All right, next up is our data policies.
We're going to now create some data policies and push them out.
I would recommend, again, removing the previous centralized policies.
We might need to override that if you haven't already done that.
But either way, let's go ahead and jump in.
We're going to start with Access Control Lists.
We'll go to Configure and Policies.
And ACLs are a localized policy, but we can come up here to Custom Options.
And under the Localized Policy side, we can pick Access Control Lists.
From here, I can add an IPv4 ACL.
I'll call it something like Challenge ACL.
Challenge ACL.
And from here, we'll add a sequence.
Now, we can match on source and destination, so we'll say source.
I'm just going to use a prefix rather than a prefix list.
We want to block from .12.
Well, actually, let's just say .11, .50 to start with.
And then we also want to add destination prefix.
And then 10.10.12.50.32.
Okay, so we've got source and destination in there.
And our action is going to be to drop this traffic.
So let's go ahead and save that.
And we probably want to add another one that this time goes in the reverse direction.
And once again, actions, we're going to set that to drop.
All right, now default action, because we're starting with the rejections,
we want to make sure that we're not dropping everything else.
We're going to accept everything else.
So there's our ACL.
Let's save the ACL policy.
And now we're going to go back to localized policies, and we'll add a new policy.
So I'll import an existing ACL.
We'll pick the challenge ACL.
Import this here.
Click next.
Next.
And now this is ACL challenge sent for centralized.
ACL challenge centralized policy.
From here, we're going to save our policy.
And now we have to apply it.
Now, remember how we apply localized policies.
I can't just go over here and activate it because it doesn't know where I want it to go.
If we're pushing policy to our edges, we have to go to our templates.
So we're going to edit our edge device template here.
And once it loads, we're going to go to additional templates.
And then under policy, I can change this to ACL challenge centralized.
I said centralized.
That should have really been localized.
Just kind of in the control policy zone, I suppose.
Configuration is correct.
It's just the name is a little off.
And from here, we'll just configure the devices and push that new policy out.
So once we see that it's been successful, then we can go and find out if that traffic stopped.
So as we see, I've got a ping set going between host 11 and 12.
So host 11 here is the host at site 11 is pinging the host at site 12.
This traffic stream should get cut off.
Let's go back and check on the application of that policy.
Okay, and it has been applied.
Great.
We haven't actually applied it yet to an interface.
So let's go out to feature templates.
And we'll go to gigabit 3, I believe, should be our VPN 10 interface.
So I'm going to edit this.
And we will apply this.
We've got to find the ACL section right here.
So I'm going to say that, yes, we do want an ingress.
Well, not necessarily an ingress ACL.
Actually, let's do an egress ACL.
Leave that at default.
Global.
On.
All right, and now we need to apply the name of the ACL.
So what was the name of the ACL?
It was challenge underscore ACL.
So I'm going to click update.
And let's see if this pushes down successfully.
And if it does, then we should see that those pings actually stop.
So let's wait a moment here for the application to be made.
And it has been made successfully.
So let's go ahead and go back over to our CLI to see how those pings are going.
And we see that the pings have actually stopped.
We stopped on sequence number 130.
And so if I exit out of this, we're going to see that we did have some packet loss there at the end.
We started to not be able to ping.
If I try to ping again, it's not even going to start up.
So our access control list was applied successfully.
So next, let's go ahead and go over to Edge 13 here and see the configuration we needed to make for DIA.
Now, we had already configured this on Edge 13.
So if you happen to already have that configuration in place, then that was a little bit of a shortcut.
I'm going to go ahead and do a show run section gigabit Ethernet 1.
And so I'm going to point out the configurations we should have made.
So first of all, all of these are outside of SD-WAN mode.
We needed to get onto interface gig 1 and make it IP NAT outside.
We then needed to, and here's our next command, actually.
We needed to specify IP NAT inside source.
Again, inside NATing, changing the source address, reference a list.
So probably a prefix list called any or something that matches everything.
And then interface gig 1 overload.
So that's the other command that we need.
The third command that we need is to look at the actual routing.
So if I do a show run include IP NAT route, remember we need this IP NAT route, not that one, this one,
that specifies that VRF10 or VPN10 can access the global Internet routing table
or really just the default route from the routing table.
So this is what allows this configuration to come together.
So that was task number three.
Probably already potentially had some of that configuration in place in your lab,
but if not, then those are the commands that you needed to enter.
Lastly, let's head back to our SD-WAN manager,
and what we want to do now is configure application-aware routing.
So what we want to do is we want to configure that by going to policies.
Under custom options, I can come to lists, and I want to start by creating an SLA class.
So we've got some SLA classes in here.
We did want to configure one that matches the parameters that we already set.
I'm not going to do that for the sake of time.
We'll just use some of the existing ones that we have.
So next we want to go create a new centralized policy.
So this new centralized policy, we're going to skip through the groups of interest here,
skip past topology and everything, and now we've got application-aware routing.
So always keep in mind that this is where we can configure data policies,
like application-aware routing.
Traffic data is going to be important as well for QoS and such,
but either way I can create a new AAR policy.
So here let's go ahead and create an AAR data policy,
and I'm going to add a sequence type.
It automatically adds app routes, the only type of sequence we can add here,
and then I'm going to choose a sequence rule or add a sequence rule rather.
We have to decide what we're going to match on.
In real life we'd probably choose an application list.
I'm going to match on source data prefix,
and I'm just going to say let's match on 10.10.11.50.
We've done this before where we just want to simulate traffic using the simulator
and want to make sure that everything would look correct in the real world.
So I'm matching on this specific IP address saying any traffic coming from this IP is good,
but under actions I'm going to place this into, let's say, the bulk data queue,
and furthermore I want to force this onto my MPLS connection, something like that.
So I can also keep in mind use this option down here to fall back to best path
if we've configured it for that, but we haven't done that,
so we're just going to save and load, or yeah, save,
and from here we want to change the default action if needed to make it enabled.
Now the default is enabled because, again, we don't want to drop any traffic like this,
but just double check that and make sure it's good.
Everything looks fine to me, so I'm going to save this policy.
From here we'll click next, and under application aware routing,
first of all let's go ahead and name this.
We'll call this a centralized data policy.
Give it a description, and now we'll add our site list and VPN list.
So we said we want to apply this to site 11 on VPN 10, so we'll add that.
Click save policy, and we want to activate it, so we want that sent data policy.
I'm going to click activate, and we'll just push it out to the controller,
and once it has applied then we'll go use that traffic simulator
to make sure that everything is working like we think it is.
All right, so that's a success.
Let's go ahead and go to monitor devices, and remember I can go to edge 11 here.
I can just say other tools, and I can pick simulate flows over here on the right.
From here I'm on edge 11, so I'll pick VPN 10.
Interface here, let's make it a source IP address of .11.50,
and the destination we'll emulate as being .12.50 at a different site,
and then the application shouldn't matter here
because we just said that we're matching all traffic.
and what we find is that this traffic is refusing to use the biz internet
because we tell it to use MPLS as part of our AAR policy.
So it looks like our AAR policy is working,
and that brings us to the end of our data challenge.
So I would recommend going ahead and clearing this configuration off as well
just because otherwise it might cause problems when we apply new policies
as we move forward further into the course.
I hope this has been informative for you, and I'd like to thank you for viewing.