boots and contacts vBond (via DNS/DHCP)
4. vBond authenticates device certificate
5. vManage pushes device template + variables
6. Device comes up fully configured
7. BFD sessions established within 5 minutes
8. NOC confirms site operational via vManage dashboard
DNS PREREQUISITE:
vbond.abhavtech.com → 203.0.113.10 (public vBond IP)
(Create this DNS record BEFORE shipping devices)
CERTIFICATE PREREQUISITE:
WAN edges use Cisco-signed certificates (included in hardware)
Root CA uploaded to vManage: Administration → Settings → Enterprise Root CA
vManage: ZTP Device Pre-Configuration¶
Navigate: Configuration → Devices → WAN Edge List → Upload
## Create device list CSV for bulk upload
cat > wan_edge_list.csv << 'CSV'
"Chassis Number","UUID","Token"
"FTX2547XXXX","a1b2c3d4-e5f6-7890-abcd-ef1234567890","TOKEN1"
"FTX2547XXXY","b2c3d4e5-f6a7-8901-bcde-f12345678901","TOKEN2"
[... one row per ISR 1100 device, fill from PO/Cisco TAC]
CSV
## Upload to vManage
curl -k -s -X POST \
https://vmanage.abhavtech.com/dataservice/system/device/vedge \
-b /tmp/cookies.txt \
-H "Content-Type: multipart/form-data" \
-F "file=@wan_edge_list.csv"
Pre-Stage Device Variables¶
#!/usr/bin/env python3
"""
Pre-stage device variables in vManage before ZTP deployment
Run this script when devices are purchased, before shipping to sites
"""
import requests, json, urllib3
urllib3.disable_warnings()
VMANAGE = "vmanage.abhavtech.com"
## Branch site variables
BRANCH_DEVICES = [
{
"hostname": "BLR-BR-01",
"system_ip": "10.252.50.1",
"site_id": 50,
"template": "ABV-DeviceTemplate-Branch-ISR1100",
"lan_ip": "192.168.50.1",
"lan_prefix": "192.168.50.0/24",
"mgmt_ip": "10.252.200.50",
"timezone": "Asia/Kolkata",
"admin_password": "REDACTED",
},
{
"hostname": "DEL-BR-01",
"system_ip": "10.252.51.1",
"site_id": 51,
"template": "ABV-DeviceTemplate-Branch-ISR1100",
"lan_ip": "192.168.51.1",
"lan_prefix": "192.168.51.0/24",
"mgmt_ip": "10.252.200.51",
"timezone": "Asia/Kolkata",
"admin_password": "REDACTED",
},
## Add remaining 11 India branches here
]
def get_session(vmanage, user, password):
s = requests.Session()
s.verify = False
s.post(f"https://{vmanage}/j_security_check",
data={"j_username": user, "j_password": password},
headers={"Content-Type": "application/x-www-form-urlencoded"})
token = s.get(f"https://{vmanage}/dataservice/client/token").text
s.headers["X-XSRF-TOKEN"] = token
return s
def get_template_id(session, vmanage, template_name):
resp = session.get(f"https://{vmanage}/dataservice/template/device")
templates = resp.json().get("data", [])
for t in templates:
if t["templateName"] == template_name:
return t["templateId"]
raise ValueError(f"Template not found: {template_name}")
def attach_template_to_device(session, vmanage, device, template_id):
payload = {
"deviceTemplateList": [{
"templateId": template_id,
"device": [{
"csv-status": "complete",
"csv-deviceId": device["chassis"],
"csv-deviceIP": device["system_ip"],
"csv-site-id": str(device["site_id"]),
"//system/host-name": device["hostname"],
"//system/system-ip": device["system_ip"],
"//system/site-id": str(device["site_id"]),
"//vpn-instance/ip/route/prefix": "0.0.0.0/0",
"/0/GigabitEthernet0/0/1/ip/address": device["lan_ip"],
"/1/GigabitEthernet0/0/1/ip/prefix": device["lan_prefix"],
}]
}]
}
resp = session.post(
f"https://{vmanage}/dataservice/template/device/config/attachfeature",
json=payload,
headers={"Content-Type": "application/json"}
)
return resp.status_code, resp.json()
s = get_session(VMANAGE, "admin", "<PASSWORD>")
template_id = get_template_id(s, VMANAGE, "ABV-DeviceTemplate-Branch-ISR1100")
print(f"Template ID: {template_id}")
for device in BRANCH_DEVICES:
status, resp = attach_template_to_device(s, VMANAGE, device, template_id)
print(f"{device['hostname']}: {'✅' if status == 200 else '❌'} (HTTP {status})")
Week 3 Day 2: Hub Site Deployment (C8500-12X)¶
Pre-Deployment Checklist¶
HUB SITE PRE-DEPLOYMENT (24 hours before cutover):
□ C8500-12X physically installed in rack, console connected
□ All WAN circuits terminated and patch cables in place:
- MPLS (Tata/BT/AT&T): TenGigabitEthernet0/0/0
- MPLS Redundant: TenGigabitEthernet0/0/1
- ExpressRoute Primary: TenGigabitEthernet0/0/2
- ExpressRoute Backup: TenGigabitEthernet0/0/3
- Internet DIA Primary: GigabitEthernet0/0/4
- Internet DIA Backup: GigabitEthernet0/0/5
- SD-Access Handoff: GigabitEthernet0/0/7
□ Management interface connected and IP confirmed
□ C8500-12X running IOS-XE 17.15.x (verified: show version)
□ WAN edge license activated in Smart Licensing
□ Device chassis number and serial confirmed with vManage device list
Day-0 Bootstrap Configuration (Hub)¶
Apply manually via console before vManage takes over:
! ============================================================================
! DAY-0 BOOTSTRAP — MUMBAI C8500-12X (MUM-HUB-01)
! Purpose: Minimal config to reach vBond/vManage for ZTP
! ============================================================================
! Management interface for initial vManage reach
interface GigabitEthernet0
description OOB-MGMT
vrf forwarding Mgmt-intf
ip address {{mgmt_ip}} {{mgmt_mask}}
no shutdown
! Default route via management
ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 {{mgmt_gateway}}
! SD-WAN basic config for vBond discovery
system
system-ip {{system_ip}}
site-id {{site_id}}
organization-name Abhavtech
vbond vbond.abhavtech.com
! SDWAN interface config for initial connection
sdwan
interface GigabitEthernet0
tunnel-interface
color mgmt-internet
no restrict
!
