To configure cellular interfaces using Cisco SD-WAN Manager templates:
-
Create a VPN Interface Cellular feature template to configure cellular module parameters, as described in this section.
-
Create a Cellular Profile template to configure the profiles used by the cellular modem.
-
Create a VPN feature template to configure VPN parameters.
Note
|
If your deployment includes devices with cellular interface, you must include cellular controller templates in Cisco SD-WAN Manager, even if these templates are not used.
If the device has the LTE or cellular controller module configured and the cellular controller feature template does not exist,
then the device tries to remove the cellular controller template. For releases earlier than Cisco IOS XE Release 17.4.2, the
following error message is displayed. bad-cli - No controller Cellular 0/2/0, parser-context - No controller Cellular 0/2/0,
parser-response % Cannot remove controllers this way
For devices running on Cisco IOS XE Release 17.4.2 and later, the device will return an access-denied error message.
|
Create VPN Interface Cellular
-
From the Cisco SD-WAN Manager menu, choose .
-
Click Device Templates.
Note
|
In Cisco vManage Release 20.7.x and earlier releases, Device Templates is titled Device.
|
-
From the Create Template drop-down list, choose From Feature Template.
-
From the Device Model drop-down list, select the type of device for which you are creating the template.
-
Click Transport & Management VPN or scroll to the Transport & Management VPN section.
-
Under Additional Cisco VPN 0 Templates, click VPN Interface Cellular.
-
From the VPN Interface Cellular drop-down list, click Create Template. The VPN Interface Cellular template form is displayed.
This form contains fields for naming the template, and fields for defining the VPN Interface Cellular parameters.
-
In Template Name, enter a name for the template. The name can be up to 128 characters and can contain only alphanumeric characters.
-
In Template Description, enter a description of the template. The description can be up to 2048 characters and can contain only alphanumeric characters.
When you first open a feature template, for each parameter that has a default value, the scope is set to Default (indicated
by a check mark), and the default setting or value is shown. To change the default or to enter a value, click the scope drop-down
list.
Configure Basic Cellular Interface Functionality
To configure basic cellular interface functionality, click Basic Configuration and configure the following parameters. Parameters marked with an asterisk are required to configure an interface. You must
also configure a tunnel interface for the cellular interface.
Table 3.
|
Parameter Name
|
Description
|
|
Shutdown*
|
Click No to enable the interface.
|
|
Interface Name*
|
Enter the name of the interface. It must be cellular0.
|
|
Description
|
Enter a description of the cellular interface.
|
|
DHCP Helper
|
Enter up to four IP addresses for DHCP servers in the network, separated by commas, to have the interface be a DHCP helper.
A DHCP helper interface forwards BOOTP (Broadcast) DHCP requests that it receives from the specified DHCP servers.
|
|
Bandwidth Upstream
|
For transmitted traffic, set the bandwidth above which to generate notifications. Range: 1 through (232 / 2) – 1 kbps
|
|
Bandwidth Downstream
|
For received traffic, set the bandwidth above which to generate notifications. Range: 1 through (232 / 2) – 1 kbps
|
|
IP MTU*
|
Enter 1428 to set the MTU size, in bytes. This value must be 1428. You cannot use a different value.
|
To save the feature template, click Save.
Create a Tunnel Interface
To configure an interface in VPN 0 to be a WAN transport connection, you must configure a tunnel interface on the cellular
interface. The tunnel, which provides security from attacks, is used to send the phone number. At a minimum, select On and select a color for the interface, as described in the previous section. You can generally accept the system defaults
for the reminder of the tunnel interface settings.
To configure a tunnel interface, click Tunnel, and configure the following parameters. Parameters marked with an asterisk (*) are required to configure a cellular interface.
|
Parameter Name
|
Description
|
|
Tunnel Interface*
|
From the drop-down, select Global. Click On to create a tunnel interface.
|
|
Per-tunnel QoS
|
From the drop-down, select Global. Click On to create per-tunnel QoS.
