Cisco 4D Secure SD-WAN (Viptela) v3.3 - Instant Demo

Instant Demo Guide
Cisco dCloud
Cisco 4D Secure SD-WAN (Viptela)

v3.3 - Instant Demo
Last Updated: 18-February-2020
About This Instant Demo

This guide for the preconfigured demonstration includes:
About This Instant Demo
Requirements
About This Solution
Topology
Get Started
Scenario 1. vManage Dashboard
Scenario 2. Topology Creation, Traffic Data, Application Aware Routing, and Monitoring Visibility
Scenario 3. SD-WAN Security Overview
Scenario 4. vAnalytics
What’s Next?
© 2019 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. Page 1 of 48
Instant Demo Guide
Cisco dCloud
Requirements
The table below outlines the requirements for this preconfigured demonstration.
Required Optional
Laptop Cisco AnyConnect®
Instant Demo Guide
Cisco dCloud
About This Solution

Cisco SD-WAN delivers an uncompromised user experience over any kind of transport, allowing the business
to right size their network with operational simplicity while lowering costs. Now, IT can fully utilize their WAN
investments with the highest performance, reliability, and security while ensuring that all next generation WAN
capability requirements necessary to avoid unexpected expenses, unplanned downtime and unforeseen
complications are accounted for.
Instant Demo Guide
Cisco dCloud
Topology
This content includes preconfigured users and components to illustrate the scripted scenarios and features of
the solution. Most components are fully configurable with predefined administrative user accounts. You can see
the IP address and user account credentials to use to access a component by clicking the component icon in
the Topology menu of your active session and in the scenario steps that require their use.
Physical Topology
Instant Demo Guide
Cisco dCloud
Get Started
Follow the steps to schedule a session of the content and configure your presentation environment.
1. Click Catalog and select Instant Demo from the side bar. This lists all the dCloud Instant Demos.
2. Click the appropriate View button.
NOTE: Alternately, you can use the Search Catalog box to search for the Instant Demo name.
Instant Demo Guide
Cisco dCloud
3. Login with username/password as amdemo1 / C1sco12345 and click Log In.
Instant Demo Guide
Cisco dCloud
Scenario 1. vManage Dashboard

Value Proposition: The dashboard provides aggregated visibility into the environment.
Steps
1. The vManage Dashboard displays aggregated visibility into the environment.
Instant Demo Guide
Cisco dCloud
2. Point out that the dashboard contains vital information, such as the overall health statistics for Site Health
and vEdge Health.
Instant Demo Guide
Cisco dCloud
3. From the menu, select Configuration > Policies.
Instant Demo Guide
Cisco dCloud
4. In the upper right corner, select Custom Options >Centralized Policy > Lists.
5. From the left panel, click Data Prefix.
NOTE: This displays the routing prefixes to change the topology within the routing construct.
6. From the left panel, click Site.
NOTE: This allows you to specify groupings within the environment based on role, region, or other
characteristics to distinguish site types.
Instant Demo Guide
Cisco dCloud
7. From the left panel, click SLA Class.
NOTE: This allows you to define classifications at the SLA level to satisfy the required loss and latency
characteristics for applications or types of applications.
NOTE: This allows you to define the different segments you will carry inside your network, separating them by
purpose, for example, public vpn vs corporate vpn.
Value Proposition: Within each vpn construct, you can apply specific policies, leveraging the criteria assigned,
for instance, which route is advertised within each VPN, or what to do with the different transports or
application on a segment-by-segment basis.
8. From the left panel, click VPN.
Instant Demo Guide
Cisco dCloud
NOTE: Once all the objects are defined, you can view and deliver a complete application.
9. From the left panel, click Application.
Instant Demo Guide
Cisco dCloud
Scenario 2. Topology Creation, Traffic Data, Application Aware Routing, and

