Gateways

The Gateways list under Service Gateway shows the Cisco routers registered to this Sign-In Context. Each router gets its configuration from a framework: a router configuration template with variables. You fill in the router’s variables, download the resolved configuration from the router’s page and apply it on the router. Sign In does not send configuration to the router.

The Gateways list

Each row shows:

• Router Id: the name the router has in Sign In. It is also the ID of the router’s IPsec remote peer.
• IP Address: the router’s tunnel interface IP. The platform assigns it when you add the router.
• IPsec Remote Peer: whether the router has its own IPsec tunnel to Netgraph.
• BGP Enabled: whether the router runs BGP with the platform.

Search by Router ID to find a router in a large deployment. The menu on each row has Add to DHCP scopes and Remove from DHCP scopes, which add the router to every DHCP scope or take it out of every scope, and Remove for the router itself.

Add a Service Gateway

1. Click Add Service Gateway

   On the Gateways list, click + Add Service Gateway. The button stays disabled until at least one framework is available to your organization. Contact support if none is.

2. Enter the Router ID

   3 to 45 characters, lowercase letters and digits. all is reserved.

3. Pick the framework

   The Framework list appears when more than one framework is available. With only one, it is selected for you.

4. Keep Acts as IPsec Remote Peer ticked

   The box is ticked by default. Sign In then creates an IPsec remote peer for the router, with the Router ID as its ID.

5. Click Add Service Gateway in the dialog

   The platform assigns the router’s tunnel interface IP. If BGP is enabled for the Context, it is enabled for the router as well and the router is added to the BGP peers.

6. Download and apply the configuration

   Open the router, fill in its variables and download the configuration, as described in Download and apply the configuration.

Batch Add

Batch Add creates many routers from one file, all with the same framework. The file is a semicolon-separated .csv without a heading and with four columns:

Column	Content
1	Router Id, lowercase letters and digits.
2	IP Address, the router’s tunnel interface IP.
3	IPsec, true or false. Default true. false creates the router without an IPsec remote peer.
4	BGP Enabled, true or false. Default true.

Rows with BGP enabled are rejected when BGP is disabled for the Context. The page previews the file before you submit it and lists the rows that failed, with the reason.

The router’s page

Click a Router ID to open the router. The page stacks these cards:

• Service Gateway: Router ID, Router Tunnel Interface IP (edit it with the pencil), BGP Enabled (a switch, shown when BGP is enabled for the Context) and IPsec Remote Peer (Yes or No).
• Framework Configuration: Select Framework picks the framework the router uses. If the framework is no longer available, a Framework unavailable callout asks you to select another one.
• Reserved Variables: the variables the platform fills in, with their category (Platform or Sign-In Context) and the value they resolve to for this router. They cannot be overridden.
• Framework Template: the router configuration with ${variable} placeholders. Edit Template opens it for editing and Save Template saves it for this router.
• Custom Variables: this router’s own values, such as interfaces and addresses. Save Configuration saves them.
• Resolved Template Preview: the configuration with every variable filled in, ready for the router.

Reserved Variables

Name	Meaning
applicationIp	The platform address the router talks to.
dcId	The platform datacenter ID.
domainName	The platform domain name.
contextId	This Sign-In Context’s ID.
routerId	This router’s Router ID.
bgpLocalAs	The router’s own BGP AS, set as Service Gateway BGP AS on the BGP tab.
bgpRemoteAs	The platform’s BGP AS, set as Cloud BGP AS on the BGP tab.
ikev2PreSharedKey	The pre-shared key of this router’s IPsec remote peer.
tunnelIntIp	This router’s tunnel interface IP.

Framework Template

The template holds the router configuration as text, with ${...} placeholders wherever a value differs between routers. Editing it changes the template for this router only. When it differs from the framework, a Template modified callout appears, and Restore from template reverts it.

Custom Variables

One row per variable, with Variable, Description and Value. Add Variable asks for a Property Name and a Description. When a value differs from the framework’s default, the default is shown under the field with a Restore link. Reserved and custom variables share the same ${...} names, so don’t give a custom variable a reserved name.

Every variable must be used

Two callouts above the template list variables the template does not reference:

• Unused Reserved Variables: reserved variables missing from the template. Add them where they belong in the configuration.
• Unused Custom Variables: custom variables that are defined but not referenced. Reference them in the template or delete them.

While either callout is shown, the preview card reads Framework configuration incomplete, and preview, copy and download are disabled.

Download and apply the configuration

1. Save the variables

   Fill in the Custom Variables and click Save Configuration. The preview is built from what is saved.

2. Check the preview

   In Resolved Template Preview, click Refresh and read through the configuration.

3. Download it

   Download saves the configuration as a text file named after the router, <Router ID>-framework-config.txt. Copy puts it on the clipboard instead.

4. Apply it on the router

   Apply the configuration on the router. The router then brings up its tunnel to Netgraph by itself.

Note

Changes in Sign In never reach the router by themselves. After you change the template, a variable, the tunnel interface IP, the IPsec pre-shared key or the BGP AS numbers, download the configuration again and apply it on the router.

Common Settings

The Common Settings sub-tab, next to Gateways, holds:

• Service Gateway IOS-XE: the Interface description used in the router configuration.
• Service Gateway Viptela SDWAN: vManage Host, IPsec-Id, API Username and API Password, used when the routers run on a Catalyst SD-WAN (Viptela) fabric.

Remove a Service Gateway

Use Remove in the row menu when a router is decommissioned. Sign In also removes the router’s IPsec remote peer and BGP peer and takes it out of every DHCP scope. The configuration on the router itself is left as it is.

Multiple routers in one Context

A Context can have many routers, for example one per site or two at one site. They share the Context’s settings. Each router has its own tunnel interface IP, IPsec remote peer, BGP peer, framework variables and set of DHCP scopes.

Related

DHCP

Scopes served through the registered routers.

IPsec

The remote peer each router gets.

BGP

Routes from the routers to the platform.