ZSCALER AND
CISCO CATALYST SD-WAN
DEPLOYMENT GUIDEJULY 2024, VERSION 5.3

BUSINESS DEVELOPMENT GUIDEZscaler and CISCO Catalyst SD-WAN Deployment Guide

Contents
Terms and Acronyms

9

About This Document

12

Zscaler Overview

12

Cisco Overview

12

Audience

12

Hardware Used

12

Software Revisions

13

Request for Comments

13

About the Guide

13

Zscaler and Cisco Introduction

15

ZIA Overview

15

ZPA Overview

15

Zscaler Resources

15

Cisco SD-WAN

16

Cisco Resources

16

Define17

Cisco Catalyst SD-WAN Design Overview

17

Feature Background and History

18

Support through Cisco Catalyst SD-WAN 20.3/17.3 code versions(Traditional Active/Standby Tunnels and L7 Health Checking)18

Cisco Catalyst SD-WAN 20.4/17.4 code versions(Active/Active ECMP Tunnels and Traffic Steering through SIG Route and Centralized Data
Policy using SIG Templates)
18
Cisco Catalyst SD-WAN 20.5/17.5 code versions(Zscaler Automatic IPSec Tunnel Provisioning)

19

Cisco Catalyst SD-WAN 20.6/17.6 code versions(L7 Health Checks for IPSec Auto Tunnels for IOS XE SD-WAN routers
and Cloud onRamp for SaaS over SIG Tunnel Support)

19©2024 Zscaler, Inc. All rights reserved.

1

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Cisco Catalyst SD-WAN 20.7/17.7 code versions(VRRP Interface Tracker support for SIG Tunnels)

19

Cisco Catalyst SD-WAN 20.8/17.8 code versions (Multiple SIG Enhancements)

19

Cisco Catalyst SD-WAN 20.9/17.9 code versions(Zscaler Automatic GRE Tunnel Provisioning and SIG Tunnel Monitoring)

19

DesignGRE and IPSec Tunnels

21
21

Packet Format and NAT

21

Throughput

22

Tunnel Source IP Addressing

22

Tunnel Liveliness

23

GRE Keepalives and DPD

23

Layer 7 Health Checks

23

ECMP Routing

23

4-Tuple ECMP

23

Source IP-Based ECMP

24

Primary vs. Secondary Data Center Placement

25

Zscaler Active/Standby Tunnel Combinations

26

One Active/Standby Tunnel Pair

26

Multiple Active/Active Tunnels with ECMP

27

Multiple Active/Standby Tunnel Pairs

28

Active/Active Tunnels with Weighted Load Balancing

29

User Traffic Redirection

29

Service VPNs30

WAN Edge with Zscaler Site Tunnel Design

30

Single WAN Edge Design31

Dual WAN Edge Design34

Dual WAN Edge with Zscaler Site Service-Side Design

37

VRRP

37

Routing37©2024 Zscaler, Inc. All rights reserved.

2

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

SIG Service

39

New SIG Workflow

40

Automatic Zscaler Tunnels

41

IPSec

41

Advanced Settings for Zscaler Auto Tunnels

42

Layer 7 Health Check for Auto Tunnels

43

General Configuration Steps

43

Configuration Prerequisites

43

Design Considerations

44

Basic

44

ZIA Admin Portal

44

ECMP Tunnels

44

Auto Tunnels

44

L7 Health Checks

45

GRE

45

Cisco vEdge

45

Deploy46

Deploy: ZIA for API Access

46

Procedure 1: Log In to ZIA

47

Procedure 2: Find Zscaler Organization Domain and Partner Base URI

47

Procedure 3: Add and Verify SD-WAN Partner Key

49

Procedure 4: Add a Partner Administrator Role

52

Procedure 5: Create a Partner Administrator

54

Procedure 6: Activate Pending Changes

57

Deploy: Cisco WAN Edge Prerequisites

58

Procedure 1: Log In to the Cisco Catalyst SD-WAN Manager

58

Procedure 2: Ensure Prerequisites are Met

58

Procedure 3: Create a SIG Credentials Feature Template60©2024 Zscaler, Inc. All rights reserved.

