Topology Mesh Policy

Configure mesh topology policies for full-mesh connectivity between specified sites through target VPNs.

sites also accepts network hierarchy groups and regions via the paired site_groups key - a group name expands to every site nested under it, unioned with any sites listed directly. See Example-3 and the version note below.

Diagram

Classes

topology_profiles (sdwan.feature_profiles)

Name	Type	Constraint	Mandatory	Default Value
mesh_policies	List	[mesh_policies]	No

mesh_policies (sdwan.feature_profiles.topology_profiles)

Name	Type	Constraint	Mandatory	Default Value
name	String	Regex: ^[^&<>! "]{1,128}$	Yes
lan_vpn_names	List	String[Regex: ^[^&<>! "]{1,128}$]	Yes
sites	List	String	No
site_groups	List	String	No

Examples

Example-1: This example demonstrates a basic mesh topology connecting three sites with full-mesh connectivity through a single VPN.

sdwan:
  feature_profiles:
    topology_profiles:
      - name: topology_profile_1
        description: mesh topology
        mesh_policies:
          - name: mesh_basic
            lan_vpn_names:
              - service_lan_vpn1
            sites:
              - SITE_100
              - SITE_200
              - SITE_300

Example-2: This example demonstrates a mesh topology spanning multiple VPNs with several sites.

sdwan:
  feature_profiles:
    topology_profiles:
      - name: topology_profile_2
        description: multi vpn mesh topology
        mesh_policies:
          - name: mesh_multi_vpn
            lan_vpn_names:
              - service_lan_vpn1
              - service_lan_vpn2
            sites:
              - SITE_100
              - SITE_200
              - SITE_300
              - SITE_400

Note:

• lan_vpn_names references service LAN VPN feature names (not VPN IDs). If a VPN needs renumbering, create a new LAN VPN feature with the desired VPN ID rather than modifying the existing one in-place.

Example-3: This example demonstrates full-mesh targeting by network hierarchy group instead of listing individual sites. CAMPUS is a group declared under sdwan.network_hierarchy that expands to every site nested under it.

sdwan:
  manager_version: "20.18.4"
  network_hierarchy:
    groups:
      - name: CAMPUS
        sites:
          - name: SITE_100
            site_id: 100
          - name: SITE_200
            site_id: 200
          - name: SITE_300
            site_id: 300
  feature_profiles:
    topology_profiles:
      - name: topology_profile_3
        description: group-targeted mesh topology
        mesh_policies:
          - name: mesh_by_group
            lan_vpn_names:
              - service_lan_vpn1
            site_groups:
              - CAMPUS

Note: site targeting and Manager version

• A group name in site_groups must be declared as a group or region under sdwan.network_hierarchy, and a plain site name in sites must be declared as a site there too - directly, or nested under any group/region. An undeclared name fails validation.
• When sdwan.network_hierarchy is declared, every resolved site is sent as a network hierarchy UUID on Manager 20.18.1 and later. An unset manager_version is treated as 20.18.1+.
• Set manager_version below 20.18 (e.g. "20.15") to send plain site names on the wire instead, for Managers that predate hierarchy UUIDs. manager_version is required whenever sdwan.network_hierarchy is declared - validation rejects the combination of a declared hierarchy and an unset version.
• A site_groups entry that expands to no sites (an empty group) fails the plan - at least one site must resolve.