You can apply a Quality of Service (QoS) policy on individual tunnels, and is only supported for hub-to-spoke network topologies.
|
|
Per-tunnel QoS Aggregrator
|
From the drop-down, select Global. Click On to create per-tunnel QoS.
|
Note
|
'bandwidth downstream' is required for per-Tunnel QoS feature to take effect as spoke role.
|
|
|
Color*
|
From the drop-down, select Global. Select a color for the TLOC. The color typically used for cellular interface tunnels is lte.
|
|
Groups
|
From the drop-down, select Global. Enter the list of groups in the field.
|
|
Border
|
From the drop-down, select Global. Click On to set TLOC as border TLOC.
|
|
Maximum Control Connections
|
Set the maximum number of Cisco SD-WAN Controller that the WAN tunnel interface can connect to. To have the tunnel establish no control connections, set the number to 0. Range:
0 through 8
Default: 2
|
|
vBond As STUN Server
|
Click On to enable Session Traversal Utilities for NAT (STUN) to allow the tunnel interface to discover its public IP address and
port number when the router is located behind a NAT.
|
|
Exclude Control Group List
|
Set the identifiers of one or more Cisco SD-WAN Controller groups that this tunnel is not allows to establish control connections with.
Range: 0 through 100
|
|
vManage Connection Preference
|
Set the preference for using the tunnel to exchange control traffic with the Cisco SD-WAN Manager.
Range: 0 through 9
Default: 5
If the edge device has two or more cellular interfaces, you can minimize the amount of traffic between the Cisco SD-WAN Manager and the cellular interfaces by setting one of the interfaces to be the preferred one to use when sending updates to the Cisco SD-WAN Manager and receiving configurations from the Cisco SD-WAN Manager.
To have a tunnel interface never connect to the Cisco SD-WAN Manager, set the number to 0. At least one tunnel interface on the edge device must have a nonzero Cisco SD-WAN Manager connection preference.
|
|
Port Hop
|
From the drop-down, select Global. Click Off to allow port hopping on tunnel interface.
Default: On, which disallows port hopping on tunnel interface.
|
|
Low-Bandwidth Link
|
Click On to set the tunnel interface as a low-bandwidth link.
Default: Off
|
|
Tunnel TCP MSS
|
TCP MSS affects any packet that contains an initial TCP header that flows through the router. When configured, TCP MSS is
examined against the MSS exchanged in the three-way handshake. The MSS in the header is lowered if the configured TCP MSS
setting is lower than the MSS in the header. If the MSS header value is already lower than the TCP MSS, the packets flow through
unmodified. The host at the end of the tunnel uses the lower setting of the two hosts. If the TCP MSS is to be configured,
it should be set at 40 bytes lower than the minimum path MTU.
Specify the MSS of TPC SYN packets passing through the Cisco IOS XE Catalyst SD-WAN device. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU such that TCP SYN packets are never fragmented.
Range: 552 to 1460 bytes. Default: None
|
|
Clear-Dont-Fragment
|
Configure Clear-Dont-Fragment for packets that arrive at an interface that has Don't Fragment configured. If these packets are larger than what MTU allows,
they are dropped. If you clear the Don't Fragment bit, the packets are fragmented and sent.
Click On to clear the Dont Fragment bit in the IPv4 packet header for packets being transmitted out of the interface. When the Dont
Fragment bit is cleared, packets larger than the MTU of the interface are fragmented before being sent.
|
Note
|
Clear-Dont-Fragment clears the Dont Fragment bit and the Dont Fragment bit is set. For packets not requiring fragmentation, the Dont Fragment
bit is not affected.
|
|
|
Network Broadcast
|
From the drop-down, select Global. Click On to accept and respond to network-prefix-directed broadcasts. Turn this On only if the Directed Broadcast is enabled on the LAN interface feature template.
Default: Off
|
|
Allow Service
|
Click On or Off for each service to allow or disallow the service on the cellular interface.
|
To configure additional tunnel interface parameters, click Advanced Options and configure the following parameters:
Table 4.
|
Parameter Name
|
Description
|
|
GRE
|
From the drop-down, select Global. Click On to use GRE encapsulation on the tunnel interface. By default, GRE is disabled.
If you select both IPsec and GRE encapsulations, two TLOCs are created for the tunnel interface that have the same IP addresses
and colors, but that differ by their encapsulation.
|
|
GRE Preference
|
From the drop-down, select Global. Enter a value to set GRE preference for TLOC.
Range: 0 to 4294967295
|
|
GRE Weight
|
From the drop-down, select Global. Enter a value to set GRE weight for TLOC.
Default: 1
|
|
IPsec
|
From the drop-down, select Global. Click Onto use IPsec encapsulation on the tunnel interface. By default, IPsec is enabled.
If you select both IPsec and GRE encapsulations, two TLOCs are created for the tunnel interface that have the same IP addresses
and colors, but that differ by their encapsulation.
|
|
IPsec Preference
|
From the drop-down, select Global. Enter a value to set the preference for directing traffic to the tunnel. A higher value is preferred over a lower value.
