SSE Cisco Feature

Configure SSE Cisco Secure Access feature profile.

Diagram

Classes

sse_profiles (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
cisco	Class	[cisco]	No

cisco (sdwan.feature_profiles.sse_profiles)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	Yes
description	String		No
context_sharing_for_sgt	Boolean	true, false	No
context_sharing_for_vpn	Boolean	true, false	No
interface_pairs	List	[interface_pairs]	Yes
interfaces	List	[interfaces]	Yes
region	String	min: 1	No
tracker_source_ip	IP		No
tracker_source_ip_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
trackers	List	[trackers]	No

interface_pairs (sdwan.feature_profiles.sse_profiles.cisco)

Name	Type	Constraint	Mandatory	Default Value
active_interface	String	Regex: ^ipsec(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$	No
active_interface_weight	Integer	min: 1, max: 255	No
backup_interface	String	Regex: ^(None|ipsec(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d))$	No
backup_interface_weight	Integer	min: 1, max: 255	No

interfaces (sdwan.feature_profiles.sse_profiles.cisco)

Name	Type	Constraint	Mandatory	Default Value
dpd_interval	Integer	min: 0, max: 65535	No
dpd_interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
dpd_retries	Integer	min: 0, max: 255	No
dpd_retries_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_ciphersuite	Choice	aes256-cbc-sha1, aes256-cbc-sha2, aes128-cbc-sha1, aes128-cbc-sha2	No
ike_ciphersuite_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_group	Choice	2, 5, 14, 15, 16, 19, 20, 21	No
ike_group_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ike_rekey_interval	Integer	min: 300, max: 1209600	No
ike_rekey_interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
interface_name	String	Regex: ^ipsec(?:1\d{2}|2[0-4]\d|25[0-5]|[1-9]\d|\d)$	No
ipsec_ciphersuite	Choice	aes256-cbc-sha1, aes256-cbc-sha384, aes256-cbc-sha256, aes256-cbc-sha512, aes256-gcm	No
ipsec_ciphersuite_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ipsec_rekey_interval	Integer	min: 300, max: 1209600	No
ipsec_rekey_interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
ipsec_replay_window	Integer	min: 64, max: 4096	No
ipsec_replay_window_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
mtu	Integer	min: 576, max: 2000	No
mtu_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
perfect_forward_secrecy	Choice	group-2, group-5, group-14, group-15, group-16, group-19, group-20, group-21, none	No
perfect_forward_secrecy_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
shutdown	Boolean	true, false	No
shutdown_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tcp_mss_adjust	Integer	min: 500, max: 1460	No
tcp_mss_adjust_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
track_enable	Boolean	true, false	No
track_enable_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tracker	String	min: 1, max: 128	No
tunnel_dc_preference	Choice	primary-dc, secondary-dc	No
tunnel_route_via	String	min: 1, max: 32	No
tunnel_route_via_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
tunnel_source_interface	String	Regex: ^(ATM|ATM-ACR|AppGigabitEthernet|AppNav-Compress|AppNav-UnCompress|Async|BD-VIF|BDI|CEM|CEM-ACR|Cellular|Dialer|Embedded-Service-Engine|Ethernet|Ethernet-Internal|FastEthernet|FiftyGigabitEthernet|FiveGigabitEthernet|FortyGigabitEthernet|FourHundredGigE|GMPLS|GigabitEthernet|Group-Async|HundredGigE|L2LISP|LISP|Loopback|MFR|Multilink|Port-channel|SM|Serial|Service-Engine|TenGigabitEthernet|Tunnel|TwentyFiveGigE|TwentyFiveGigabitEthernet|TwoGigabitEthernet|TwoHundredGigE|Vif|Virtual-PPP|Virtual-Template|VirtualPortGroup|Vlan|Wlan-GigabitEthernet|nat64|nat66|ntp|nve|ospfv3|overlay|pseudowire|ucse|vasileft|vasiright|vmi)([0-9]*(. ?[1-9][0-9]*)*|[0-9/]+|[0-9]+/[0-9]+/[0-9]+:[0-9]+|[0-9]+/[0-9]+/[0-9]+|[0-9]+/[0-9]+|[0-9]+)$	No
tunnel_source_interface_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

trackers (sdwan.feature_profiles.sse_profiles.cisco)

Name	Type	Constraint	Mandatory	Default Value
name	String	min: 1, max: 128	Yes
endpoint_api_url	String	Regex: ^https?://[^\s/$.?#].[^\s]*$	No
endpoint_api_url_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
interval	Integer	min: 20, max: 600	No
interval_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
multiplier	Integer	min: 1, max: 10	No
multiplier_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No
threshold	Integer	min: 100, max: 1000	No
threshold_variable	String	Regex: ^[./\[\]a-zA-Z0-9_-]{1,128}$	No

Examples

Example-1: The example below demonstrates how to configure a basic SSE Cisco feature profile.

sdwan:
  feature_profiles:
    sse_profiles:
      - name: sse_cisco_profile_1
        description: Basic Cisco SSE profile
        cisco:
          name: sse_cisco_profile_1
          description: Basic Cisco Secure Access
          interfaces:
            - interface_name: ipsec2
              tunnel_source_interface: GigabitEthernet2
              tunnel_dc_preference: primary-dc
          interface_pairs:
            - active_interface: ipsec2
              active_interface_weight: 1
              backup_interface: None
              backup_interface_weight: 1
          region: Auto
          tracker_source_ip: 10.0.2.1