Policy

Centralized policy can be built by either feature policy or cli policy.The focus for this example is feature policy. Centralized policy comprises of control policies , data policies and references to policy objects which is applied to all the sites.Only one centralized policy can be activated at any given instant.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
centralized_policies	Class	centralized_policies	No

centralized_policies (sdwan)

Name	Type	Constraint	Mandatory	Default Value
feature_policies	List	feature_policies	No

feature_policies (sdwan.centralized_policies)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[A-Za-z0-9\-_]{1,127}$	Yes
description	String		Yes
hub_and_spoke_topology	List	hub_and_spoke_topology	No
mesh_topology	List	mesh_topology	No
custom_control_topology	List	custom_control_topology	No
vpn_membership	List	vpn_membership	No
application_aware_routing	List	application_aware_routing	No
traffic_data	List	traffic_data	No
cflowd	List	cflowd	No

hub_and_spoke_topology (sdwan.centralized_policies.feature_policies)

Name	Type	Constraint	Mandatory	Default Value
policy_definition	String		Yes

mesh_topology (sdwan.centralized_policies.feature_policies)

Name	Type	Constraint	Mandatory	Default Value
policy_definition	String		Yes

custom_control_topology (sdwan.centralized_policies.feature_policies)

Name	Type	Constraint	Mandatory	Default Value
policy_definition	String		Yes
site_region	Class	site_region	Yes

vpn_membership (sdwan.centralized_policies.feature_policies)

Name	Type	Constraint	Mandatory	Default Value
policy_definition	String		Yes

application_aware_routing (sdwan.centralized_policies.feature_policies)

Name	Type	Constraint	Mandatory	Default Value
policy_definition	String		Yes
site_region_vpn	Class	site_region_vpn	No

traffic_data (sdwan.centralized_policies.feature_policies)

Name	Type	Constraint	Mandatory	Default Value
policy_definition	String		Yes
site_region_vpn	List	site_region_vpn	No

cflowd (sdwan.centralized_policies.feature_policies)

Name	Type	Constraint	Mandatory	Default Value
policy_definition	String		Yes
site_lists	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	Yes

site_region (sdwan.centralized_policies.feature_policies.custom_control_topology)

Name	Type	Constraint	Mandatory	Default Value
site_lists_in	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	No
site_lists_out	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	No
region_lists_in	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	No
region_lists_out	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	No
region_in	Integer	min: 0, max: 63	No
region_out	Integer	min: 0, max: 63	No

site_region_vpn (sdwan.centralized_policies.feature_policies.application_aware_routing)

Name	Type	Constraint	Mandatory	Default Value
site_lists	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	No
region_list	String	Regex: ^[A-Za-z0-9\-_]{1,32}$	No
region	Integer	min: 0, max: 63	No
vpn_lists	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	Yes

site_region_vpn (sdwan.centralized_policies.feature_policies.traffic_data)

Name	Type	Constraint	Mandatory	Default Value
direction	Choice	service, tunnel, all	Yes
site_lists	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	No
region_list	String	Regex: ^[A-Za-z0-9\-_]{1,32}$	No
region	Integer	min: 0, max: 63	No
vpn_lists	List	String[Regex: ^[A-Za-z0-9\-_]{1,32}$]	Yes

Examples

Example-1 : In the following example , the name of centralized policy has been configured as CP-Hub-and-Spoke-01 and is stitched together using following policies :

1.control policies.

TOPOLOGY-DC-OUT-01 which is applied to sites defined in site list CENTRAL-DC in the out direction TOPOLOGY-BR-T1-01 which is applied to sites defined in site list BR-T1 in the out direction TOPOLOGY-BR-T2-01 which is applied to sites defined in site list BR-T2 in the out direction

2.traffic data policies

DP-VPN10-01 which is applied to sites defined in site list CENTRAL-DC and BR-ALL for VPN list defined in VPN-PROD. DP-VPN11-01 which is applied to sites defined in site list CENTRAL-DC and BR-ALL for VPN list defined in VPN-Guest.

3.application aware routing

AAR-Policy-01 is applied to sites defined in site list CENTRAL-DC and BR-ALL for VPN list defined in VPN-PROD.

4.cflowd policy

CFLOW_DEFINITION_v01 is applied to sites defined in site list DC-BR-ALL

sdwan:
  centralized_policies:
    feature_policies:
      - name: CP-Hub-and-Spoke-01
        description: Hub and Spoke | AAR | DP for QoS | cFlow
        custom_control_topology:
          - policy_definition: TOPOLOGY-DC-OUT-01
            site_region:
              site_lists_out:
                - CENTRAL-DC
          - policy_definition: TOPOLOGY-BR-T1-01
            site_region:
              site_lists_out:
                - BR-T1
          - policy_definition: TOPOLOGY-BR-T2-01
            site_region:
              site_lists_out:
                - BR-T2
        traffic_data:
          - policy_definition: DP-VPN10-01
            site_region_vpn:
              - direction: service
                site_lists:
                  - CENTRAL-DC
                  - BR-ALL
                vpn_lists:
                  - VPN-PROD
          - policy_definition: DP-VPN11-01
            site_region_vpn:
              - direction: service
                site_lists:
                  - CENTRAL-DC
                  - BR-ALL
                vpn_lists:
                  - VPN-Guest
        application_aware_routing:
          - policy_definition: AAR-Policy-01
            site_region_vpn:
              site_lists:
                - CENTRAL-DC
                - BR-ALL
              vpn_lists:
                - VPN-PROD
        cflowd:
          - policy_definition: CFLOW_DEFINITION_v01
            site_lists:
              - DC-BR-ALL