Range: 0 through 4294967295. Default: 0
|
|
IPsec Weight
|
From the drop-down, select Global. Enter a value to set weight for balancing traffic across multiple TLOCs. A higher value sends more traffic to the tunnel.
Range: 1 through 255. Default: 1
|
|
Carrier
|
From the drop-down, select Global. From the Carrier drop-down, select the carrier name or private network identifier to associate with the tunnel. Values: carrier1, carrier2,
carrier3, carrier4, carrier5, carrier6, carrier7, carrier8, default. Default: default
|
|
Bind Loopback Tunnel
|
Enter the name of a physical interface to bind to a loopback interface. The interface name has the format ge
slot/port.
|
|
Last-Resort Circuit
|
From the drop-down, select Global. Click On to use the tunnel interface as the circuit of last resort. By default, it is disabled.
|
Note
|
An interface configured as a circuit of last resort is expected to be down and is skipped while calculating the number of
control connections, the cellular modem becomes dormant, and no traffic is sent over the circuit.
When the configurations are activated on the edge device with cellular interfaces, then all the interfaces begin the process
of establishing control and BFD connections. When one or more of the primary interfaces establishes a BFD connection, the
circuit of last resort shuts itself down.
Only when all the primary interfaces lose their connections to remote edges, then the circuit of last resort activates itself
triggering a BFD TLOC Down alarm and a Control TLOC Down alarm on the edge device. The last resort interfaces are used as
backup circuit on edge device and are activated when all other transport links BFD sessions fail. In this mode the radio interface
is turned off, and no control or data connections exist over the cellular interface.
|
|
|
NAT Refresh Interval
|
Set the interval between NAT refresh packets sent on a DTLS or TLS WAN transport connection. Range: 1 through 60 seconds.
Default: 5 seconds.
|
|
Hello Interval
|
Enter the interval between Hello packets sent on a DTLS or TLS WAN transport connection. Range: 100 through 10000 milliseconds.
Default: 1000 milliseconds (1 second).
|
|
Hello Tolerance
|
Enter the time to wait for a Hello packet on a DTLS or TLS WAN transport connection before declaring that transport tunnel
to be down.
Range: 12 through 60 seconds. Default: 12 seconds.
The default hello interval is 1000 milliseconds, and it can be a time in the range 100 through 600000 milliseconds (10 minutes).
The default hello tolerance is 12 seconds, and it can be a time in the range 12 through 600 seconds (10 minutes). To reduce
outgoing control packets on a TLOC, it is recommended that on the tunnel interface you set the hello interval to 60000 milliseconds
(10 minutes) and the hello tolerance to 600 seconds (10 minutes) and include the no track-transport disable regular checking of the DTLS connection between the edge device and the controller. For a tunnel connection between a edge
device and any controller device, the tunnel uses the hello interval and tolerance times configured on the edge device. This
choice is made to minimize the traffic sent over the tunnel, to allow for situations where the cost of a link is a function
of the amount of traffic traversing the link. The hello interval and tolerance times are chosen separately for each tunnel
between a edge device and a controller device. Another step taken to minimize the amount of control plane traffic is to not
send or receive OMP control traffic over a cellular interface when other interfaces are available. This behavior is inherent
in the software and is not configurable.
|
To save the feature template, click Save.
Configure the Cellular Interface as a NAT Device
To configure a cellular interface to act as a NAT device for applications such as port forwarding, click NAT, and configure the following parameters:
Table 5.
|
Parameter Name
|
Description
|
|
NAT
|
Click On to have the interface act as a NAT device.
|
|
Refresh Mode
|
Select how NAT mappings are refreshed, either outbound or bidirectional (outbound and inbound). Default: Outbound
|
|
UDP Timeout
|
Specify when NAT translations over UDP sessions time out. Range: 1 through 65536 minutes. Default: 1 minute
|
|
TCP Timeout
|
Specify when NAT translations over TCP sessions time out. Range: 1 through 65536 minutes. Default: 60 minutes (1 hour)
|
|
Block ICMP
|
Select On to block inbound ICMP error messages. By default, a router acting as a NAT device receives these error messages. Default:
Off
|
|
Respond to Ping
|
Select On to have the router respond to ping requests to the NAT interface's IP address that are received from the public side of the
connection.
|
To create a port forwarding rule, click Add New Port Forwarding Rule and configure the following parameters. You can define up to 128 port-forwarding rules to allow requests from an external
network to reach devices on the internal network.
