Cisco SD-WAN Self-Service Portal
•Overview of the Cisco SD-WAN Self-Service Portal, on page 1•Using the Cisco SD-WAN Self-Service Portal for the First Time, on page 3
•Allow IP Addresses to Access Overlay Networks, on page 6
•Configure the Cisco SD-WAN Self-Service Portal, on page 6
•Monitor Cisco SD-WAN Overlay Networks, on page 9
Overview of the Cisco SD-WAN Self-Service Portal
The Cisco SD-WAN Self-Service Portal (SSP) is a web application hosted on Amazon Web Services (AWS) GovCloud that you can use to perform the following operations:
• Create and manage Cisco SD-WAN overlay networks. • Monitor the health of your overlay network.
The Cisco SD-WAN SSP is protected by a firewall and application load balancer to prevent denial of service (DoS) and DDoS attacks. You can connect to the Cisco SD-WAN SSP with Okta or any other IdP to provide MFA for all logins. Using an IdP ensures that you can use your secure identity management service that lets you connect any user with any application on any device using your single sign-on (SSO). The Cisco SD-WAN SSP is modularized into separate web servers, backend servers, and database clusters to achieve software scalability.
Cisco vMonitor monitors the cloud infrastructure and updates health notifications regarding a customer’s overlay infrastructure to a common database. The Cisco vOrchestrator web server is also accessible for advanced features and any existing infrastructure-tier customizations, if any, that you use. The Cisco SD-WAN SSP uses Cisco vMonitor and Cisco vOrchestrator by way of API calls to orchestrate actions and monitor the overlay.
Cisco vOrchestrator and Cisco vMonitor can only be accessed by Cisco FedOps. Note
A common global database with multiple read replicas for high availability and disaster recovery is used by all the three applications, and the applications connect to the database using a Transport Layer Security (TLS) or a Secure Socket Layer (SSL) connection.
Figure 1: Cisco SD-WAN SSP Overview
There are two types of users for Cisco SD-WAN for government: • Customers, such as service providers, partners, and other end users.
• Cisco Federal Operations (FedOps): A Cisco team that maintains and monitors Cisco SD-WAN for government.
Cisco FedOps cannot access the customers' Amazon VPCs. Note
Cisco SD-WAN Self-Service Portal Overview of the Cisco SD-WAN Self-Service Portal
Using the Cisco SD-WAN Self-Service Portal for the First Time
When you log in to the Cisco SD-WAN SSP for the first time, a guided workflow is presented. This workflow helps you optionally configure some features as well as create your first Cisco SD-WAN overlay network. The following sections describe the workflow in detail:
Log In to the Cisco SD-WAN Self-Service Portal
When you log in to the Cisco SD-WAN SSP, you must use your Cisco login credentials:
1. Navigate to the Cisco SD-WAN SSP URL.
2. On the login page, click Login via external Cisco IDP. 3. Enter your Cisco login credentials.
4. When prompted, set up or enter your MFA credentials.
The onboarding wizard appears.
(Optional) Configure an IdP for Cisco SD-WAN SSP
When you log in to the Cisco SD-WAN SSP for the first time, you can optionally configure the Cisco SD-WAN SSP to use your organization's IdP, such as Okta Identity Management. After you configure your IdP and roles (as described in(Optional) Configure Cisco SD-WAN Self-Service Portal Roles for IdP Users), you can log in using your own IdP instead of your Cisco.com account credentials.
Before you configure an IdP in Cisco SD-WAN SSP, you must create the following variables on your organization's IdP. Cisco SD-WAN SSP requires these variables for each user that logs in.
• firstName • lastName • email
• SSP_User_Role Note
1. Specify the following information for your IdP. (You can find this information in your IdP.)
• Domain Name • IdP Issuer URL • IdP SSO URL
• IdP Signature Certificate in .pem format.
2. (Applicable only for federal environments), check the I acknowledge that this is a Federal IDP check
box.
Cisco SD-WAN Self-Service Portal
3. Click Submit Request.
4. On your IdP site, confirm the IdP creation. 5. Click Go to Role Management.
(Optional) Configure Cisco SD-WAN Self-Service Portal Roles for IdP Users
1. Enter a name for the role.
2. For each of your virtual accounts, assign a role from the following list:
• Monitor: Allows you to view and monitor all the overlay options in the Cisco SD-WAN SSP. • Overlay Management: Allows you to create, modify, and monitor overlay networks.
• Administration: Allows you to perform all the tasks defined by the monitor and overlay network roles, and to onboard a new IdP.
