Well, we certainly want to make sure that we have this process down
for configuring these control policies.
Remember, control policies are at the control plane,
and we're talking about a centralized policy.
Then we're talking about pushing that policy
through the centralized SD-WAN controller.
So we go to Configuration. We go down to Policies.
We see we're on Centralized Policy.
And when we're told, for example, to start creating site lists,
a blank canvas, because we haven't done anything yet,
say, well, where do I configure lists?
Well, remember, we have two different places we can do it.
I can simply say Add Policy,
and I'm immediately placed into the area of the UI
that allows me to configure the lists.
They call them groups of interest up here,
but really on the back end, it's creating lists
that's going to get pushed to the CLI of the SD-WAN controller.
But the other place that we can go is up here to Custom Policies,
and under Centralized Policy, I can configure lists directly here.
Now, if I go Configure Lists here,
there's no next option to take me to the policy creation,
but it is a nice place to go
if we want to go about doing it that way,
just to create the lists.
So if you are starting with a blank template,
you probably just went to Add Policy,
but either way, we need to make sure
that we get the site list created as specified,
and so we were told to basically replicate what we did
but then also create a site list that includes sites 11 and 12,
with the goal that we're going to eventually create
those sites together as spokes,
and then having one site list for both
makes it so we don't have to reference multiple site lists.
So this is obviously going to be a little bit different
at our scale with only three different sites.
If we have 100 sites,
then we're going to need to decide
what's right for our organization there.
We also wanted to create VPN lists.
We did not say how to name these,
so it's always nice to put a little bit of thought
into how we name things just to make it
abundantly clear what it's doing.
If these VPNs belong to specific customers,
then we could put customer names here,
but we want to come up with something
that's going to scale out to the rest of our environment.
So at this point, we can scroll down and click Next,
and now we want to do the first main task here,
We're told to create a hub and spoke topology.
We'd create a name, description,
add our VPNs into the list here.
We'd just select VPN 10 is what we did in the demonstration,
and then we can add our hub sites here.
So don't forget this part when we add a site.
So our hub site's going to be 13.
Don't forget to click Add just to make sure that it's in there,
and then adding the spoke sites again.
This is where if we created that site 11 and 12,
but sites 11 and 12, we could just select a single list
or we could select multiple lists here as well.
So I can click Add there,
and so that would be how we create our hub and spoke policy,
and again, we're encouraged in the lab tasks
to go verify once we activate this that it works.
So I'd encourage you to make sure you take the time
to deploy this into your own lab environment.
When you do save it and deploy this policy,
click that config diff, the differences,
so see what's getting deployed to the CLI.
We'll be doing CLI-specific configuration coming up
because we do need to know the CLI commands as well.
It's very important, which is why it's good to kind of start
to take a look at that.
So that is the hub and spoke topology.
Next is the VPN membership concept, same thing.
We'll go over to VPN membership.
We'll create a new VPN membership policy,
give it a name and a description,
and we just want to match the sites with our VPN lists.
So if I want sites 11 and 12 to have both VPNs, great.
I can add as many of these as I need to.
Use the trash can over here to get rid of them
if you do too many, and then we can add site 13 here
and only deliver VPN 10.
So remember, this is what we're going to allow.
Think back to the fact that when we look at the CLI versions
of these policies that they look like route maps,
which means that we're going to add in what we're allowing
because we're changing the default behavior
to be rejecting everything.
So we want to start to frame that as well
to really make sure we understand
that everything is allowed by default.
If we just want everything to be allowed,
then we don't need any policies whatsoever.
So the moment we deploy a policy, Cisco says,
okay, you clearly want to control what's happening here.
So we're going to say nothing is allowed
unless you explicitly allow it.
So it's the allowed elements
that we are actually going about configuring here.
and again, go out and make sure
that VPN 20 is being properly received
by the sites that need it, sites 11 and 12,
and that it's not being received by site 13.
So that brings us to the end of just the concept
of deploying the centralized control policies
via the SD-WAN Manager UI.
Let's make sure we are comfortable with that.
And again, as we start to look at CLI config,
it is helpful to take a look and see what's being deployed
on the SD-WAN controller from that perspective,
and that as long as we get all the concepts down,
we'll be primed and ready to start to learn the CLI as well.
I hope this has been informative for you,
and I'd like to thank you for viewing.