Monitoring Visibility
Value Proposition: The topology helps you define how you control your environment. Can you use a generic
Hub and Spoke? Do you need customized setting and mesh type connectivity? Whatever the needs, you
can set them using the topology. One single stop helps define everything. For Hub and Spoke, the wizard is
fairly straight-forward, since we’ve taken the time to identify and define all the hub sites.
If the requirements are more complex, for instance for creating a globally distributed network or multiple
data centers in multiple geographies, and the branch site in the US must transit through a branch site in
Singapore and one in Hong Kong.
This will require you to define much more granularly what data to manipulate.
You can select which routes or transports are used to engineer a transport from end to end, across
multiple regions, and have full traffic engineering capabilities.
SD-WAN allows very powerful control over any type of topology.
Steps
1. In the upper right corner, select Custom Options > Topology.
Instant Demo Guide
Cisco dCloud
2. From the existing policies, click the three dots to the right of Hub-n-SpokeALLVPN.
3. Click View.
4. Click Cancel.
Value Proposition: Now that the topology is defined, you can define what happens to each application inside
each VPN.
In a centralized fashion, you can define rules for different types of applications.
5. In the upper right corner, select Custom Options > Traffic Policy.
6. Application Aware Routing is displayed.
Instant Demo Guide
Cisco dCloud
7. Click the three dots to the right of one of the AppRoutePolicy and click View to get details.
Value Proposition: You can apply unique SLAs for several types of traffic. You can also specify which transport
you prefer to offload traffic from a priority to a non-prioritized circuit to preserve bandwidth.
8. Click back on your browser and click Traffic Data.
Instant Demo Guide
Cisco dCloud
9. Click the three dots to the right of one of the traffic data policies and click View to get details.
NOTE: Once you define how the applications are treated, you can use the activation mechanism to propagate
the policy across the network.
Value Proposition: This one page provides the ability to define the entire business objects, your network
topology, to control the application traffic, and apply it across the network. This eliminates the need for
configuration on any remote endpoints, either physical or virtual, other than IP addressing. All routing or traffic
applications are centrally-defined across the network.
10. Click Cancel.
Instant Demo Guide
Cisco dCloud
vManage Capabilities
Value Proposition: Now, we need assurance and visibility into what is happening in our environment, and to be
able to get alerts from the environment and trigger improvements.
vManage also has monitoring capabilities, with visibility into any device that is operational, including a direct
tunnel path to every device and visibility into the performance, characteristics, and traffic that passes through
the device.
vManage gives you visibility into device health, like CTU memory consumption. You can also see the
applications traveling through the environment and flow traffic.
1. From the menu, select Monitor > Network.

2. Click BR2-VEDGE1.
Instant Demo Guide
Cisco dCloud
NOTE: The traffic generator shows the periodic spikes of traffic, allowing us to see not only the traffic
generated, but also the source and destination.
3. Click on Interface.
NOTE: This shows visibility in terms of overall utilization of the different transports and tunnels, and the overall
consumption among them.
NOTE: The aggregated visualization gives visibility into the transport in question, that is, what are the aggregate
characteristics of those transports with regards to loss, latency, and jitter.
Instant Demo Guide
Cisco dCloud
4. Click TLOC.
Value Proposition: You can get a further breakdown into the IPSEC tunnels constructed over the transports to
any number of end points.
This also supplies metrics for loss, latency and jitter on a tunnel by tunnel basis.
When we talk about a meshed environment, we have very detailed information about all the different IPSEC
tunnels that get constructed in a meshed environment.
Instant Demo Guide
Cisco dCloud
5. Click Tunnel.
Value Proposition: We have visibility into all the different control peers established from an any-
edged component.
The number of controlled adjacencies is less than the actual number of IP Sec tunnels because we don’t
build an adjacency with every other end point. The control plane runs through the edge component and the
vSmart controller appliance.
vManage allows you to centrally display all the different connections built across the environment.
6. From the menu, click Control Connections.
Instant Demo Guide
Cisco dCloud
Value Proposition: We also have full visibility into every real time event.
vManage is an event recipient for everything that happens over the network. Changes to tunnels or the quality
of tunnels are recorded, as are events where the traffic is redirected to improve the quality of the flow.
7. From the menu, click Events.
Instant Demo Guide
Cisco dCloud
8. Click the three dots next to an Event Time and select Device Details.
9. Click Close.
Value Proposition: vManage, from an assurance perspective, provides capability to troubleshoot the
environment it is managing.
It gives you the ability to see what is preventing a device from becoming operational, or diagnosing traffic
problems on devices that are operational.
10. From the menu, click Troubleshooting.
NOTE: Troubleshooting allows you to visualize what is occurring for different types of traffic at certain locations.
NOTE: This allows you to get historical data for particular time stamps for the traffic, and the different criteria
and transport for the application.
11. Click App Route Visualization.
Instant Demo Guide
Cisco dCloud
NOTE: To troubleshoot even further, you can simulate particular types of flows in real time, by device or BTN
segment.
12. Under Remote Device, select BR1-CEDGE1 | 10.3.0.1, click DPI, under Application, select 3pc, and click
Go.
Instant Demo Guide
Cisco dCloud
Scenario 3. SD-WAN Security Overview

