Site

This includes site and device specific configuration including device variables.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
sites	List	[sites]	No

sites (sdwan)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 4294967295	Yes
routers	List	[routers]	Yes

routers (sdwan.sites)

Name	Type	Constraint	Mandatory	Default Value
chassis_id	String		Yes
management_ip_variable	String	Regex: ^[^"~`$&+,]{1,255}$	No
configuration_group	String	Regex: ^[^<>!&" ]{1,128}$	No
configuration_group_deploy	Boolean	true, false	No	true
policy_group	String	Regex: ^[^<>!&" ]{1,128}$	No
policy_group_deploy	Boolean	true, false	No	true
tags	List	String[Regex: ^[^<>!&" ]{1,128}$]	No
topology_label	String		No
model	Choice	ASR-1001-HX, ASR-1001-X, ASR-1002-HX, ASR-1002-X, ASR-1006-X, C1101-4P, C1101-4PLTEP, C1101-4PLTEPW, C1109-2PLTEGB, C1109-2PLTEUS, C1109-2PLTEVZ, C1109-4PLTE2P, C1109-4PLTE2PW, C1111-4P, C1111-4PLTEEA, C1111-4PLTELA, C1111-4PW, C1111-8P, C1111-8PLTEEA, C1111-8PLTEEAW, C1111-8PLTELA, C1111-8PLTELAW, C1111-8PW, C1111X-8P, C1112-8P, C1112-8PLTEEA, C1112-8PLTEEAWE, C1112-8PWE, C1113-8P, C1113-8PLTEEA, C1113-8PLTEEAW, C1113-8PLTELA, C1113-8PLTELAWZ, C1113-8PLTEW, C1113-8PM, C1113-8PMLTEEA, C1113-8PMWE, C1113-8PW, C1116-4P, C1116-4PLTEEA, C1116-4PLTEEAWE, C1116-4PWE, C1117-4P, C1117-4PLTEEA, C1117-4PLTEEAW, C1117-4PLTELA, C1117-4PLTELAWZ, C1117-4PM, C1117-4PMLTEEA, C1117-4PMLTEEAWE, C1117-4PMWE, C1117-4PW, C1118-8P, C1121-4P, C1121-4PLTEP, C1121-8P, C1121-8PLTEP, C1121-8PLTEPW, C1121X-8P, C1121X-8PLTEP, C1121X-8PLTEPW, C1126-8PLTEP, C1126X-8PLTEP, C1127-8PLTEP, C1127-8PMLTEP, C1127X-8PLTEP, C1127X-8PMLTEP, C1128-8PLTEP, C1131-8PLTEPW, C1131-8PW, C1131X-8PLTEPW, C1131X-8PW, C1161-8P, C1161-8PLTEP, C1161X-8P, C1161X-8PLTEP, C8000V, C8200-1N-4T, C8200L-1N-4T, C8300-1N1S-4T2X, C8300-1N1S-6T, C8300-2N2S-4T2X, C8300-2N2S-6T, C8500-12X, C8500-12X4QC, C8500-20X6C, C8500L-8S4X, IR-1101, IR-1821, IR-1831, IR-1833, IR-1835, IR-8140H, IR-8140H-P, IR-8340, ISR-4221, ISR-4221X, ISR-4321, ISR-4331, ISR-4351, ISR-4431, ISR-4451-X, ISR-4461, ISR1100-4G-XE, ISR1100-4GLTEGB-XE, ISR1100-4GLTENA-XE, ISR1100-6G-XE, ISR1100X-4G-XE, ISR1100X-6G-XE	No
device_template	String	Regex: ^[^<>!&" ]{1,128}$	No
device_variables	Map		No
policy_variables	Map		No
cor_saas_variables	Class	[cor_saas_variables]	No

cor_saas_variables (sdwan.sites.routers)

