All right, let's go ahead and jump into CLI configuration. Now, when we think about creating
policies, we have to kind of work our way backwards. We can't just start by creating a policy
because a policy is built on lists. For example, we need VPN lists, we need TLOC lists, we need
site lists. We've got a lot of different lists to make, and so we're going to start by making
some lists. So we're going to do a config T. Now again, notice where we are. We're on the controller.
We're going to start by creating a centralized policy, and that centralized policy is going to
have to come from the controller. Controllers, at the time of this recording at least, are still
running VIP Telecode, and so we don't need a config dash T or an SD-WAN or anything like that to get
to that side of the house. For edges that are running iOS XE, we have to kind of balance two
different software packages in one. But these controllers are just running VIP Telecode, so I
just do a config T. I don't need to do SD-WAN or anything like that. That's not going to work
because it's all SD-WAN code, and so we're going to get into a policy part of the hierarchy here,
and we're going to find that there's actually a lot of hierarchy, so much so that as we expand
this, it actually starts to shrink again, and we just have to pay attention to where we are,
and certainly looking at the final configuration is going to help us a lot. But a lot of configuration
happens under policy. I simply do a config T, and then just like I get onto an interface on a
standard Cisco device, I get onto policy. So now I'm in the configuration for policy,
and it's within this policy that I can configure lists. So we notice here it doesn't say config
dash policy dash lists. It just goes to config dash lists, but if I were to exit out of this,
it goes back to policy. So we are actually getting more and more hierarchical in this
command structure, and so it's important to kind of keep up with that and figure out where
things go. And so I want to create lists, and so I can do a question mark here, and I can see all
the types of lists that I can create. For example, an app list, a color list, the TLOC list, and very
importantly, what we're going to need for a lot of these, site lists and VPN lists. We also have the
idea of making prefix lists, so we have prefix lists here, which if it doesn't say data, then
that's a standard prefix list that is used on the control plane. So for control policies,
data prefix lists would be used for our data policies. So lots of lists there, and we've
configured them all before just at the UI. So let's go and do it at the CLI now. I'm going to
create a site list, and I'm going to call this site list maybe site 11. We actually saw that we
already have one called site 11, and so I'll just make one for maybe site 14 as a demonstration
purposes here, and then I have to tell it which site IDs exist within this site list. So I could
say site ID 14, maybe I add another one, site ID 15, something along those lines. So I can exit out
of that, and I can create more site lists if I so desire. Now one thing I want to point out about the
CLI with Viptela, it's actually kind of cool. We saw how hierarchical that got. I had to do policy,
then I had to do lists, and then I had to get on to site lists. Well check this out. I can actually
do something really cool here. I can combine some of these lines of configuration together.
So for example, I can say, let me exit out of this, I can say policy lists, and then
it takes me right there. It knows that, hey, if we're going to enter into this context,
then we can enter into the next context. So that's kind of cool too. I can also say site list,
and then create, let's say, a new site list. Let's just call it site new here,
and then I can add a site ID. I could say site ID 15, something like that, and so now it put me in
here into the site new list, and it has also added in a site ID. So even though it gets very hierarchical,
we do have options for trying to streamline our configuration. So we'll see that a few
different times, not only in how we do demonstrations, but also later on for our lab tasks.
So let's go ahead and configure a few other list types. We'll start with VPN lists. So again, I'm
going to get into policy, and I can do this as two commands all in one there. So policy lists,
and I'm going to create a VPN list. We'll call this VPN for customer A, something like that,
and just like with the site list, I'm going to add individual components, in this case VPNs.
So I could do a range of VPNs, like 20 to 30, and then I can add another range of VPNs, like
40 to 50, and then exit out of this. And again, this is where I might want to commit normally, but
because our controller's in managed mode, we're not going to be able to do that. That's no problem.
All right, so next up is TLOC lists. This is going to follow the same pattern. We're in policy
and lists. Now I'm going to say TLOC list and give it a name like, I don't know, site 12 TLOCs,
something like that. And then I can enter in the TLOC information. Now, this is pretty
straightforward with a site ID of 14 or 15 and a VPN range of 20 to 30. What am I entering for a
TLOC? Let's think back to when we created TLOC lists. We had to enter those three pieces of
information. And so we're going to need an IP address, for example. So the IP address is the
system IP address. So for site 12, it'd be 12.12.12.12. And then we have to enter in the color next.
So I'll say color, and then I can choose, let's say MPLS first. And then I also have to include
the encapsulation. So it's just NCAP, not encapsulation. Yes, we're running over into the
next line because it's so long. And then I specify it's IPsec and hit enter. So next, I can create
the other TLOC that's at site 12. This one has a different color. It's bizinternet. I can tab that
over and then say NCAP IPsec and hit enter. So that's how I create a TLOC list. Next up, I might
want to create a prefix list. So remember, we've got the two different types. I'm just going to
create one for each. I'm going to say, let's say, prefix list and maybe something like a match any
prefix list where we say IP-prefix 0.0.0.0.0.0 less than or equal to 32. So slightly different
syntax from Cisco's. And then we can also do prefix list or rather, whoops, data prefix list.
There it is. Data prefix list. And then the syntax is going to be the same here. So I've got to name
it. So I could call it match any data, something like that. And then IP-prefix, and it would do the
same thing. All right. So, whoops. What did we do here? IP-prefix. Okay. There we go. Didn't need
the less than or equal to 32. All right. So we're going to exit out of there. And that is how we
create lists here on the SD-WAN controller. Now, I do want to pop over to the edge here. We've been
timed out as usual. All right. So we do have list configuration on edges. That's going to be
important later when we're configuring access control lists. So just to demonstrate this real
quick, we do our config dash T there and then policy. And then from here, we can do lists
and we can see the many different types of lists that we can create. However, it's not nearly as
many this time, because we have an app list and we have our prefix lists, but we don't see site
lists and VPN lists because those are only used from a controller perspective. The data plane,
localized policies that we're typically deploying, they don't need those types of lists. And so our
list types are certainly more limited on the edges. So be aware of that from an edge perspective,
but otherwise that is how we create our lists at the CLI.