3

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Deploy: Cisco WAN Edge Auto IPSec or GRE Tunnels(One Active/Standby Pair, Hybrid Transport)

63

Procedure 1: Create a SIG Template

64

Procedure 2: Add the Tunnel Configuration to the Device Template

69

Procedure 3: Add Service Route71

Procedure 4: Verify Tunnel Operation

72

Procedure 5: (Optional) Customize L7 Health Tracker

73

Procedure 6: (Optional) Enable Advanced Zscaler Features

75

Procedure 7: (Optional) Customize Zscaler Tunnel Destination(Primary and Secondary Data Centers)

77

Deploy: Cisco WAN Edge Auto IPSec or GRE Tunnels(Active/Active Tunnels, Hybrid Transport)

80

Procedure 1: Create two loopback interfaces, one for each active tunnel(Cisco IOS XE SD-WAN only)

81

Procedure 2: Create a local policy-based routing policy(Cisco IOS XE SD-WAN only)

82

Procedure 3: (Optional) IOS XE SD-WAN Only: Configure Source IP-Based ECMP

84

Procedure 4: Create a New SIG Feature Template with Two Active Tunnels(Cisco IOS XE SD-WAN Only)

85

Procedure 5: Modify Device Template

86

Procedure 6: Add Centralized Data Policy for Traffic Redirection

89

Procedure 7: (Optional) Assign Tunnel Weights

94

Operate95

Verify Cisco Catalyst SD-WAN Tunnel Operationfrom the Cisco SD-WAN Manager

95

Verify Cisco Catalyst SD-WAN Event Logs from the Cisco SD-WAN Manager

96

Verify Zscaler Tunnel Status in ZIA Admin

97

Verify Zscaler Tunnel Event Logs in ZIA Admin

98

Tunnel Logging

98

View API Calls in Zscaler ZIA (Audit Logs)

98

Verify Zscaler ZIA Service Configuration

100©2024 Zscaler, Inc. All rights reserved.

4

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Verify Zscaler Tunnel Operation Using Cisco IOS XE SD-WAN CLI

100

Verify Zscaler Tunnel Operation using Cisco vEdge CLI

104

Appendix A: Cisco Branch Base Feature Templates
and Configuration Values Used
Feature Templates

109
109

AAA feature template (Cisco IOS XE SD-WAN)

109

AAA feature template (Cisco vEdge)109

NTP Feature Template

110

Branch VPN0 Feature Template

110

Branch Internet Interface Feature Template (Cisco IOS XE SD-WAN)

110

Branch Internet Interface Feature Template (Cisco vEdge)

111

Branch MPLS Interface Feature Template

111

Branch VPN512 Interface Feature Template

111

Branch VPN 1 Feature Template112

Branch VPN1 Interface Feature Template112

Device Templates

112

Single WAN Edge Router Sites (Cisco IOS XE SD-WAN)

112

Single WAN Edge Router Sites (Cisco vEdge)

113

Device Variable Values

Appendix B: Tunnel Configuration Summary(Feature and Device Templates)
Prerequisites

113

115
115

Cisco VPN Interface Ethernet Feature Template

115

Cisco VPN Feature Template

115

Cisco VPN Feature Template

115

SIG Credential Information from ZIA

116

Cisco SIG Credentials Feature Template

116

Example 1: Active/Standby Tunnels

117

Cisco SIG Feature Template (GRE)117©2024 Zscaler, Inc. All rights reserved.

5

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Cisco SIG Feature Template (IPSec)

117

Device Template

118

Example 2: Active/Active Tunnels (Cisco IOS XE SD-WAN Only)

118

Cisco VPN Interface Ethernet Feature Template

118

Cisco VPN Interface Ethernet Feature Template

119

Cisco CLI Add-On Feature Template

119

Cisco SIG Feature Template (GRE)119

Cisco SIG Feature Template (IPSec)120

Device Template

121

Traffic Redirection

121

Service Route121

Branch VPN1 Feature Template

121

Centralized Policy

121

Miscellaneous

122

Customize Health Tracker

122

Enable Advanced Zscaler Features

122

Customize Zscaler Tunnel Destinations (Primary and Secondary DCs)

122

Assign Tunnel Weights (Use with Active/Active Tunnels)

123

Appendix C: Cisco IOS XE SD-WAN CLI Configuration

124

Base Connectivity

124

Prerequisites

127

Common Tunnel Components

127

SIG Credentials

127

IKEv2 and IPSec Configuration

127

Zscaler Location Settings

129

L7 Health Check Configuration

129

Use Case Example 1: Active/Standby Tunnels

130

IPSec Tunnels Defined130

GRE Tunnels Defined

130©2024 Zscaler, Inc. All rights reserved.