Name	Type	Constraint	Mandatory	Default Value
cor_saas_device_role	Choice	dia, gateway, client	No
cor_saas_interface_list	List	String	No
cor_saas_latency	Integer	min: 1	No
cor_saas_lb_enabled	Boolean	true, false	No
cor_saas_loss	Integer	min: 0, max: 100	No
cor_saas_sig_enabled	Boolean	true, false	No
cor_saas_sig_tunnel_list	List	String	No
cor_saas_source_ip_based	Boolean	true, false	No
cor_saas_tloc_list	List	String	No
cor_saas_vpn_type	Choice	service-vpn, vpn-0	No

Examples

Example-1: The example below shows how to assign router to a single device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should not be deployed to the device. This also include association of policy group with policy variables.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type1
          configuration_group_deploy: false
          policy_group: emea_branches
          policy_group_deploy: false
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64
          policy_variables:
            target_qos_interfaces:
              - GigabitEthernet1
              - GigabitEthernet2

Example-2: The example below shows how to assign router to a dual device configuration group in SD-WAN version 20.15, assign the tag required for dual device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should be deployed to the device.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type2
          configuration_group_deploy: true
          tags:
            - primary_router
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64

Example-3: The example below shows how to assign router to a dual device configuration group in SD-WAN version 20.18 and higher, assign the topology label required for dual device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should be deployed to the device.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type2
          configuration_group_deploy: true
          topology_label: primary_router
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64

Example-4: The example below shows how to assign router to a device template and list all the variables required for template assignement.

Info: For variables under Security Policies, they are defined a bit differently with a vedgePolicy/ prefix. For example, a variable named zbfw_dip_pl_1 in security policy will be defined as vedgePolicy/zbfw_dip_pl_1

sdwan:
  sites:
    - id: 2101
      routers:
        - chassis_id: C8K-CC678D1C-8EDF-3966-4F51-ABFAB64F5ABE
          model: C8000V
          device_template: DT-C8000V-TEST
          device_variables:
            site_id: 2101
            system_ip: 10.0.2.101
            system_hostname: SITE2101-C8KV-01
            logging_server_source_interface: Loopback511
            ntp_server_source_interface: Loopback511
            global_cdp_enable: true
            global_lldp_enable: false
            global_ip_domain_lookup_enable: true
            snmp_shutdown: false
            snmp_trap_source_interface: Loopback511
            snmp_contact: contact@acme.com
            snmp_location: Location 2101
            system_location: Site2101
            system_description: Site 2101 C8KV01
            timezone: UTC
            system_latitude: 38.1
            system_longitude: -1.9
            ondemand_tunnel_enable: false
            ondemand_tunnel_idle_timeout: 10
            vpn0_layer4_ecmp_enable: true
            vpn0_tloc01_if_name: GigabitEthernet1
            vpn0_tloc01_if_description: INET-1
            vpn0_tloc01_if_shutdown: false
            vpn0_tloc01_shaping_rate: 1000000
            vedgePolicy/zbfw_dip_pl_1: 10.10.99.0/24

Example-5: The example below shows how to use the management_ip_variable field for direct-to-device (D2D) testing. This field specifies which device variable contains the management IP address for SSH connectivity. The global setting at the sdwan level applies to all devices, while a per-router setting overrides the global default.

sdwan:
  # Global management_ip_variable - applies to all devices (2nd preference)
  management_ip_variable: "vpn10_Lo10_if_ipv4_address"
  sites:
    - id: 100
      routers:
        # This router uses the global management_ip_variable
        - chassis_id: C8K-AAA11111-1111-1111-1111-111111111111
          configuration_group: branch_type1
          device_variables:
            system_ip: 10.0.0.1
            vpn10_Lo10_if_ipv4_address: 10.1.1.1/32

        # This router overrides with its own management_ip_variable (1st preference)
        - chassis_id: C8K-BBB22222-2222-2222-2222-222222222222
          configuration_group: branch_type1
          management_ip_variable: "vpn512_mgmt_ip"
          device_variables:
            system_ip: 10.0.0.2
            vpn10_Lo10_if_ipv4_address: 10.1.1.2/32
            vpn512_mgmt_ip: 192.168.1.100/24

Note: The management_ip_variable field is used by the nac-test testing framework to determine which IP address to use for SSH connections during direct-to-device (D2D) tests. The referenced variable must exist in the router’s device_variables and contain a valid IPv4 address (with or without CIDR notation).