Value Proposition: In this scenario, the remote offices all utilize a Guest Internet VPN which allows
customers to browse the internet via Direct Internet Access. SD-WAN Security policy has been activated on
this guest VPN to protect them. Cisco SD-WAN Security can provide protection against known and unknown
malware threats with AMP and Threat Grid.
Challenge:
• Backhauled internet-bound traffic on a corporate firewall is a complex problem which requires

more appliances.
Benefits that Reduce Cost and Complexity:
• Activation of SD-WAN Security policy from central vManage results in simpler operations, reduced
cost, and reduction in time and effort.
• Insert a wide range of security offerings at remote locations without needing more appliances.
Objective:
• Leverage defense-in-depth security offerings in a combined platform so customers can decide

what posture to adopt in distinct locations across the WAN saving on rack space.
REMINDER: It may take 15 minutes after the demo has fully launched to start seeing dashboard activity for the
SD-WAN Security dashboard, please plan accordingly. If after 20 minutes, the dashboard hasn’t populated (this
is a known issue that will be fixed in the next release), please start a new session.
Steps
1. Click on the Dashboard button and then Security to view the SD-WAN Security dashboard.
Instant Demo Guide
Cisco dCloud
2. Click the small down arrow in the first widget and adjust time frame to 1 hour and click Search.
3. Click Configuration > Templates.
4. To the right of BranchType1Template-CSR click the three dots (…) and select View.
Instant Demo Guide
Cisco dCloud
5. After the page loads, click Additional Templates which will go to the bottom, where Security Policy is
listed.
NOTE: Notice the Security Policy and the Container Profile. The Container runs the snort IPS engine.
6. Click Cancel.
SD-WAN Security Policies
1. Click Configuration > Security.
Instant Demo Guide
Cisco dCloud
Value Proposition: Explore the preconfigured SD-WAN Security policy. Each security offering needs its own
policy. Explore each one now.
2. To the right of Branch-DIA-Security policy, click the three dots (…) and View.
3. Click Firewall on the top.

4. To the right of BRANCH-DIA-GUEST click three dots (…) and View to see the firewall rules in effect.
NOTE: Due to a visual bug in vManage, the implicit deny rule (called Drop) shows above the other rules. It will
NOT take effect before the configured rules.
NOTE: Notice that this firewall is zone-based and is configured to inspect traffic from the Guest VPN to the
Outside.
NOTE: The rules are allowing traffic from the branch subnets and the traffic is being inspected.
5. Click Cancel to go back to the SD-WAN Security Policy.
Instant Demo Guide
Cisco dCloud
6. Click Intrusion Prevention to see how the IPS rules are set up.
7. Click on the three dots (…) to the right of the Branch-DIA-IPS policy and click View.
Value Proposition: Notice that there is only 1 VPN targeted, which is the Guest VPN. We can select a security
posture as well as detect or protect against attacks. The SD-WAN IPS is based on Snort which uses Cisco
Talos signatures, and while not as granular as the full Firepower offering should meet 99% of remote office
needs.
8. Click on Advanced
NOTE: Notice that we can create a signature whitelist if certain applications are triggering the IPS but should be
allowed (common with some corporate home-grown applications).
9. Click Cancel.
Instant Demo Guide
Cisco dCloud
10. Click on URL Filtering at the top.