!
commit
vManage: Attach Template to Hub Device¶
After device appears in vManage (Unmanaged state):
1. vManage → Configuration → Devices → WAN Edge
2. Locate MUM-HUB-01 (will show System IP after bootstrap)
3. Click ... → Attach Template
4. Select: ABV-DeviceTemplate-Hub-C8500
5. Fill device-specific variables:
system_hostname: MUM-HUB-01
system_ip: 10.252.1.1
site_id: 1
mpls_ip: <Tata-assigned /30>
mpls_next_hop: <Tata PE IP>
dia_ip: <ISP-assigned>
er_vlan: 4001
er_primary_ip: 169.254.200.2
hub_lan_subnet_1: 10.100.1.0/24
hub_lan_subnet_2: 10.100.2.0/24
corp_handoff_ip: 10.240.1.2
corp_vlan: 3001
6. Click Dry Run → Verify no errors
7. Click Deploy
Post-Deployment Verification (Hub)¶
! Run these on the device after template deployment:
! Verify control connections (vBond, vSmart, vManage)
show sdwan control connections
! Expected:
! vbond.abhavtech.com → ESTABLISHED
! vsmart-1.abhavtech.com → ESTABLISHED
! vsmart-2.abhavtech.com → ESTABLISHED
! vmanage.abhavtech.com → ESTABLISHED
! Verify BFD sessions (IPsec tunnels to other sites)
show sdwan bfd sessions | count
! After connecting to all sites: expect 30-40 sessions
! Verify OMP routes
show sdwan omp routes vpn 1 | count
! Expected: >20 routes (all site LANs + Azure + GCP)
! Verify SD-Access BGP
show bgp vpnv4 unicast vrf 1 summary | grep 65001
! Expected: 10.240.1.1 in established state
! Verify ExpressRoute BGP
show bgp ipv4 unicast summary | grep 12076
! Expected: Both 169.254.200.1 and .5 established
! Verify policy applied
show sdwan policy app-route-policy
! Expected: Abhavtech-Hub-CloudOnRamp-AAR attached
Week 3 Day 3: Large Branch Deployment (ISR 4331)¶
Pre-Deployment Checklist (Branch)¶
BRANCH PRE-DEPLOYMENT:
□ ISR 4331 physically installed and console connected
□ WAN circuits:
- MPLS: GigabitEthernet0/0/2
- Internet DIA: GigabitEthernet0/0/0
□ LAN connection: GigabitEthernet0/0/1 → existing switch
□ Firmware: IOS-XE 17.15.x verified
□ WAN IPs (static): Provided by carrier in provisioning letter
□ Device chassis number pre-staged in vManage device list
Day-0 Bootstrap (ISR 4331 Branch)¶
! ============================================================================
! DAY-0 BOOTSTRAP — BANGALORE BRANCH ISR 4331 (BLR-ISR-01)
! ============================================================================
system
system-ip 10.252.50.1
site-id 50
organization-name Abhavtech
vbond vbond.abhavtech.com
!
! Transport interface to reach vBond
interface GigabitEthernet0/0/0
description INTERNET-DIA-INITIAL
ip address dhcp ! Or static if ISP provides
no shutdown
!
sdwan
interface GigabitEthernet0/0/0
tunnel-interface
color dia
encapsulation ipsec
no restrict
!
!
!
commit
vManage Template Attachment (Branch ISR 4331)¶
Template: ABV-DeviceTemplate-Branch-ISR4331
Variables:
system_hostname: BLR-ISR-01
system_ip: 10.252.50.1
site_id: 50
mpls_ip: <carrier-assigned>
mpls_next_hop: <carrier PE IP>
dia_ip: dhcp
lan_ip: 192.168.50.1
lan_prefix: 192.168.50.0/24
lan_excluded_end: 192.168.50.20
mgmt_ip: 10.252.200.50
mgmt_prefix: 10.252.200.0/24
mgmt_gateway: 10.252.200.1
Week 3 Day 4: Small Branch Deployment (ISR 1100-4GLTENA)¶
Small branches (13 India sites) deploy via full ZTP with no console access required.