Example-6: When using Multi-Region Fabric (MRF) with configuration groups (SD-WAN version 20.15+), the region_id field can be included in device_variables to assign the device to a specific MRF region (valid values: 0–63). Without it, deploying a configuration group will have the device in the Global Region (region 0).

sdwan:
  sites:
    - id: 100
      routers:
        - chassis_id: C8K-AAA11111-1111-1111-1111-111111111111
          configuration_group: branch_region1
          device_variables:
            region_id: 1
            system_ip: 10.0.0.1
            site_id: 100
            host_name: Edge1

The following 3 examples below show policy_variables for the three CoR-SaaS device_role values. See policy_groups/policy_group.md for the full variable catalog and conditional requirements.

Example-7: The example below shows how to provide the CoR for SaaS variables when assigning the role of client to the router.

sdwan:
  sites:
    - id: 100
      routers:
        - chassis_id: C8K-40C0CCFD-9EA8-2B2E-E73B-32C5924EC79B
          configuration_group: edge_basic
          device_variables:
            system_ip: 10.0.0.1
            host_name: BRANCH1-C8KV-01
            site_id: 100
            vpn0_gi1_inet_ip: 172.16.1.1
            vpn0_gi2_mpls_ip: 172.16.2.1
          policy_group: PG1
          cor_saas_variables:
            cor_saas_device_role: client

Example-8: The example below shows how to provide the CoR for SaaS variables when assigning the role of dia to the router, this example configures the router to not use SIG interfaces by setting the variable to false. It provides a list of TLOC list to use and enables load balancing.

sdwan:
  sites:
    - id: 100
      routers:
        - chassis_id: C8K-40C0CCFD-9EA8-2B2E-E73B-32C5924EC79B
          configuration_group: edge_basic
          device_variables:
            system_ip: 10.0.0.1
            host_name: BRANCH1-C8KV-01
            site_id: 100
            vpn0_gi1_inet_ip: 172.16.1.1
            vpn0_gi2_mpls_ip: 172.16.2.1
          policy_group: PG1
          cor_saas_variables:
            cor_saas_device_role: dia
            cor_saas_sig_enabled: false
            cor_saas_tloc_list:
              - biz-internet
              - lte
              - public-internet
            cor_saas_lb_enabled: true
            cor_saas_loss: 20
            cor_saas_latency: 60
            cor_saas_source_ip_based: true

Example-9: The example below shows how to provide the CoR for SaaS variables when assigning the role of dia to the router, this example configures the router to use all SIG interfaces in it by setting the variable to true and providing a SIG interface list.

sdwan:
  sites:
    - id: 100
      routers:
        - chassis_id: C8K-40C0CCFD-9EA8-2B2E-E73B-32C5924EC79B
          configuration_group: edge_basic
          device_variables:
            system_ip: 10.0.0.1
            host_name: BRANCH1-C8KV-01
            site_id: 100
            vpn0_gi1_inet_ip: 172.16.1.1
            vpn0_gi2_mpls_ip: 172.16.2.1
          policy_group: PG1
          cor_saas_variables:
            cor_saas_device_role: dia
            cor_saas_sig_enabled: true
            cor_saas_sig_tunnel_list:
              - all

Example-10: The example below shows how to provide the CoR for SaaS variables when assigning the role of gateway to the router, this example configures the router to act as the gateway in the service-vpn and use an interface list while disabling load balance.