6

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Zscaler Tunnel Options

131

Service SIG Interface Pairs HA Pair Configuration

131

Use Case Example 2: Active/Active Tunnels

131

Tunnel Source Loopbacks Defined131

Local Policy Route (for ISAKMP control traffic)

131

IPSec Tunnels Defined132

Zscaler Tunnel Options

133

Service SIG Interface Pairs HA Pair Configuration

133

Traffic Redirection

133

Service SIG Route

133

Service SIG Data Policy (apply to Cisco SD-WAN Controller)

133

Miscellaneous

135

Customize Health Tracker

135

Enable Advanced Zscaler Features

135

Customize Zscaler Tunnel Destinations (Primary and Secondary DCs)

135

Customize Zscaler GRE Tunnel Destinations (Primary and Secondary DCs)

136

Assign Tunnel Weights (Use with Active/Active Tunnels)

136

Appendix D: Cisco vEdge CLI Configuration

137

Base Connectivity

137

Prerequisites

139

Use Case Example 1: Active/Standby Tunnels

139

IPSec Tunnels Defined139

Service SIG Interface Pairs HA Pair Configuration

141

SIG Credentials

141

Traffic Redirection

141

Service SIG Route141

Service SIG Data Policy (apply to Cisco SD-WAN Controller)

141

Miscellaneous
Customize Health Tracker

143
143©2024 Zscaler, Inc. All rights reserved.

7

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Enable Advanced Zscaler Features

143

Customize Zscaler IPSec Tunnel Destinations (Primary and Secondary DCs)

143

Appendix E: Requesting Zscaler Support

144

Appendix F: Document Revision Control

146©2024 Zscaler, Inc. All rights reserved.

8

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Terms and Acronyms
The following table defines acronyms used in this deployment guide. When applicable, a Request for Change (RFC) is
included in the Definition column for your reference.
Acronym
BGP

Definition
Border Gateway Protocol

Cisco SD-WAN Validator

Cisco Catalyst SD-WAN component which facilitates the initial bring-up authentication andauthorization of the network elements. Formerly referred to as vBond.

Cisco SD-WAN Manager

Cisco Catalyst SD-WAN centralized network management system that provides a GUI
interface and REST APIs to monitor, configure, and maintain all Cisco Catalyst SD-WAN
devices in the overlay network. Formerly referred to as vManage.

Cisco SD-WAN Controller Cisco Catalyst SD-WAN centralized control plane and policy engine. Formerly referred to as
vSmart.
DIA

Dedicated Internet Access

DLP

Data Loss Prevention

DPD

Dead Peer Detection (RFC 3706)

DTLS

Datagram Transport Layer Security (RFC6347)

EBGP

External Border Gateway Protocol

ECMP

Equal Cost Multi-Path

EIGRP

Enhanced Interior Gateway Routing Protocol

ESP

Encapsulated Security Payload

GRE

Generic Routing Encapsulation (RFC2890)

IKE

Internet Key Exchange (RFC2409)

INET

Internet Networking

IPS

Intrusion Prevention System

IPSec

Internet Protocol Security (RFC2411)

ISAKMPInternet Security Association and Key Management Protocol

MPLS

Multiprotocol Label Switching

NAT-T

Network Address Translation traversal

NMS

Network Management System

NTP

Network Time Protocol

OMP

Overlay Management Protocol (Cisco SD-WAN)

OSPF

Open Shortest Path FirstPATPort Address Translation

PBR

Policy-based Routing

PFS

Perfect Forward Secrecy

SIG

Secure Internet Gateway

SSH

Secure Shell

SSL

Secure Socket Layer (RFC6101)

TLOC

Transport Locator

TLS

Transport Layer Security (RFC5246)

URI

Uniform Resource Identifier©2024 Zscaler, Inc. All rights reserved.

9

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

AcronymDefinition

VDI

Virtual Desktop Infrastructure

VRF

Virtual Routing and Forwarding

VRRP

Virtual Router Redundancy Protocol

WAN Edge

Cisco SD-WAN router solution

XFF

X-Forwarded-For (RFC7239)

ZIA

Zscaler Internet Access (Zscaler)

ZPA

Zscaler Private Access (Zscaler)©2024 Zscaler, Inc. All rights reserved.