ZTP Flow for ISR 1100¶
DEPLOYMENT STEPS (All done remotely):
PRE-SHIP (done by NOC, before device leaves warehouse):
1. Activate serial number in Cisco Smart Account
2. Pre-stage in vManage device list (chassis + UUID + token)
3. Pre-attach device template with site-specific variables
4. Confirm DNS: vbond.abhavtech.com resolves correctly
ON-SITE (done by non-technical branch staff):
1. Unbox ISR 1100
2. Connect GigabitEthernet0 → ISP modem/router (WAN)
3. Connect GigabitEthernet0/0/1 → office switch (LAN)
4. Connect Cellular antenna (for LTE backup)
5. Power on
6. Wait 10-15 minutes
AUTOMATIC (requires no intervention):
7. ISR 1100 boots, contacts DHCP, gets IP on WAN port
8. Contacts DNS → resolves vbond.abhavtech.com
9. vBond authenticates device certificate
10. vManage pushes pre-staged device template
11. Full config applied — MPLS + DIA + LTE + VPNs + QoS + UTD + Umbrella
12. BFD sessions established to hub sites
13. OMP routes distributed
14. vManage alarm: "Device operational"
NOC VALIDATION (15 minutes after power-on):
15. Verify in vManage dashboard: Site online, tunnels green
16. Send confirmation to branch contact
vManage: ISR 1100 Device Template¶
Template Name: ABV-DeviceTemplate-Branch-ISR1100
Device Type: vedge-ISR-1100-4GLTENA
Feature Templates Attached:
├── ABV-System-Branch-ISR1100 (System)
├── ABV-AAA-Global (AAA)
├── ABV-Banner-Global (Banner)
├── ABV-OMP-Global (OMP)
├── ABV-VPN0-Transport (VPN 0 routing)
├── ABV-IF-VPN0-DIA-Branch-ISR1100 (GigabitEthernet0 — DIA)
├── ABV-IF-VPN0-LTE-Branch-ISR1100 (Cellular0 — LTE backup)
├── ABV-VPN1-Corporate (VPN 1)
├── ABV-IF-VPN1-LAN-Branch-ISR1100 (GigabitEthernet0/0/1 — LAN)
├── ABV-VPN512-Management (VPN 512 — OOB mgmt)
├── ABV-BGP-Branch-VPN1 (BGP for VPN 1)
├── ABV-UTD-Branch (UTD security)
├── ABV-ZBFW-Branch (Zone-based FW)
└── Abhavtech-Branch-CloudOnRamp-AAR (AAR policy)
Week 3 Day 5: Per-Site Deployment Verification¶
#!/bin/bash
## site_deployment_verification.sh
## Run after each new site comes online
SITE=$1 # hostname (e.g., BLR-BR-01)
SYSTEM_IP=$2 # e.g., 10.252.50.1
echo "=== SITE DEPLOYMENT VERIFICATION: $SITE ($SYSTEM_IP) ==="
## 1. vManage shows device as reachable
echo ""
echo "[1] vManage Reachability"
STATUS=$(curl -k -s -b /tmp/cookies.txt \
"https://vmanage.abhavtech.com/dataservice/device?deviceId=$SYSTEM_IP" | \
python3 -c "import json,sys; d=json.load(sys.stdin); \
print(d['data'][0].get('reachability','unknown') if d.get('data') else 'not found')")
[[ "$STATUS" == "reachable" ]] && echo "✅ vManage: reachable" || echo "❌ vManage: $STATUS"
## 2. Control connections established
echo ""
echo "[2] Control Connections"
ssh admin@$SYSTEM_IP "show sdwan control connections | grep ESTABLISHED | wc -l" 2>/dev/null | \
xargs -I{} bash -c '[[ "{}" -ge 4 ]] && echo "✅ Control: {} connections" || echo "❌ Control: {} connections (expected 4+)"'
## 3. BFD sessions to hub
echo ""
echo "[3] BFD Sessions"
ssh admin@$SYSTEM_IP "show sdwan bfd sessions | grep Up | wc -l" 2>/dev/null | \
xargs -I{} bash -c '[[ "{}" -ge 2 ]] && echo "✅ BFD: {} UP sessions" || echo "❌ BFD: {} sessions (expected 2+)"'
## 4. OMP routes received
echo ""
echo "[4] OMP Routes"
ROUTE_COUNT=$(ssh admin@$SYSTEM_IP "show sdwan omp routes vpn 1 | count" 2>/dev/null | tail -1)
[[ "$ROUTE_COUNT" -ge 10 ]] && echo "✅ OMP: $ROUTE_COUNT routes in VPN 1" || echo "❌ OMP: $ROUTE_COUNT routes (expected 10+)"
## 5. Hub reachability
echo ""
echo "[5] Hub Reachability (ICMP)"
PING=$(ssh admin@$SYSTEM_IP "ping vrf 1 10.252.1.1 repeat 5 | tail -3" 2>/dev/null)
echo "$PING" | grep -q "5/5" && echo "✅ Mumbai hub: 5/5 ping" || echo "⚠️ Mumbai hub: $PING"
## 6. Azure SQL reachability
echo ""
echo "[6] Azure SQL (Private Endpoint)"
ssh admin@$SYSTEM_IP "ping vrf 1 10.100.10.10 repeat 3 | tail -2" 2>/dev/null | \
grep -q "3/3" && echo "✅ Azure SQL (10.100.10.10): Reachable" || echo "⚠️ Azure SQL: Check routing"
## 7. Internet access (Umbrella)
echo ""
echo "[7] Internet via Umbrella DNS"
ssh admin@$SYSTEM_IP "show umbrella config | grep Status" 2>/dev/null | \
grep -qi "registered" && echo "✅ Umbrella: Registered" || echo "❌ Umbrella: Not registered"
## 8. Policy applied
echo ""
echo "[8] AAR Policy"
ssh admin@$SYSTEM_IP "show sdwan policy app-route-policy" 2>/dev/null | \
grep -qi "CloudOnRamp" && echo "✅ AAR Policy: Applied" || echo "❌ AAR Policy: Missing"
echo ""
echo "=== VERIFICATION COMPLETE: $SITE ==="
Week 4: Advanced Configuration and Automation¶
Week 4 Day 1: Configuration Groups (vManage 20.12+)¶
Configuration Groups replace Feature Templates as the new unified configuration model in vManage 20.12+. Both are supported; Configuration Groups offer profile-based configuration.