sdwan:
  sites:
    - id: 100
      routers:
        - chassis_id: C8K-40C0CCFD-9EA8-2B2E-E73B-32C5924EC79B
          configuration_group: edge_basic
          device_variables:
            system_ip: 10.0.0.1
            host_name: BRANCH1-C8KV-01
            site_id: 100
            vpn0_gi1_inet_ip: 172.16.1.1
            vpn0_gi2_mpls_ip: 172.16.2.1
          policy_group: PG1
          cor_saas_variables:
            cor_saas_device_role: gateway
            cor_saas_vpn_type: service-vpn
            cor_saas_interface_list:
              - GigabitEthernet3
              - GigabitEthernet4
            cor_saas_lb_enabled: false

This includes site and device specific configuration including device variables.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
sites	List	[sites]	No

sites (sdwan)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 4294967295	Yes
routers	List	[routers]	Yes

routers (sdwan.sites)

Name	Type	Constraint	Mandatory	Default Value
chassis_id	String		Yes
management_ip_variable	String	Regex: ^[^"~`$&+,]{1,255}$	No
configuration_group	String	Regex: ^[^<>!&" ]{1,128}$	No
configuration_group_deploy	Boolean	true, false	No	true
policy_group	String	Regex: ^[^<>!&" ]{1,128}$	No
policy_group_deploy	Boolean	true, false	No	true
tags	List	String[Regex: ^[^<>!&" ]{1,128}$]	No
topology_label	String		No
model	Choice	ASR-1001-HX, ASR-1001-X, ASR-1002-HX, ASR-1002-X, ASR-1006-X, C1101-4P, C1101-4PLTEP, C1101-4PLTEPW, C1109-2PLTEGB, C1109-2PLTEUS, C1109-2PLTEVZ, C1109-4PLTE2P, C1109-4PLTE2PW, C1111-4P, C1111-4PLTEEA, C1111-4PLTELA, C1111-4PW, C1111-8P, C1111-8PLTEEA, C1111-8PLTEEAW, C1111-8PLTELA, C1111-8PLTELAW, C1111-8PW, C1111X-8P, C1112-8P, C1112-8PLTEEA, C1112-8PLTEEAWE, C1112-8PWE, C1113-8P, C1113-8PLTEEA, C1113-8PLTEEAW, C1113-8PLTELA, C1113-8PLTELAWZ, C1113-8PLTEW, C1113-8PM, C1113-8PMLTEEA, C1113-8PMWE, C1113-8PW, C1116-4P, C1116-4PLTEEA, C1116-4PLTEEAWE, C1116-4PWE, C1117-4P, C1117-4PLTEEA, C1117-4PLTEEAW, C1117-4PLTELA, C1117-4PLTELAWZ, C1117-4PM, C1117-4PMLTEEA, C1117-4PMLTEEAWE, C1117-4PMWE, C1117-4PW, C1118-8P, C1121-4P, C1121-4PLTEP, C1121-8P, C1121-8PLTEP, C1121-8PLTEPW, C1121X-8P, C1121X-8PLTEP, C1121X-8PLTEPW, C1126-8PLTEP, C1126X-8PLTEP, C1127-8PLTEP, C1127-8PMLTEP, C1127X-8PLTEP, C1127X-8PMLTEP, C1128-8PLTEP, C1131-8PLTEPW, C1131-8PW, C1131X-8PLTEPW, C1131X-8PW, C1161-8P, C1161-8PLTEP, C1161X-8P, C1161X-8PLTEP, C8000V, C8200-1N-4T, C8200L-1N-4T, C8300-1N1S-4T2X, C8300-1N1S-6T, C8300-2N2S-4T2X, C8300-2N2S-6T, C8500-12X, C8500-12X4QC, C8500-20X6C, C8500L-8S4X, IR-1101, IR-1821, IR-1831, IR-1833, IR-1835, IR-8140H, IR-8140H-P, IR-8340, ISR-4221, ISR-4221X, ISR-4321, ISR-4331, ISR-4351, ISR-4431, ISR-4451-X, ISR-4461, ISR1100-4G-XE, ISR1100-4GLTEGB-XE, ISR1100-4GLTENA-XE, ISR1100-6G-XE, ISR1100X-4G-XE, ISR1100X-6G-XE	No
device_template	String	Regex: ^[^<>!&" ]{1,128}$	No
device_variables	Map		No
policy_variables	Map		No