11. Click the three dots (…) next to the URL Filtering policy and select View.
NOTE: The URL Filtering policy is functionally like the expanded Cisco Web Security Appliance (WSA) offering.
Though not as granular as the full WSA appliance, the URL Filtering offering in SD-WAN Security allows you to
customize category/reputation, specify a block page (or redirect per something like ISE), as well as to
customize a whitelist/blacklist.
12. Click Cancel.
Instant Demo Guide
Cisco dCloud
Value Proposition: AMP (Advanced Malware Protection) provides cloud-based file reputation checking, while
Threat Grid's behavior-based deep file analysis can help detect and stop zero-day and polymorphic malware
threats.
13. Click Advanced Malware Protection.

14. Click the three dots (…) next to the AMP_BRANCH_DIA_POLICYv1 and select View.
15. Click Cancel.
Instant Demo Guide
Cisco dCloud
Value Proposition: Umbrella DNS based protection offers the first line of defense. Umbrella processes billions
of DNS request per day and can predict, identify and block the latest malicious destinations on the Internet.
With this protection and SD-WAN, Umbrella helps prevent and contain any malicious activity on an SD-WAN
enabled network.
16. Click DNS Security.

17. Click the three dots (…) next to the UMBRELLA_GUESTWIFIv1 policy and select View.
18. Click Cancel.
Instant Demo Guide
Cisco dCloud
19. Click Policy Summary.
NOTE: You have the option to set an external logging server here as well as determine if the device will fail to
open (allow all traffic) or closed (allow no traffic) if there is a failure of the SD-WAN Security application. You
can also set a TCP SYN flood limit to protect against that type of attack.
20. Click Cancel.
Instant Demo Guide
Cisco dCloud
Scenario 4. vAnalytics
Value Proposition: Use the Applications & Network screen to monitor application families and individual
applications in your overlay network over time.
Challenge:
As Enterprises deploy workloads in the Cloud, WAN becomes critical to their day-to-day business operations.
IT Admins however get limited visibility and control over this hybrid infrastructure. This makes troubleshooting
of the network and application issues extremely difficult and time-consuming (more downtime & higher
operational cost).
Benefits:
Data Transfer and Storage

• Client authenticated and data securely transmitted from vManage to vAnalytics.
• Data storage isolation between customers.
• No PII (Personal Identifiable Information) is collected.
Objectives:
Data Correlation and Algorithms