Create Configuration Group: Hub Sites¶
Navigate: Configuration → Configuration Groups → Add Group
Group Name: ABV-Hub-C8500-Group
Description: All hub sites (Mumbai, Chennai, London, Frankfurt, NJ, Dallas)
Device Type: vedge-c8500-12X
Profile Set:
├── Transport Profile:
│ Includes: VPN 0, all WAN interfaces (MPLS, DIA, ER)
│ Variables: wan_ips, gateways, colors (per-device)
│
├── Service Profile:
│ Includes: VPN 1-4, VPN 512, LAN interfaces, DHCP
│ Variables: lan_subnets, dns_servers (per-region)
│
├── System Profile:
│ Includes: System, AAA, NTP, Logging, Banner
│ Variables: hostname, system_ip, site_id (per-device)
│
├── Security Profile:
│ Includes: UTD, ZBFW
│ Variables: IPS mode (uniform — no device variables)
│
└── Policy Profile:
Includes: AAR policy, Data policy, Control policy
Variables: None (policies uniform across all hubs)
Create Configuration Group: Branch ISR 4331¶
Group Name: ABV-Branch-ISR4331-Group
Description: Large branch sites (Bangalore, Delhi, Frankfurt)
Device Type: vedge-ISR-4331
Profile Set:
├── Transport Profile: VPN 0, MPLS, DIA interfaces
├── Service Profile: VPN 1, LAN, DHCP server
├── System Profile: System settings
├── Security Profile: UTD (Detection mode), ZBFW
└── Policy Profile: Branch AAR policy
Week 4 Day 2: vManage REST API — Full Automation Scripts¶
Python: Complete vManage Automation Library¶
#!/usr/bin/env python3
"""
Abhavtech SD-WAN vManage Automation Library
Covers: Device management, template operations, policy management, monitoring
"""
import requests
import json
import time
import urllib3
from typing import Optional, Dict, List
urllib3.disable_warnings()
class VManageClient:
"""Complete vManage REST API client"""
def __init__(self, host: str, username: str, password: str):
self.host = host
self.base_url = f"https://{host}"
self.session = requests.Session()
self.session.verify = False
self._login(username, password)
def _login(self, username: str, password: str):
self.session.post(
f"{self.base_url}/j_security_check",
data={"j_username": username, "j_password": password},
headers={"Content-Type": "application/x-www-form-urlencoded"}
)
token = self.session.get(f"{self.base_url}/dataservice/client/token").text
self.session.headers["X-XSRF-TOKEN"] = token
def get(self, endpoint: str) -> dict:
r = self.session.get(f"{self.base_url}/dataservice/{endpoint}")
r.raise_for_status()
return r.json()
def post(self, endpoint: str, payload: dict) -> dict:
r = self.session.post(
f"{self.base_url}/dataservice/{endpoint}",
json=payload,
headers={"Content-Type": "application/json"}
)
r.raise_for_status()
return r.json()
def put(self, endpoint: str, payload: dict) -> dict:
r = self.session.put(
f"{self.base_url}/dataservice/{endpoint}",
json=payload,
headers={"Content-Type": "application/json"}
)
r.raise_for_status()
return r.json()
## --- Device Operations ---
def get_all_devices(self) -> List[Dict]:
"""Get all WAN edge devices"""
return self.get("device?type=vedge").get("data", [])
def get_device(self, system_ip: str) -> Optional[Dict]:
"""Get specific device by system IP"""
devices = self.get_all_devices()
for d in devices:
if d.get("system-ip") == system_ip:
return d
return None
def get_device_running_config(self, device_id: str) -> str:
"""Get running configuration of a device"""
return self.get(f"template/config/running/{device_id}")
## --- Template Operations ---
def get_device_templates(self) -> List[Dict]:
"""List all device templates"""
return self.get("template/device").get("data", [])
def get_template_id(self, template_name: str) -> Optional[str]:
"""Get template ID by name"""
for t in self.get_device_templates():
if t["templateName"] == template_name:
return t["templateId"]
return None
def attach_template(self, template_id: str, device_configs: List[Dict]) -> dict:
"""Attach template to one or more devices"""
payload = {