Examples

Example-1: The example below shows how to assign router to a single device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should not be deployed to the device. This also include association of policy group with policy variables.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type1
          configuration_group_deploy: false
          policy_group: emea_branches
          policy_group_deploy: false
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64
          policy_variables:
            target_qos_interfaces:
              - GigabitEthernet1
              - GigabitEthernet2

Example-2: The example below shows how to assign router to a dual device configuration group in SD-WAN version 20.15, assign the tag required for dual device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should be deployed to the device.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type2
          configuration_group_deploy: true
          tags:
            - primary_router
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64

Example-3: The example below shows how to assign router to a dual device configuration group in SD-WAN version 20.18 and higher, assign the topology label required for dual device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should be deployed to the device.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type2
          configuration_group_deploy: true
          topology_label: primary_router
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64

Example-4: The example below shows how to assign router to a device template and list all the variables required for template assignement.

!!! info For variables under Security Policies, they are defined a bit differently with a vedgePolicy/ prefix. For example, a variable named zbfw_dip_pl_1 in security policy will be defined as vedgePolicy/zbfw_dip_pl_1

sdwan:
  sites:
    - id: 2101
      routers:
        - chassis_id: C8K-CC678D1C-8EDF-3966-4F51-ABFAB64F5ABE
          model: C8000V
          device_template: DT-C8000V-TEST
          device_variables:
            site_id: 2101
            system_ip: 10.0.2.101
            system_hostname: SITE2101-C8KV-01
            logging_server_source_interface: Loopback511
            ntp_server_source_interface: Loopback511
            global_cdp_enable: true
            global_lldp_enable: false
            global_ip_domain_lookup_enable: true
            snmp_shutdown: false
            snmp_trap_source_interface: Loopback511
            snmp_contact: contact@acme.com
            snmp_location: Location 2101
            system_location: Site2101
            system_description: Site 2101 C8KV01
            timezone: UTC
            system_latitude: 38.1
            system_longitude: -1.9
            ondemand_tunnel_enable: false
            ondemand_tunnel_idle_timeout: 10
            vpn0_layer4_ecmp_enable: true
            vpn0_tloc01_if_name: GigabitEthernet1
            vpn0_tloc01_if_description: INET-1
            vpn0_tloc01_if_shutdown: false
            vpn0_tloc01_shaping_rate: 1000000
            vedgePolicy/zbfw_dip_pl_1: 10.10.99.0/24

Example-5: The example below shows how to use the management_ip_variable field for direct-to-device (D2D) testing. This field specifies which device variable contains the management IP address for SSH connectivity. The global setting at the sdwan level applies to all devices, while a per-router setting overrides the global default.

sdwan:
  # Global management_ip_variable - applies to all devices (2nd preference)
  management_ip_variable: "vpn10_Lo10_if_ipv4_address"
  sites:
    - id: 100
      routers:
        # This router uses the global management_ip_variable
        - chassis_id: C8K-AAA11111-1111-1111-1111-111111111111
          configuration_group: branch_type1
          device_variables:
            system_ip: 10.0.0.1
            vpn10_Lo10_if_ipv4_address: 10.1.1.1/32

        # This router overrides with its own management_ip_variable (1st preference)
        - chassis_id: C8K-BBB22222-2222-2222-2222-222222222222
          configuration_group: branch_type1
          management_ip_variable: "vpn512_mgmt_ip"
          device_variables:
            system_ip: 10.0.0.2
            vpn10_Lo10_if_ipv4_address: 10.1.1.2/32
            vpn512_mgmt_ip: 192.168.1.100/24

!!! note The management_ip_variable field is used by the nac-test testing framework to determine which IP address to use for SSH connections during direct-to-device (D2D) tests. The referenced variable must exist in the router’s device_variables and contain a valid IPv4 address (with or without CIDR notation).