10

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Trademark Notice© 2024 Zscaler, Inc. All rights reserved. Zscaler™ and other trademarks listed at zscaler.com/legal/trademarks are either (i)registered trademarks or service marks or (ii) trademarks or service marks of Zscaler, Inc. in the United States and/or othercountries. Any other trademarks are the properties of their respective owners.

©2024 Zscaler, Inc. All rights reserved.

11

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

About This Document
Zscaler Overview
Zscaler (NASDAQ: ZS), enables the world’s leading organizations to securely transform their networks and applications fora mobile and cloud-first world. Its flagship Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) services create
fast, secure connections between users and applications, regardless of device, location, or network. Zscaler delivers its
services 100% in the cloud and offers the simplicity, enhanced security, and improved user experience that traditional
appliances or hybrid solutions can’t match. Used in more than 185 countries, Zscaler operates a massive, global cloudsecurity platform that protects thousands of enterprises and government agencies from cyberattacks and data loss. To
learn more, see Zscaler’s website.

Cisco Overview
Cisco (NASDAQ: CSCO) helps seize the opportunities of tomorrow by proving that amazing things can happen when you
connect the unconnected. An integral part of Cisco's DNA is creating long-lasting customer partnerships, working together
to identify their customers’ needs and provide solutions that fuel their success.
Cisco has preserved this keen focus on solving business challenges since its founding in 1984. Len Bosack and wife Sandy
Lerner, both working for Stanford University, wanted to email each other from their respective offices, but technologicalshortcomings did not allow such communication. Technology was invented to deal with disparate local area protocols,
and as a result of solving their challenge, the multiprotocol router was born. To learn more, refer to Cisco's website.

Audience
This document is designed for network engineers and network architects interested in configuring and integrating ZIA
access with Cisco WAN Edge routers. It assumes the reader has a basic comprehension of IP networking and is familiar
with Cisco SD-WAN concepts and configurations. For more information, see:• Zscaler Resources• Cisco Resources• Appendix E: Requesting Zscaler Support

Hardware Used
To create this document, Cisco WAN Edge router solutions were tested in various use cases. They include a C8300-1N1S6T, ISR4331, ISR1100-4G (Cisco Viptela), and Cisco vEdge 100b.
Clipboard-list Tech Tip
End-of-Life milestones have been announced for the vEdge router and other select SD-WAN platforms (vEdge 100,vEdge 1000, vEdge 2000, vEdge 5000, select ISR4K, select ASR1K products, and select ISR1K products). To learn more,refer to the Cisco end-of-life announcements page.

©2024 Zscaler, Inc. All rights reserved.

12

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Software Revisions
The following products and software versions are included as part of validation in this deployment guide. This validated
set is not inclusive of all possibilities.
Product/Part Number

Software Version

Zscaler ZIA

6.1

Cisco SD-WAN Manager

20.6.1

Cisco ISR4331

17.6.1a

Cisco C8300-1N1S-6T

17.6.1a

Cisco ISR1100-4G (Cisco Viptela)

20.6.1

Cisco vEdge 100b20.6.1

Cisco 5.1

December 2021 (Updated formatting and edited for style)

Request for Comments• For prospects and customers: Zscaler values reader opinions and experiences. Contact partner-doc-support@
zscaler.com to offer feedback or corrections for this guide.
• For Zscaler employees: Contact z-bd-sa@zscaler.com to reach the team that validated and authored the integrationsin this document.

About the Guide
This document provides technical and configuration guidance for integrating ZIA and Cisco SD-WAN, successfully using
the capabilities provided by Cisco SD-WAN Manager version 20.6, Cisco vEdge version 20.6, and Cisco IOS XE SD-WAN
Edge version 17.6. It includes examples to show how to provision a new service to integrate ZIA and Cisco SD-WAN IPSectunnels. For Cisco SD-WAN, configurations that use feature templates through Cisco SD-WAN Manager and CLI are bothshown. The following Cisco SD-WAN and ZIA use cases are discussed within this document.
Clipboard-list Tech Tip
Cisco SD-WAN has been rebranded to Cisco Catalyst SD-WAN. As part of this rebranding, the vManage name has beenchanged to SD-WAN Manager, the vSmart name has been changed to SD-WAN Controller, and the vBond name has
been changed to SD-WAN Validator. Together, the vManage, vSmart, and vBond are referred to as the SD-WAN control
components or the SD-WAN control complex in this document.
• Single WAN Edge deployments• Active/standby and active/active tunnels• Automatic provisioning of IPSec tunnels• Use of service route or centralized policy for traffic redirection
The Zscaler portion of this document was authored by Zscaler and the Cisco SD-WAN portion of this document was
authored by Cisco. Both companies partnered to review and validate the information in this guide.