"deviceTemplateList": [{
"templateId": template_id,
"device": device_configs
}]
}
return self.post("template/device/config/attachfeature", payload)
def wait_for_action(self, action_id: str, timeout: int = 300) -> bool:
"""Wait for a vManage action to complete"""
start = time.time()
while time.time() - start < timeout:
status = self.get(f"device/action/status/{action_id}")
if status.get("data", [{}])[0].get("status") in ["Success", "Done"]:
return True
if status.get("data", [{}])[0].get("status") == "Failure":
return False
time.sleep(10)
return False
## --- Policy Operations ---
def get_policies(self) -> List[Dict]:
"""List all vSmart policies"""
return self.get("template/policy/vsmart").get("data", [])
def activate_policy(self, policy_id: str) -> dict:
"""Activate a vSmart policy"""
return self.post(f"template/policy/vsmart/activate/{policy_id}", {})
def deactivate_policy(self, policy_id: str) -> dict:
"""Deactivate a vSmart policy"""
return self.post(f"template/policy/vsmart/deactivate/{policy_id}", {})
## --- Monitoring Operations ---
def get_tunnel_stats(self, system_ip: str) -> List[Dict]:
"""Get tunnel statistics for a device"""
return self.get(f"statistics/interface/fec?deviceId={system_ip}").get("data", [])
def get_app_route_stats(self, hours: int = 24) -> List[Dict]:
"""Get application route statistics"""
now = int(time.time() * 1000)
start = now - (hours * 3600 * 1000)
return self.get(
f"statistics/approute/fec/aggregation"
f"?startTime={start}&endTime={now}&count=100"
).get("data", [])
def get_device_alarms(self, severity: str = "critical") -> List[Dict]:
"""Get active alarms for all devices"""
return self.get(
f"alarms?acknowledged=false&severity={severity}"
).get("data", [])
def get_bfd_sessions(self, system_ip: str) -> List[Dict]:
"""Get BFD sessions for a device"""
return self.get(f"device/bfdsessions?deviceId={system_ip}").get("data", [])
def get_omp_routes(self, system_ip: str, vpn: int = 1) -> List[Dict]:
"""Get OMP route table for a device/VPN"""
return self.get(
f"device/omp/routes/received?deviceId={system_ip}&vpn={vpn}"
).get("data", [])
## --- Operational Scripts ---
def check_fabric_health(client: VManageClient):
"""Check overall SD-WAN fabric health"""
print("\n📊 SD-WAN FABRIC HEALTH CHECK")
print("=" * 60)
devices = client.get_all_devices()
reachable = [d for d in devices if d.get("reachability") == "reachable"]
unreachable = [d for d in devices if d.get("reachability") != "reachable"]
print(f"\n Devices: {len(reachable)}/{len(devices)} reachable")
if unreachable:
print("\n ❌ UNREACHABLE DEVICES:")
for d in unreachable:
print(f" - {d['host-name']} ({d['system-ip']})")
## Check alarms
alarms = client.get_device_alarms("critical")
print(f"\n Critical Alarms: {len(alarms)}")
for alarm in alarms[:5]:
print(f" ⚠️ {alarm.get('message', 'Unknown')[:60]}")
## App route SLA
stats = client.get_app_route_stats(hours=1)
sla_violations = [s for s in stats if s.get("average_loss", 0) > 1.0
or s.get("average_latency", 0) > 100]
print(f"\n SLA Violations (last 1h): {len(sla_violations)}")
def deploy_new_site(client: VManageClient, site_config: Dict):
"""Deploy a new branch site"""
print(f"\n🚀 DEPLOYING SITE: {site_config['hostname']}")
template_id = client.get_template_id(site_config["template"])
if not template_id:
print(f"❌ Template not found: {site_config['template']}")
return
device_vars = {
"csv-status": "complete",
"csv-deviceId": site_config["chassis"],
"csv-deviceIP": site_config["system_ip"],
"csv-site-id": str(site_config["site_id"]),
"//system/host-name": site_config["hostname"],
"//system/system-ip": site_config["system_ip"],
"/1/GigabitEthernet0/0/1/ip/address": site_config["lan_ip"],
}
try:
result = client.attach_template(template_id, [device_vars])
action_id = result.get("id")
print(f" Action ID: {action_id}")
if action_id and client.wait_for_action(action_id):