This includes site and device specific configuration including device variables.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
sites	List	[sites]	No

sites (sdwan)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 4294967295	Yes
routers	List	[routers]	Yes

routers (sdwan.sites)

Name	Type	Constraint	Mandatory	Default Value
chassis_id	String		Yes
configuration_group	String	Regex: ^[^<>!&" ]{1,128}$	No
configuration_group_deploy	Boolean	true, false	No	true
policy_group	String	Regex: ^[^<>!&" ]{1,128}$	No
policy_group_deploy	Boolean	true, false	No	true
tags	List	String[Regex: ^[^<>!&" ]{1,128}$]	No
model	Choice	ASR-1001-HX, ASR-1001-X, ASR-1002-HX, ASR-1002-X, ASR-1006-X, C1101-4P, C1101-4PLTEP, C1101-4PLTEPW, C1109-2PLTEGB, C1109-2PLTEUS, C1109-2PLTEVZ, C1109-4PLTE2P, C1109-4PLTE2PW, C1111-4P, C1111-4PLTEEA, C1111-4PLTELA, C1111-4PW, C1111-8P, C1111-8PLTEEA, C1111-8PLTEEAW, C1111-8PLTELA, C1111-8PLTELAW, C1111-8PW, C1111X-8P, C1112-8P, C1112-8PLTEEA, C1112-8PLTEEAWE, C1112-8PWE, C1113-8P, C1113-8PLTEEA, C1113-8PLTEEAW, C1113-8PLTELA, C1113-8PLTELAWZ, C1113-8PLTEW, C1113-8PM, C1113-8PMLTEEA, C1113-8PMWE, C1113-8PW, C1116-4P, C1116-4PLTEEA, C1116-4PLTEEAWE, C1116-4PWE, C1117-4P, C1117-4PLTEEA, C1117-4PLTEEAW, C1117-4PLTELA, C1117-4PLTELAWZ, C1117-4PM, C1117-4PMLTEEA, C1117-4PMLTEEAWE, C1117-4PMWE, C1117-4PW, C1118-8P, C1121-4P, C1121-4PLTEP, C1121-8P, C1121-8PLTEP, C1121-8PLTEPW, C1121X-8P, C1121X-8PLTEP, C1121X-8PLTEPW, C1126-8PLTEP, C1126X-8PLTEP, C1127-8PLTEP, C1127-8PMLTEP, C1127X-8PLTEP, C1127X-8PMLTEP, C1128-8PLTEP, C1131-8PLTEPW, C1131-8PW, C1131X-8PLTEPW, C1131X-8PW, C1161-8P, C1161-8PLTEP, C1161X-8P, C1161X-8PLTEP, C8000V, C8200-1N-4T, C8200L-1N-4T, C8300-1N1S-4T2X, C8300-1N1S-6T, C8300-2N2S-4T2X, C8300-2N2S-6T, C8500-12X, C8500-12X4QC, C8500-20X6C, C8500L-8S4X, IR-1101, IR-1821, IR-1831, IR-1833, IR-1835, IR-8140H, IR-8140H-P, IR-8340, ISR-4221, ISR-4221X, ISR-4321, ISR-4331, ISR-4351, ISR-4431, ISR-4451-X, ISR-4461, ISR1100-4G-XE, ISR1100-4GLTEGB-XE, ISR1100-4GLTENA-XE, ISR1100-6G-XE, ISR1100X-4G-XE, ISR1100X-6G-XE	No
device_template	String	Regex: ^[^<>!&" ]{1,128}$	No
device_variables	Map		No
policy_variables	Map		No

Examples

Example-1: The example below shows how to assign router to a single device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should not be deployed to the device. This also include association of policy group with policy variables.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type1
          configuration_group_deploy: false
          policy_group: emea_branches
          policy_group_deploy: false
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64
          policy_variables:
            target_qos_interfaces:
              - GigabitEthernet1
              - GigabitEthernet2

Example-2: The example below shows how to assign router to a dual device configuration group, assign the tag required for dual device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should be deployed to the device.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type2
          configuration_group_deploy: true
          tags:
            - primary_router
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64

Example-3: The example below shows how to assign router to a device template and list all the variables required for template assignement.