3. Click Add Role.
4. Log out of the Cisco SD-WAN SSP.
5. Log in to the Cisco SD-WAN SSP again using your IdP and credentials.
Create a Cisco SD-WAN Cloud-Hosted Overlay Network
1. Click Go to Overlay Creation.
2. Click Overlay and select the name of the virtual account for which you want to associate the overlay network.
3. Choose Cisco Hosted or Non-Cisco Hosted.
If you choose Non-Cisco Hosted, set the location for your data storage.
4. Click Next.
5. Select Amazon Web Services.
6. Depending on what hosting modeling you selected, you can configure the following. • Cisco Hosted
a. Choose the primary and secondary locations of your cloud-hosted controllers.
We recommend that you choose different primary and secondary locations to achieve geographical redundancy.
b. Select the location where you want your monitoring data to be stored. c. Choose the Cisco SD-WAN version.
• Non-Cisco Hosted
a. Select the location where you want your monitoring data to be stored.
Cisco SD-WAN Self-Service Portal (Optional) Configure Cisco SD-WAN Self-Service Portal Roles for IdP Users
7. Click Next.
8. Enter the email address for the Cisco SD-WAN overlay network owner or administrator.
9. For the Overlay Status, select Production.
10. Click Summary.
11. (Optional) To customize subnets, DNS names, or snapshot settings, click Edit in Advanced Options: • Subnets
• For the primary and secondary subnets, specify the VPC subnet. You can specify up to three subnets.
• To provision Cloud vEdges for TACACS-based user authentication and authorization, click the checkbox.
• DNS names
• Enter the custom DNS name for Cisco vBond Orchestrator. • Enter the custom DNS name for Cisco vManage.
• Snapshot settings
• Select a frequency for taking the snapshots from one of the following: • Once a day
• Once in 2 days • Once in 3 days • Once in 4 days
You can choose up to 10 snapshots.
By default, the network overlay configuration is backed up once a day and 10 snapshots are stored. Note
12. Review the details that you entered.
13. Click Submit Request.
14. A unique controller password appears. You can use this password to access the overlay network after it is created.
To secure your environment, we recommend that you immediately change the password after logging in. Note
Cisco SD-WAN Self-Service Portal
Allow IP Addresses to Access Overlay Networks
For Cisco-hosted overlay networks, you can specify trusted IP addresses, including prefixes, from which you can access the overlay network. To request user access, specify a rule type, protocol, port range, and source IP (IP addresses and prefixes) for which you require access.
You do not need to add the IP addresses of Cisco IOS XE SD-WAN devices. While bringing up the Cisco IOS XE SD-WAN devices, IP addresses and prefixes are added through an automated process.
Note
1. From the Cisco SD-WAN SSP dashboard, navigate to your overlay network. 2. From the drop-down list, click Cisco Hosted Overlays.
The list of overlay networks appears.
3. Click the name of your overlay network. 4. Click Inbound Rules.
5. Specify the following parameters for your IP address or prefix:
• Rule type: Select All, SSH, HTTPS, Custom TCP rule, or Custom UDP rule. • Port range: For custom TCP and UDP rules, specify a port range.
• Source: Specify an IP address or IP address prefix.
6. Click Add.
7. (Optional) Add any additional IP addresses or IP address prefixes that you want to allow. 8. Click Save.
Configure the Cisco SD-WAN Self-Service Portal
After setting up the Cisco SD-WAN SSP for the first time, you can also set up additional overlay networks, users and roles, and child IdPs. You can have multiple child IdPs for the same IdP. A child IdP can also have a subchild IdP.
Create Additional Overlay Networks
To create a Cisco SD-WAN cloud-hosted overlay network, do the following:
1. Click Go to Overlay Creation.
2. Click Overlay and select the name of the virtual account for which you want to associate the overlay network.
3. Choose Cisco Hosted or Non-Cisco Hosted.
If you choose Non-Cisco Hosted, set the location for your data storage.
Cisco SD-WAN Self-Service Portal Allow IP Addresses to Access Overlay Networks
4. Click Next.
5. Select Amazon Web Services.
6. Depending on what hosting modeling you selected, you can configure the following. • Cisco Hosted
a. Choose the primary and secondary locations of your cloud-hosted controllers.
We recommend that you choose different primary and secondary locations to achieve geographical redundancy.
b. Select the location where you want your monitoring data to be stored. c. Choose the Cisco SD-WAN version.
• Non-Cisco Hosted
a. Select the location where you want your monitoring data to be stored.