print(f" ✅ Template deployed successfully")
else:
print(f" ❌ Deployment failed or timed out")
except Exception as e:
print(f" ❌ Error: {e}")
if __name__ == "__main__":
client = VManageClient("vmanage.abhavtech.com", "admin", "<PASSWORD>")
check_fabric_health(client)
Week 4 Day 3: Catalyst Center SD-WAN Integration¶
Connect vManage to Catalyst Center¶
Navigate in Catalyst Center: Design → Network Settings → SD-WAN
vManage URL: https://vmanage.abhavtech.com
Username: catalyst-center-svc
Password: <SERVICE_ACCOUNT_PASSWORD>
Verify Certificate: Enabled (import vManage cert first)
Integration Enables:
- Catalyst Center sees WAN health alongside LAN health
- Single pane of glass for DNAC + vManage
- Correlated assurance: "User on SD-Access fabric with WAN issue"
Integration Verification¶
## Verify Catalyst Center can query vManage
curl -k -X GET \
"https://catalyst-center.abhavtech.com/api/v1/site-health" \
-H "X-Auth-Token: <DNAC_TOKEN>" \
| python3 -m json.tool | grep -i "wan"
## Expected: WAN health data from vManage in site health response
## Check SD-WAN health in Catalyst Center dashboard
## Assurance → Health → Sites → Click any site with WAN
## Should show: WAN Transport Health, Tunnel Up/Down, App Performance
Week 4 Day 4: Day-2 Operations Runbooks¶
Runbook 1: Add a New Branch Site¶
ESTIMATED TIME: 4 hours (including carrier provisioning)
STEP 1 — Device Preparation (1 hour before deployment):
1. Get device chassis/serial from procurement
2. Register in Cisco Smart Account (PnP Portal)
3. Run: python3 vmanage_automation.py --action pre_stage_device \
--hostname NEW-SITE-01 --system-ip 10.252.XX.1 --site-id XX
4. Confirm device appears in vManage device list
STEP 2 — ISP Circuit:
1. Order DIA circuit (lead time 2-4 weeks typically)
2. Get LTE SIM from Jio/Airtel for backup
3. Insert SIM into ISR 1100 cellular slot before shipping
STEP 3 — Ship and Connect (on-site):
1. Ship pre-staged device to site
2. Site contact connects WAN, LAN, power
3. ISR 1100 auto-provisions via ZTP
STEP 4 — NOC Validation:
1. Monitor vManage for device to come online
2. Run: bash site_deployment_verification.sh NEW-SITE-01 10.252.XX.1
3. All checks pass → site operational
4. Close deployment ticket
Runbook 2: Transport Failure Response¶
TRIGGER: vManage alarm — "WAN transport down" | Splunk alert — tunnel loss
STEP 1 — Assess (2 minutes):
ssh admin@affected-site
show sdwan control connections
show sdwan bfd sessions
→ Identify which transport failed (mpls/dia/lte color)
STEP 2 — Confirm Traffic Failover Occurred:
show sdwan app-fwd cflowd flows | head
→ Verify flows moved to backup transport
→ If failover occurred: SD-WAN handling automatically — log only
STEP 3 — If Failover Did NOT Occur:
show sdwan policy app-route-policy
→ Verify SLA class bound to failed transport
→ Check if backup color "restrict" was accidentally enabled
→ Remove restriction if needed:
sdwan > interface GigEX/X/X > tunnel-interface > no restrict
STEP 4 — Escalate to Carrier:
Identify carrier (MPLS = Tata/BT/AT&T, DIA = local ISP)
Open ticket with carrier circuit ID (from CMDB)
Set SLA timer
STEP 5 — Document:
Update Splunk ticket with root cause
Note TTR (Time to Restore) for SLA reporting
Week 4 Day 5: Final Validation and Sign-Off¶
Complete SD-WAN Fabric Validation¶
#!/bin/bash
## final_validation.sh — Run on management server before sign-off
echo "========================================================"
echo " ABHAVTECH SD-WAN FABRIC FINAL VALIDATION"
echo " $(date)"
echo "========================================================"
PASS=0
FAIL=0
check() {
local desc=$1
local cmd=$2
local expected=$3
result=$(eval "$cmd" 2>/dev/null)
if echo "$result" | grep -q "$expected"; then
echo "✅ PASS: $desc"
((PASS++))
else
echo "❌ FAIL: $desc (expected: $expected, got: $result)"
((FAIL++))
fi
}