!!! info For variables under Security Policies, they are defined a bit differently with a vedgePolicy/ prefix. For example, a variable named zbfw_dip_pl_1 in security policy will be defined as vedgePolicy/zbfw_dip_pl_1

sdwan:
  sites:
    - id: 2101
      routers:
        - chassis_id: C8K-CC678D1C-8EDF-3966-4F51-ABFAB64F5ABE
          model: C8000V
          device_template: DT-C8000V-TEST
          device_variables:
            site_id: 2101
            system_ip: 10.0.2.101
            system_hostname: SITE2101-C8KV-01
            logging_server_source_interface: Loopback511
            ntp_server_source_interface: Loopback511
            global_cdp_enable: true
            global_lldp_enable: false
            global_ip_domain_lookup_enable: true
            snmp_shutdown: false
            snmp_trap_source_interface: Loopback511
            snmp_contact: contact@acme.com
            snmp_location: Location 2101
            system_location: Site2101
            system_description: Site 2101 C8KV01
            timezone: UTC
            system_latitude: 38.1
            system_longitude: -1.9
            ondemand_tunnel_enable: false
            ondemand_tunnel_idle_timeout: 10
            vpn0_layer4_ecmp_enable: true
            vpn0_tloc01_if_name: GigabitEthernet1
            vpn0_tloc01_if_description: INET-1
            vpn0_tloc01_if_shutdown: false
            vpn0_tloc01_shaping_rate: 1000000
            vedgePolicy/zbfw_dip_pl_1: 10.10.99.0/24

This includes site and device specific configuration including device variables.

Diagram

Classes

sdwan

Name	Type	Constraint	Mandatory	Default Value
sites	List	[sites]	No

sites (sdwan)

Name	Type	Constraint	Mandatory	Default Value
id	Integer	min: 1, max: 4294967295	Yes
routers	List	[routers]	Yes

routers (sdwan.sites)

Name	Type	Constraint	Mandatory	Default Value
chassis_id	String		Yes
configuration_group	String	Regex: ^[^<>!&" ]{1,128}$	No
configuration_group_deploy	Boolean	true, false	No	true
tags	List	String[Regex: ^[^<>!&" ]{1,128}$]	No
model	Choice	ASR-1001-HX, ASR-1001-X, ASR-1002-HX, ASR-1002-X, ASR-1006-X, C1101-4P, C1101-4PLTEP, C1101-4PLTEPW, C1109-2PLTEGB, C1109-2PLTEUS, C1109-2PLTEVZ, C1109-4PLTE2P, C1109-4PLTE2PW, C1111-4P, C1111-4PLTEEA, C1111-4PLTELA, C1111-4PW, C1111-8P, C1111-8PLTEEA, C1111-8PLTEEAW, C1111-8PLTELA, C1111-8PLTELAW, C1111-8PW, C1111X-8P, C1112-8P, C1112-8PLTEEA, C1112-8PLTEEAWE, C1112-8PWE, C1113-8P, C1113-8PLTEEA, C1113-8PLTEEAW, C1113-8PLTELA, C1113-8PLTELAWZ, C1113-8PLTEW, C1113-8PM, C1113-8PMLTEEA, C1113-8PMWE, C1113-8PW, C1116-4P, C1116-4PLTEEA, C1116-4PLTEEAWE, C1116-4PWE, C1117-4P, C1117-4PLTEEA, C1117-4PLTEEAW, C1117-4PLTELA, C1117-4PLTELAWZ, C1117-4PM, C1117-4PMLTEEA, C1117-4PMLTEEAWE, C1117-4PMWE, C1117-4PW, C1118-8P, C1121-4P, C1121-4PLTEP, C1121-8P, C1121-8PLTEP, C1121-8PLTEPW, C1121X-8P, C1121X-8PLTEP, C1121X-8PLTEPW, C1126-8PLTEP, C1126X-8PLTEP, C1127-8PLTEP, C1127-8PMLTEP, C1127X-8PLTEP, C1127X-8PMLTEP, C1128-8PLTEP, C1131-8PLTEPW, C1131-8PW, C1131X-8PLTEPW, C1131X-8PW, C1161-8P, C1161-8PLTEP, C1161X-8P, C1161X-8PLTEP, C8000V, C8200-1N-4T, C8200L-1N-4T, C8300-1N1S-4T2X, C8300-1N1S-6T, C8300-2N2S-4T2X, C8300-2N2S-6T, C8500-12X, C8500-12X4QC, C8500-20X6C, C8500L-8S4X, IR-1101, IR-1821, IR-1831, IR-1833, IR-1835, IR-8140H, IR-8140H-P, IR-8340, ISR-4221, ISR-4221X, ISR-4321, ISR-4331, ISR-4351, ISR-4431, ISR-4451-X, ISR-4461, ISR1100-4G-XE, ISR1100-4GLTEGB-XE, ISR1100-4GLTENA-XE, ISR1100-6G-XE, ISR1100X-4G-XE, ISR1100X-6G-XE	No
device_template	String	Regex: ^[^<>!&" ]{1,128}$	No
device_variables	Map		No