7. Click Next.
8. Enter the email address for the Cisco SD-WAN overlay network owner or administrator.
9. For the Overlay Status, select Production.
10. Click Summary.
11. (Optional) To customize subnets, DNS names, or snapshot settings, click Edit in Advanced Options: • Subnets
• For the primary and secondary subnets, specify the VPC subnet. You can specify up to three subnets.
• To provision Cloud vEdges for TACACS-based user authentication and authorization, click the checkbox.
• DNS names
• Enter the custom DNS name for Cisco vBond Orchestrator. • Enter the custom DNS name for Cisco vManage.
• Snapshot settings
• Select a frequency for taking the snapshots from one of the following: • Once a day
• Once in 2 days • Once in 3 days • Once in 4 days
You can choose up to 10 snapshots.
Cisco SD-WAN Self-Service Portal
By default, the network overlay configuration is backed up once a day and 10 snapshots are stored. Note
12. Review the details that you entered.
13. Click Submit Request.
14. A unique controller password appears. You can use this password to access the overlay network after it is created.
To secure your environment, we recommend that you immediately change the password after logging in. Note
Set Up Child IdPs
When you set up an IdP in the Cisco SD-WAN SSP, the issuer, login URL, and PEM key are not available from your organization's IdP. This information is available after you set up the ACS URL and audience in your organization's IdP. When setting up your organization's IdP, we recommend that you add placeholder values for the ACS URL and audience. Later, you can configure the IdP on the Cisco SD-WAN SSP and update your organization's IdP with the correct value of the ACS URL and audience URI that is editable in the Cisco SD-WAN SSP.
Note
1. Enter the domain name for the IdP.
Ensure that the domain name is a unique email domain that can be used to route users.
2. Enter the issuer URI of the IdP. 3. Enter the IdP SSO URL.
4. Upload the IdP signature certificate.
Create Additional Roles
To create an additional role, the Smart Account administrator must do the following:
1. Click the menu icon to the left of the Cisco SD-WAN Self-Service Portal. 2. Click Manage Roles.
3. Enter a name for the role.
4. Assign permissions for each of the virtual accounts from one of the following options:
• Monitor: Allows you to view and monitor all the overlay options in the Cisco SD-WAN SSP. • Overlay Management: Allows you to create, modify, and monitor overlay networks.
Cisco SD-WAN Self-Service Portal Set Up Child IdPs
• Administration: Allows you to perform all the tasks defined by the monitor and overlay network roles, and to onboard a new IdP.
5. Click Add Role.
Monitor Cisco SD-WAN Overlay Networks
You can monitor the Cisco SD-WAN controllers and devices in the overlay networks. You can also view the alerts for AWS instances and view the Plan of Actions and Milestones report.
Monitor Cisco SD-WAN Controllers and Devices in Overlay Networks
1. From the Cisco SD-WAN SSP dashboard, navigate to your overlay network.
• If your overlay is Cisco-hosted, click Cisco Hosted Overlays.
• If your overlay is non-Cisco hosted, click Non-Cisco Hosted Overlays. The list of overlays appears.
2. Click the name of your overlay.
3. In the Controller View tab, click the controller that you want to monitor, such as Cisco vManage, Cisco vBond Orchestrator, and so on.
4. On the window, you can filter by network usage or CPU usage. At the bottom of the window, you can
view information about the controller, such as whether it is online, its IP address, and region.
View Alerts
The Alerts window displays various alerts related to the AWS instances.
1. From the Cisco SD-WAN SSP dashboard, click Notifications.
The Alerts window appears.
This window provides alerts collected from the Cisco SD-WAN SSP about infrastructure-level issues from the AWS instances.
View Plan of Action and Milestones
To view the POA&M report, do the following:
1. From the Cisco SD-WAN SSP dashboard, click Regulated.
The POAM window, which provides a vulnerability feed of your overlay networks, is displayed. Using sources such as Qualys, Wazuh, and so on, the POAM window lists a variety of issues. You can search, categorize, and download the reports. You can feed the downloaded reports to a security information and event management (SIEM) software such as Splunk.
2. Perform the following tasks in the POAM window:
Cisco SD-WAN Self-Service Portal
• Use the search bar to filter and search for issues. You can filter by various parameters, such as POAM status, risk rating, custom date ranges for detection of issues, and so on.
• To view information about a specific issue, click Details.
A dialog box, which lists additional information about the alert, including a description of the issue, appears.
• To filter by a specific column, click the textbox under the column. For example, you can click under the Adjusted Risk column, and enter high to list all the high-risk issues.
Cisco SD-WAN Self-Service Portal View Plan of Action and Milestones