©2024 Zscaler, Inc. All rights reserved.

13

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

This document contains four major sections:• The Define section gives background on the Zscaler and Cisco SD-WAN solution.
• The Design section discusses the solution components, design aspects, and any prerequisites.
• The Deploy section provides information about various configurations and best practices.
• The Operate section shows how to manage different aspects of the solution.

Figure 1. Define, Design, Deploy, Operate©2024 Zscaler, Inc. All rights reserved.

14

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Zscaler and Cisco Introduction
Overviews of the Zscaler and Cisco applications are described in this section.
Clipboard-list Note
If you are using this guide to implement a solution at a government agency, some of the content might be different foryour deployment. Efforts are made throughout the guide to note where government agencies might need different
parameters or input. If you have questions, contact your Zscaler Account team.

ZIA Overview
ZIA is a secure internet and web gateway delivered as a service from the cloud. Think of ZIA as a secure internet onramp—just make Zscaler your next hop to the internet via one of the following methods:• Setting up a tunnel (GRE or IPSec) to the closest Zscaler data center (for offices).
• Forwarding traffic via our lightweight Zscaler Client Connector or PAC file (for mobile employees).
No matter where users connect—a coffee shop in Milan, a hotel in Hong Kong, or a VDI instance in South Korea—they get
identical protection. ZIA sits between your users and the internet and inspects every transaction inline across multiple
security techniques (even within SSL).
You get full protection from web and internet threats. The Zscaler cloud platform supports Cloud Firewall, IPS,
Sandboxing, DLP, and Isolation, allowing you to start with the services you need now and activate others as your needs
grow.

ZPA Overview
ZPA is a cloud service that provides secure remote access to internal applications running on a cloud or data center usinga Zero Trust framework. With ZPA, applications are never exposed to the internet, making them completely invisible
to unauthorized users. The service enables the applications to connect to users via inside-out connectivity rather thanextending the network to them.
ZPA provides a simple, secure, and effective way to access internal applications. Access is based on policies created by
the IT administrator within the ZPA Admin Portal and hosted within the Zscaler cloud. On each user device, software
called Zscaler Client Connector is installed. Zscaler Client Connector ensures the user’s device posture and extends a
secure microtunnel out to the Zscaler cloud when a user attempts to access an internal application.

Zscaler Resources
The following table contains links to Zscaler resources based on general topic areas.
Name and Link
ZIA Help Portal

Description
Help articles for ZIA.

ZPA Help Portal

Help articles for ZPA.

Zscaler Tools

Troubleshooting, security and analytics, and browser extensions that help
Zscaler determine your security needs.

ZIA Test Page

Information on your Zscaler cloud.

Zscaler Enforcement Node Ranges

A list of IP ranges to add to your access lists, firewalls, and application
allowlists.

Zscaler Training and Certification

Training designed to help you maximize Zscaler products.

Submit a Zscaler Support Ticket

Zscaler Support portal for submitting requests and issues.

©2024 Zscaler, Inc. All rights reserved.

15

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

The following table contains links to Zscaler resources for government agencies.
Name and Link
ZIA Help Portal

Description
Help articles for ZIA.

ZPA Help Portal

Help articles for ZPA.

Zscaler Tools

Troubleshooting, security and analytics, and browser extensions that help
Zscaler determine your security needs.

ZIA Test Page

Information on your Zscaler cloud.

Zscaler Enforcement Node Ranges

A list of IP ranges to add to your access lists, firewalls, and application
allowlists.

Zscaler Training and Certification

Training designed to help you maximize Zscaler products.

Submit a Zscaler Support Ticket

Zscaler Support portal for submitting requests and issues.

