Cisco SD-WAN (Viptela) as Service Gateway (SG)
Purpose and Functionality
Section titled “Purpose and Functionality”The Cisco SD-WAN (Viptela) solution functions as a Service Gateway, offering scalable cloud connectivity. Through vManage, SD-WAN routers receive provisioning templates that automate secure connectivity between customer networks and their assigned cloud instances. This architecture supports local internet breakout at each site, optimizing traffic flow and reducing latency.
Cisco SD-WAN (Viptela) acts as the Service Gateway, provisioned through vManage. It connects to the platform over IPsec and provides BGP routing and VRF-based tenant isolation; the captive portal, DHCP, and DNS are served from the Netgraph cloud, while each site breaks out to the internet locally instead of backhauling through the cloud.
Key Features of Cisco SD-WAN as Service Gateway
Section titled “Key Features of Cisco SD-WAN as Service Gateway”Provisioning via vManage
Section titled “Provisioning via vManage”- Configuration templates enable standardized deployments across SD-WAN routers
- Automatic configuration for secure cloud instance connectivity
Local Internet Breakout
Section titled “Local Internet Breakout”- Direct internet access at customer locations
- Maintains secure cloud service connectivity while enhancing performance for internet-bound traffic
Centralized Management and Monitoring
Section titled “Centralized Management and Monitoring”- vManage serves as the management platform
- Comprehensive statistics and telemetry data from all SD-WAN Service Gateways are collected via the vManage API
Standard SG Features
Section titled “Standard SG Features”Secure Tunneling
- FlexVPN or SD-WAN-native IPsec connectivity
Policy-Based Routing and Dynamic Segmentation
- Supports SGT/SXP tunnels and SGT-to-IP mapping for traffic segmentation
Compatibility
- Works with LAN and wireless LAN networks
Redundancy Options
- Hot standby for failover
- Load balancing for optimized performance
Instance Isolation
- VRF implementation for tenant isolation and enterprise segmentation
ServiceGateway Router Support Matrix
Section titled “ServiceGateway Router Support Matrix”| Router Series | Required License | Feature Utilization | Support Status |
|---|---|---|---|
| Cisco ISR 1100 Series | Security (SEC/K9) + AppX | Cisco TrustSec (CTS), ePBR, IPSec (FlexVPN), NAT, BGP, VRF | Supported |
| Cisco ISR 4400 Series | Security (SEC/K9) + AppX | Cisco TrustSec (CTS), ePBR, IPSec (FlexVPN), NAT, BGP, VRF | Supported |
| Cisco Catalyst 8100 Series | DNA Essentials/WAN Advantage | Cisco TrustSec (CTS), ePBR, IPSec (FlexVPN), NAT, BGP, VRF | Supported |
| Cisco Catalyst 8200 Series | DNA Essentials/WAN Advantage | Cisco TrustSec (CTS), ePBR, IPSec (FlexVPN), NAT, BGP, VRF | Supported |
| Cisco Catalyst 8300 Series | DNA Essentials/WAN Advantage | Cisco TrustSec (CTS), ePBR, IPSec (FlexVPN), NAT, BGP, VRF | Supported |
| Cisco Catalyst 8400 Series | DNA Essentials/WAN Advantage | Cisco TrustSec (CTS), ePBR, IPSec (FlexVPN), NAT, BGP, VRF | Supported |
| Cisco Catalyst 8500 Series | DNA Essentials/WAN Advantage | Cisco TrustSec (CTS), ePBR, IPSec (FlexVPN), NAT, BGP, VRF | Supported |
- Requires Cisco IOS XE 17.6.8a or later.