• Only management data (stats, flows) information collected.
• All algorithms visualization done on a per-customer basis.
• IP Addresses collected for provider look-ups.
• Peer benchmarking (future use cases) only on a group basis. No individual customer data used.
Where is vAnalytics deployed?
• vAnalytics is a SaaS-based offering deployed inside a popular public cloud provider’s US West region.
• For how long can I see data in vAnalytics?
• vAnalytics shows data for approximately one year.
Preferred Browser: Incognito Window in Google Chrome. It may take 20 – 30 seconds to fully load data.
Instant Demo Guide
Cisco dCloud
Steps
1. From vManage go to the main menu displayed and click Launch vAnalytics. You will be taken to another
tab where the main dashboard is displayed.
LIMITATIONS: If after being launched you are prompted to the Viptela Customer Support Portal, consider
closing\cleaning all your browser cache and then retry again. If you close your vManage dashboard, you will
most likely continue having this message.
Instant Demo Guide
Cisco dCloud
LIMITATIONS: If you are using Firefox, accept any potential security risk ahead for the mentioned browser and
click on advance, and then accept risk and continue. If so, accept any pop-up blocker under options in order to
allow access to the dashboard. It may take up to 2 minutes to fully load data:
• Main dashboard: You can find the top menu on the left icon (three horizontal lines) for expanding and
collapsing the vAnalytics menu (Network &Applications setup menu), and the vAnalytics product name.
On the right are a number of icons and the user profile drop-down.
Instant Demo Guide
Cisco dCloud
2. Under the title bar, let’s click this time over Applications. Once we are into the Applications menu we can
set\filter a Time Period in order to have some data displayed. Click for a predefined or custom time period,
e.g. last 12h:
NOTE: This graphic displays bandwidth utilization for application families by Summary.
3. By Summary displays a summary by application family. For example hover your mouse and click over
Network Service Application Family to display applications in that family.
Instant Demo Guide
Cisco dCloud
IMPORTANT NOTE: You can expand or compress the grayed out arrows under the description of the main
graphic in order to further check the statistics.
4. When you click the Network Service Application Family bar you can see that application's bandwidth
utilization over time. Now, click a point on the timeline to see that application's bandwidth utilization by site.
5. Hover your mouse and click over tcp. The protocol chosen provides you a view where TCP bandwidth util
over time as shown:
Instant Demo Guide
Cisco dCloud
Bandwidth by Time
1. In the top right click time. By Time displays a timeline of application family bandwidth utilization.
NOTE: The utilization by application highlighted on your screen may not be exactly like the screen shot shown in
the guide.
2. Click an application family to display utilization for the applications in that family. Let’s try this time by
clicking Audio/Video in the right side. The circle will change to grayed out; hence, the represented
bandwidth that we just deselected is in fact removed from the graph.
Instant Demo Guide
Cisco dCloud
3. Go back and deselect Audio/Video, hover your mouse over the Audio/Video circle, and then click the
application stated in order to view a breakdown of the bandwidth per application for that field in time.
4. Click rtp site bar in order to outline the collection of sites that generated the traffic.
NOTE: The utilization by site highlighted on your screen may not be exactly like the screen shot shown in the
guide.
Instant Demo Guide
Cisco dCloud
Bandwidth by Site
1. In the top right click Sites. Sites has broken down the utilization by TLOC, site and device:
2. Click on one of the vEdges in order to view a breakdown of the bandwidth per application for that device in
time, for example BR3-CEDGE1.
NOTE: Please be patient, vEdges device might take around 1 minute to load. . .
Instant Demo Guide
Cisco dCloud
Value proposition: You can also check or uncheck the offerings in the right side and continue to showcase its
applications by site. For example “web” which you can display flows for that application site. Just by hovering
your mouse and clicking on the circle as follows:
Application Performance
Value Proposition: Quality of User Experience per Application: Displays Viptela Quality of Experience (vQoE)
values for application families. Measure Quality of end-user Experience (QoE) with various applications.
QoE score is computed by taking into account latency, loss & jitter characteristics of underlying data tunnels.
vQoE score calculates the value based on latency, loss, and jitter for every application.
1. If it’s not selected, click vQoE in the right corner.
Instant Demo Guide
Cisco dCloud
Application Family Performance
Latency, Loss, Jitter understand health of your SD-WAN fabric – Visibility and performance of various data
tunnels.
1. Click Latency and you will see the Average Latency under the specific Application Family.
2. Click Loss and you will see the Average Loss under the specific Application Family.
3. Click Jitter and you will see the Average Jitter under the specific Application Family.
NOTE: Be patient, performance data may take a while to load. . .
Instant Demo Guide
Cisco dCloud
Anomaly
While performing this demo, we don’t showcase real environment reference points within the anomaly graphs,
only the data that is determined to represent the anomaly.
In summary, all the sites that consume an amount of bandwidth for the given application in the chosen time
period that exceeds the average are tagged as anomalies and provides a vehicle for singling out sites that may
be heavy users or in case there’s indeed some exceptional behavior that should be noticed for the viewed
period itself.
Network Availability
Value Proposition: Use the Network Availability screen to monitor downtime of nodes and circuits in
your overlay network over time.
1. In the top title bar, click the Network tab.
IMPORTANT NOTE: If no downtime is found please refresh your browser or swap from your predefined time
period of Past Day to Past Week.
NOTE: You can display as many details as you need depending on the circuit being analyzed. Some important
elements can be filtered; within those fields we can filter the Total Circuit Downtime by Site and we can also
check the Downtime Occurrences by Device.
Instant Demo Guide
Cisco dCloud
2. Scroll down over Circuits and click on BR2-VEDGE1:Ite device. Once displayed check in the right column
the downtime occurrences and hover your mouse over the light blue circle for the specific device. From
there you can see the status of the device in this case from the past day:
NOTE: The utilization by application and the device highlighted on your screen may not be exactly like the
screen shot shown in the guide.
Network Health
Value Proposition: Use the Network Health screen to monitor the performance of circuits, tunnels, and carriers
in your overlay network over time.
1. In the top left click Health.
NOTE: Please be patient, performance data might take a while to load. . .
This time we will display Application Performance by Carrier on a geographical map of the overlay network:
Instant Demo Guide
Cisco dCloud
2. Click Carrier. Circles on the map represent each carrier. The legend to the right indicates the color of each
carrier. Note that you can also display latency, loss, and jitter under Network Health.
3. Hover over a carrier's circle to display a hover box with details for that location. Then click a circle on the
map to display that location's performance by loss, latency, or jitter:
4. Click a carrier to see performance for each vEdge router at that site.
Instant Demo Guide
Cisco dCloud
5. Hover your mouse over a vEdge router to see that device's performance over time.
6. Hover over the map to display map functions:

• Click Search to search for a geographical location by name.
• Click the + (plus) or - (minus) zoom icons to zoom in or out.
7. In the top right under the Network Health Statistics section, click Tunnel.
Instant Demo Guide
Cisco dCloud
IMPORTANT NOTE: You can highlight any carrier, color, or vEdge device in order to further analyze its average
in terms of Latency, Loss and Jitter.
Instant Demo Guide
Cisco dCloud
What’s Next?
• Check out the related information on Demo Zone.
• Talk about it on the dCloud Community.

Cisco 4D Secure SD-WAN (Viptela) v3.3 - Instant Demo

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cisco 4D Secure SD-WAN (Viptela) v3.3 - Instant Demo

Uploaded by

Copyright:

Available Formats

Instant Demo Guide

Cisco 4D Secure SD-WAN (Viptela)

Last Updated: 18-February-2020

About This Instant Demo

About This Instant Demo

About This Solution

Scenario 1. vManage Dashboard

Scenario 3. SD-WAN Security Overview

Laptop Cisco AnyConnect®

About This Solution

3. Login with username/password as amdemo1 / C1sco12345 and click Log In.

Scenario 1. vManage Dashboard

1. The vManage Dashboard displays aggregated visibility into the environment.

3. From the menu, select Configuration > Policies.

5. From the left panel, click Data Prefix.

6. From the left panel, click Site.

7. From the left panel, click SLA Class.

8. From the left panel, click VPN.

9. From the left panel, click Application.

Scenario 2. Topology Creation, Traffic Data, Application Aware Routing, and

1. In the upper right corner, select Custom Options > Topology.

6. Application Aware Routing is displayed.

8. Click back on your browser and click Traffic Data.

10. Click Cancel.

1. From the menu, select Monitor > Network.

6. From the menu, click Control Connections.

7. From the menu, click Events.

10. From the menu, click Troubleshooting.

11. Click App Route Visualization.

Scenario 3. SD-WAN Security Overview

• Backhauled internet-bound traffic on a corporate firewall is a complex problem which requires

Benefits that Reduce Cost and Complexity:

• Leverage defense-in-depth security offerings in a combined platform so customers can decide

3. Click Configuration > Templates.

SD-WAN Security Policies

1. Click Configuration > Security.

3. Click Firewall on the top.

5. Click Cancel to go back to the SD-WAN Security Policy.

10. Click on URL Filtering at the top.

12. Click Cancel.

13. Click Advanced Malware Protection.

15. Click Cancel.

16. Click DNS Security.

18. Click Cancel.

19. Click Policy Summary.

20. Click Cancel.

Data Transfer and Storage

Data Correlation and Algorithms

1. If it’s not selected, click vQoE in the right corner.

Application Family Performance

NOTE: Be patient, performance data may take a while to load. . .

1. In the top title bar, click the Network tab.

1. In the top left click Health.

NOTE: Please be patient, performance data might take a while to load. . .

6. Hover over the map to display map functions:

You might also like