Table 6.
|
Parameter Name
|
Description
|
|
Port Start Range
|
Enter a port number to define the port or first port in the range of interest. Range: 0 through 65535
|
|
Port End Range
|
Enter the same port number to apply port forwarding to a single port, or enter a larger number to apply it to a range of ports.
Range: 0 through 65535
|
|
Protocol
|
Select the protocol to which to apply the port-forwarding rule, either TCP or UDP. To match the same ports for both TCP and
UDP traffic, configure two rules.
|
|
VPN
|
Specify the private VPN in which the internal server resides. This VPN is one of the VPN identifiers in the overlay network.
Range: 0 through 65530
|
|
Private IP
|
Specify the IP address of the internal server to which to direct traffic that matches the port-forwarding rule.
|
To save a port forwarding rule, click Add.
To save the feature template, click Save.
Apply Access Lists
To configure a shaping rate to a cellular interface and to apply a QoS map, a rewrite rule, access lists, and policers to
a router interface, click ACL/QoS and configure the following parameters:
Table 7. Access Lists Parameters
|
Parameter Name
|
Description
|
|
Shaping rate
|
Configure the aggreate traffic transmission rate on the interface to be less than line rate, in kilobits per second (kbps).
|
|
QoS map
|
Specify the name of the QoS map to apply to packets being transmitted out the interface.
|
|
Rewrite rule
|
Click On, and specify the name of the rewrite rule to apply on the interface.
|
|
Ingress ACL – IPv4
|
Click On, and specify the name of an IPv4 access list to packets being received on the interface.
|
|
Egress ACL– IPv4
|
Click On, and specify the name of an IPv4 access list to packets being transmitted on the interface.
|
|
Ingress ACL – IPv6
|
Click On, and specify the name of an IPv6 access list to packets being received on the interface.
|
|
Egress ACL– IPv6
|
Click On, and specify the name of an IPv6 access list to packets being transmitted on the interface.
|
|
Ingress policer
|
Click On, and specify the name of the policer to apply to packets being received on the interface.
|
|
Egress policer
|
Click On, and specify the name of the policer to apply to packets being transmitted on the interface.
|
To save the feature template, click Save.
Add ARP Table Entries
To configure static Address Resolution Protocol (ARP) table entries on the interface, click ARP. Then click Add New ARP and configure the following parameters:
Table 8.
|
Parameter Name
|
Description
|
|
IP Address
|
Enter the IP address for the ARP entry in dotted decimal notation or as a fully qualified host name.
|
|
MAC Address
|
Enter the MAC address in colon-separated hexadecimal notation.
|
To save the ARP configuration, click Add.
To save the feature template, click Save.
Configure Other Interface Properties
To configure other interface properties, click Advanced and configure the following parameters.
Table 9. Cellular Interfaces Advanced Parameters
|
Parameter Name
|
Description
|
|
PMTU Discovery
|
Click On to enable path MTU discovery on the interface, to allow the router to determine the largest MTU size supported without requiring
packet fragmentation.
|
|
TCP MSS
|
Specify the maximum segment size (MSS) of TPC SYN packets passing through the router. By default, the MSS is dynamically adjusted
based on the interface or tunnel MTU such that TCP SYN packets are never fragmented. Range: 552 to 1460 bytes. Default: None.
|
|
Clear-Dont-Fragment
|
Click On to clear the Don't Fragment (DF) bit in the IPv4 packet header for packets being transmitted out the interface. When the
DF bit is cleared, packets larger than that interface's MTU are fragmented before being sent.
|
|
Static Ingress QoS
|
Select a queue number to use for incoming traffic. Range: 0 through 7
|
|
Autonegotiate
|
Click Off to turn off autonegotiation. By default, an interface runs in autonegotiation mode.
|
|
TLOC Extension
|
Enter the name of a physical interface on the same router that connects to the WAN transport. This configuration then binds
this service-side interface to the WAN transport. A second router at the same site that itself has no direct connection to
the WAN (generally because the site has only a single WAN connection) and that connects to this service-side interface is
then provided with a connection to the WAN.
|
|
Tracker
|
Enter the name of a tracker to track the status of transport interfaces that connect to the internet.
|
|
IP Directed-Broadcast
|
From the drop-down, select Global. Click On for IP directed-broadcast.
Default: Off
|
To save the feature template, click Save.
Feedback