Examples

Example-1: The example below shows how to assign router to a single device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should not be deployed to the device.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type1
          configuration_group_deploy: false
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64

Example-2: The example below shows how to assign router to a dual device configuration group, assign the tag required for dual device configuration group, list variables for device-specific fields in features under this configuration group and specify configuration should be deployed to the device.

sdwan:
  sites:
    - id: 1
      routers:
        - chassis_id: C8K-3D1A8960-6E76-532C-DA93-50626FC5797E
          configuration_group: branch_type2
          configuration_group_deploy: true
          tags:
            - primary_router
          device_variables:
            system_ip: 10.0.0.1
            site_id: 1
            host_name: Edge1
            pseudo_commit_timer: 300
            vpn0_inet_ip: 172.16.1.1
            vpn0_inet_mask: 255.255.255.0
            vpn0_inet_sec1_ip: 172.16.1.191
            vpn0_inet_sec1_mask: 255.255.255.0
            vpn0_inet_ipv6: 2001:db8::1/64
            vpn0_ipv6_sec1_ip: 2001:db8:1::1/64
            motd_banner: this is motd banner
            device_access_destination_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            device_access_source_prefixes:
              - 10.0.0.0/8
              - 172.16.0.0/12
            vpn512_mgmt_int_ip: 192.168.254.1
            vpn512_mgmt_int_mask: 255.255.255.0
            vpn512_mgmt_int_ipv6: fd02::1/64

Example-3: The example below shows how to assign router to a device template and list all the variables required for template assignement.

sdwan:
  sites:
    - id: 2101
      routers:
        - chassis_id: C8K-CC678D1C-8EDF-3966-4F51-ABFAB64F5ABE
          model: C8000V
          device_template: DT-C8000V-TEST
          device_variables:
            site_id: 2101
            system_ip: 10.0.2.101
            system_hostname: SITE2101-C8KV-01
            logging_server_source_interface: Loopback511
            ntp_server_source_interface: Loopback511
            global_cdp_enable: true
            global_lldp_enable: false
            global_ip_domain_lookup_enable: true
            snmp_shutdown: false
            snmp_trap_source_interface: Loopback511
            snmp_contact: contact@acme.com
            snmp_location: Location 2101
            system_location: Site2101
            system_description: Site 2101 C8KV01
            timezone: UTC
            system_latitude: 38.1
            system_longitude: -1.9
            ondemand_tunnel_enable: false
            ondemand_tunnel_idle_timeout: 10
            vpn0_layer4_ecmp_enable: true
            vpn0_tloc01_if_name: GigabitEthernet1
            vpn0_tloc01_if_description: INET-1
            vpn0_tloc01_if_shutdown: false
            vpn0_tloc01_shaping_rate: 1000000