## --- FABRIC HEALTH ---
echo ""
echo "━━━━ FABRIC HEALTH ━━━━"
## All 19 devices reachable in vManage
REACHABLE=$(curl -k -s -b /tmp/cookies.txt \
"https://vmanage.abhavtech.com/dataservice/device?type=vedge" | \
python3 -c "import json,sys; d=json.load(sys.stdin); print(sum(1 for x in d['data'] if x.get('reachability')=='reachable'))")
[[ "$REACHABLE" -eq 19 ]] && { echo "✅ PASS: All 19 devices reachable"; ((PASS++)); } \
|| { echo "❌ FAIL: Only $REACHABLE/19 devices reachable"; ((FAIL++)); }
## Hub BFD sessions (hub should have 30+ sessions — inter-site tunnels)
for HUB in mum-hub-01 lon-hub-01 nj-hub-01; do
BFD=$(ssh admin@$HUB "show sdwan bfd sessions | grep Up | wc -l" 2>/dev/null)
[[ "$BFD" -ge 15 ]] && { echo "✅ PASS: [$HUB] BFD: $BFD sessions UP"; ((PASS++)); } \
|| { echo "❌ FAIL: [$HUB] BFD: $BFD sessions (expected 15+)"; ((FAIL++)); }
done
## --- CLOUD ONRAMP ---
echo ""
echo "━━━━ CLOUD ONRAMP ━━━━"
SAAS_APPS=$(curl -k -s -b /tmp/cookies.txt \
"https://vmanage.abhavtech.com/dataservice/cloudonramp/saas/apps" | \
python3 -c "import json,sys; d=json.load(sys.stdin); print(len(d.get('data', [])))")
[[ "$SAAS_APPS" -ge 6 ]] && { echo "✅ PASS: $SAAS_APPS SaaS apps configured"; ((PASS++)); } \
|| { echo "❌ FAIL: Only $SAAS_APPS SaaS apps (expected 6+)"; ((FAIL++)); }
## Teams latency (via ExpressRoute should be <20ms from hub sites)
for HUB in mum-hub-01 lon-hub-01 nj-hub-01; do
LAT=$(ssh admin@$HUB "ping teams.microsoft.com repeat 5 | tail -1 | awk -F/ '{print int(\$5)}'" 2>/dev/null)
[[ -n "$LAT" && "$LAT" -lt 20 ]] && { echo "✅ PASS: [$HUB] Teams latency: ${LAT}ms"; ((PASS++)); } \
|| { echo "⚠️ WARN: [$HUB] Teams latency: ${LAT}ms (expected <20ms)"; }
done
## --- VPN SEGMENTATION ---
echo ""
echo "━━━━ VPN SEGMENTATION ━━━━"
## Guest VPN should have no corporate routes
GUEST_LEAK=$(ssh admin@mum-hub-01 "show sdwan omp routes vpn 3 | grep 10.252" 2>/dev/null | wc -l)
[[ "$GUEST_LEAK" -eq 0 ]] && { echo "✅ PASS: Guest VPN isolated (no corporate routes)"; ((PASS++)); } \
|| { echo "❌ FAIL: Corporate routes leaking into Guest VPN!"; ((FAIL++)); }
## SD-Access BGP peering
SDA_BGP=$(ssh admin@mum-hub-01 "show bgp vpnv4 unicast vrf 1 summary | grep Estab" 2>/dev/null | wc -l)
[[ "$SDA_BGP" -ge 1 ]] && { echo "✅ PASS: SD-Access BGP established (VRF 1)"; ((PASS++)); } \
|| { echo "❌ FAIL: SD-Access BGP not established"; ((FAIL++)); }
## --- AZURE / GCP CONNECTIVITY ---
echo ""
echo "━━━━ CLOUD CONNECTIVITY ━━━━"
AZURE_SQL=$(ssh admin@mum-hub-01 "ping vrf 1 10.100.10.10 repeat 3 | tail -1" 2>/dev/null)
echo "$AZURE_SQL" | grep -q "3/3" && { echo "✅ PASS: Azure SQL (PE) reachable"; ((PASS++)); } \
|| { echo "❌ FAIL: Azure SQL not reachable: $AZURE_SQL"; ((FAIL++)); }
## --- SUMMARY ---
echo ""
echo "========================================================"
echo " FINAL RESULT: $PASS PASSED, $FAIL FAILED"
echo " $([ $FAIL -eq 0 ] && echo '🎉 ALL CHECKS PASSED — READY FOR SIGN-OFF' || echo '⚠️ FAILURES DETECTED — RESOLVE BEFORE SIGN-OFF')"
echo "========================================================"
Appendix A: Complete Device Variable Reference¶
All Device Variables per Template Type¶
## Hub C8500-12X Variables
Hub_C8500_Variables:
system_hostname: "MUM-HUB-01"
system_ip: "10.252.1.1"
site_id: 1
timezone: "Asia/Kolkata"
mpls_ip: "172.16.100.2"
mpls_prefix: "30"
mpls_next_hop: "172.16.100.1"
dia_ip: "203.0.113.2"
dia_prefix: "29"
dia_next_hop: "203.0.113.1"
er_vlan: 4001
er_primary_ip: "169.254.200.2"
er_secondary_ip: "169.254.200.6"
corp_vlan: 3001
corp_handoff_ip: "10.240.1.2"
corp_handoff_prefix: "30"
hub_lan_subnet_1: "10.100.1.0/24"
hub_lan_subnet_2: "10.100.2.0/24"
hub_lan_subnet_3: "10.100.3.0/24"
mgmt_ip: "10.252.200.1"
mgmt_prefix: "24"
mgmt_gateway: "10.252.200.254"
admin_password: "<ENCRYPTED>"
## Branch ISR 4331 Variables
Branch_ISR4331_Variables:
system_hostname: "BLR-ISR-01"
system_ip: "10.252.50.1"
site_id: 50
timezone: "Asia/Kolkata"
mpls_ip: "172.16.150.2"
mpls_prefix: "30"
mpls_next_hop: "172.16.150.1"
dia_ip: "dhcp"
lan_ip: "192.168.50.1"
lan_prefix: "192.168.50.0/24"
lan_excluded_end: "192.168.50.20"
mgmt_ip: "10.252.200.50"
admin_password: "<ENCRYPTED>"
## Branch ISR 1100 Variables
Branch_ISR1100_Variables:
system_hostname: "NOI-BR-01"
system_ip: "10.252.55.1"
site_id: 55
timezone: "Asia/Kolkata"
dia_ip: "dhcp"
lan_ip: "192.168.55.1"
lan_prefix: "192.168.55.0/24"
admin_password: "<ENCRYPTED>"
Appendix B: Site Inventory and System IP Assignments¶
SITE IP PLAN:
┌────────────────────────────────────────────────────────────────────────────┐
│ Site │ Type │ System IP │ Site ID │ LAN Subnet │
├────────────────────────────────────────────────────────────────────────────┤
│ Mumbai │ Hub │ 10.252.1.1 │ 1 │ 10.100.1-3.0/24 │
│ Chennai │ Hub │ 10.252.2.1 │ 2 │ 10.100.4-6.0/24 │
│ London │ Hub │ 10.252.16.1 │ 16 │ 10.100.16-18.0/24 │
│ Frankfurt │ Hub │ 10.252.17.1 │ 17 │ 10.100.17-19.0/24 │
│ New Jersey │ Hub │ 10.252.32.1 │ 32 │ 10.100.32-34.0/24 │
│ Dallas │ Hub │ 10.252.33.1 │ 33 │ 10.100.33-35.0/24 │
│ Bangalore │ ISR 4331 │ 10.252.50.1 │ 50 │ 192.168.50.0/24 │
│ Delhi │ ISR 4331 │ 10.252.51.1 │ 51 │ 192.168.51.0/24 │
│ Hyderabad │ ISR 1100 │ 10.252.52.1 │ 52 │ 192.168.52.0/24 │
│ Pune │ ISR 1100 │ 10.252.53.1 │ 53 │ 192.168.53.0/24 │
│ Ahmedabad │ ISR 1100 │ 10.252.54.1 │ 54 │ 192.168.54.0/24 │
│ Noida │ ISR 1100 │ 10.252.55.1 │ 55 │ 192.168.55.0/24 │
│ Kolkata │ ISR 1100 │ 10.252.56.1 │ 56 │ 192.168.56.0/24 │
│ Jaipur │ ISR 1100 │ 10.252.57.1 │ 57 │ 192.168.57.0/24 │
│ Surat │ ISR 1100 │ 10.252.58.1 │ 58 │ 192.168.58.0/24 │
│ Nagpur │ ISR 1100 │ 10.252.59.1 │ 59 │ 192.168.59.0/24 │
│ Chandigarh │ ISR 1100 │ 10.252.60.1 │ 60 │ 192.168.60.0/24 │
│ Coimbatore │ ISR 1100 │ 10.252.61.1 │ 61 │ 192.168.61.0/24 │
│ Lucknow │ ISR 1100 │ 10.252.62.1 │ 62 │ 192.168.62.0/24 │
└────────────────────────────────────────────────────────────────────────────┘
MANAGEMENT NETWORK: 10.252.200.0/24
vManage: 10.252.31.10
vSmart-1: 10.252.31.11
vSmart-2: 10.252.31.12
vBond: 10.252.31.13
Splunk: 10.252.31.50
Implementation Complete¶
Total Duration: 4 Weeks (80 Hours)
What This Guide Delivered:
- 15 Feature Templates covering System, AAA, VPN 0 (transport), VPN 1-4 (service), VPN 512 (management), interfaces, routing (BGP/OSPF/Static), UTD, and Zone-Based Firewall
- VPN segmentation design — 5-VPN model (Corporate/Voice/Guest/IoT/OOB) with isolation policies
- Full SD-Access to SD-WAN handoff — BGP per VRF, 802.1Q sub-interfaces, route redistribution
- Zero-Touch Provisioning — complete ZTP workflow for ISR 1100 branches (no console required)
- Per-site deployment runbooks — hub C8500, branch ISR 4331, branch ISR 1100
- Configuration Groups — new vManage 20.12+ profile-based model
- Complete Python automation library — VManageClient class with full CRUD operations
- Day-2 Operations runbooks — Add site, transport failure response
- Site inventory — all 19 sites with System IPs, Site IDs, and LAN subnets
Guide Series Completion Summary¶
GUIDE 1: GCP Vertex AI — 4 weeks, 2,752 lines
GUIDE 2: Azure ExpressRoute + Virtual WAN — 4 weeks, 1,789 lines
GUIDE 3: SD-WAN Cloud OnRamp (SaaS/IaaS/SASE) — 4 weeks, 2,321 lines
GUIDE 4: SD-WAN Detailed Configuration (Templates/ZTP/Automation) — 4 weeks, THIS DOCUMENT
COMBINED: 16 weeks of deployment procedures, covering:
✅ GCP Vertex AI with WxCC analytics pipeline
✅ Azure ExpressRoute BGP (3 sites × 2 peers)
✅ Azure Virtual WAN with 19-site IPsec mesh
✅ SD-WAN Cloud OnRamp for SaaS (6 apps), IaaS (Azure), SASE (Umbrella)
✅ SD-WAN vManage template library (15 templates)
✅ VPN segmentation (5 VPNs) with SD-Access handoff
✅ Zero-Touch Provisioning for all branch types
✅ Python automation library for vManage API