Cisco SD-WAN
Cisco SD-WAN powered by Cisco Viptela and Cisco IOS XE is a highly secure, cloud-scale architecture that is open,
programmable, and scalable. Through the Cisco SD-WAN Manager, you can quickly establish an SD-WAN overlay fabric.
Use it to connect data centers, branches, campuses, and colocation facilities to improve network speed, security, andefficiency.
This document assumes you have the Cisco SD-WAN controllers already built and operational, either through the Cisco
cloud service or on-premises. Zscaler recommends that you use Cisco SD-WAN Manager to configure and manage the
WAN Edge routers.
Make sure that the WAN Edge devices are already connected to the controllers in the SD-WAN overlay, and a basic device
template configuration from Cisco SD-WAN Manager has been deployed on them. See the following:• Appendix A: Cisco Branch Base Feature Templates and Configuration Values Used for base device and featuretemplate configurations.
• Appendix B: Tunnel Configuration Summary (Feature and Device Templates) for a summary of feature templates
required to configure the Zscaler tunnel use cases.
• Appendix C: Cisco IOS XE SD-WAN CLI Configuration and Appendix D: Cisco vEdge CLI Configuration reflect CLIequivalent configurations for Cisco IOS XE SD-WAN and Cisco vEdge, respectively.
This document requires administrator login credentials to Cisco SD-WAN Manager and SSH administrator login credentials
to the WAN Edge routers.

Cisco Resources
The following table contains links to Cisco support resources.
Name and Link

Description

Cisco SD-WAN Design Guide

An overview on the Cisco SD-WAN solution.

Cisco SD-WAN End-to-End
Deployment Guide

Additional information on deploying a Cisco SD-WAN network fromend-to-end.

Cisco EN&C Validated Design and
Deployment Guides

Simple, modular, use-case based design and deployment guidance toprovide you with validated designs and best practices.

Cisco SD-WAN Community Resources

Resource pages and discussion boards.

Cisco Catalyst SD-WAN

Additional Cisco SD-WAN resources.
©2024 Zscaler, Inc. All rights reserved.

16

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Define
The following section explains Cisco SD-WAN concepts.

Cisco Catalyst SD-WAN Design Overview
Enterprises can take advantage of secure local internet breakout by using Cisco Catalyst SD-WAN combined with Zscaler.
Using Cisco Catalyst SD-WAN, the network administrator can decide what traffic is forwarded to Zscaler, using either GRE
or IPSec tunnels.
The following example topology shows a Cisco Catalyst SD-WAN network with two transports (MPLS and internet) andthe SD-WAN control components reachable through the internet cloud. Two branch sites are shown with a data centersite. SD-WAN fabric (IPSec) tunnels are built between each WAN Edge router at each site for corporate traffic. A separate
pair of GRE or IPSec tunnels are built from each branch router to ZIA Public Service Edge for access to internet and SaaS
applications. If the local internet transport fails, traffic can traverse the SD-WAN overlay over the MPLS transport to thedata center and access the internet from there.

Figure 2. Example SD-WAN and ZIA network©2024 Zscaler, Inc. All rights reserved.

17

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Feature Background and History
Clipboard-list Note
Testing was done on 20.9 SD-WAN Manager, 20.9/20.6 vEdge versions, and 17.9 IOS XE SD-WAN versions. To learn more,refer to Cisco Recommended SD-WAN Software Versions for Controllers and WAN Edge Routers for information on
the latest recommended release.
The following sections discuss specifics for different versions of the Cisco SD-WAN software releases.

Support through Cisco Catalyst SD-WAN 20.3/17.3 code versions (Traditional Active/Standby
Tunnels and L7 Health Checking)
Early support for Zscaler tunnels included GRE or IPSec tunnels that are configured manually through Interface VPN
templates in SD-WAN Manager, either in the transport VPN (IPSec or GRE) or service VPN (IPSec). A single active/standby
tunnel pair is supported per WAN Edge router, along with L7 health check probes running between the WAN Edge routerand the respective ZIA Public Service Edge. The active tunnel is typically connected to a primary Public Service Edge while
the standby tunnel is connected to a secondary Public Service Edge. To learn more, refer to the Zscaler Internet Access(ZIA) and Cisco SD-WAN Deployment Guide.
Clipboard-list Note
The recommended way to configure SIG tunnels is through the SIG feature template, supported in Cisco SD-WAN
20.4/17.4 and later code versions.

Cisco Catalyst SD-WAN 20.4/17.4 code versions (Active/Active ECMP Tunnels and Traffic Steering
through SIG Route and Centralized Data Policy using SIG Templates)
The following SIG enhancements were introduced in 20.4/17.4:• A new SD-WAN Manager SIG feature template is introduced where you can configure up to 4 active/backup tunnel
pairs to get the benefit of ECMP load balancing and allow more traffic bandwidth to be redirected to Zscaler. Zscaler
tunnels are configured manually using the SIG feature template and choosing the third-party SIG Provider option.
Only one SIG template is attached per device, and it must be GRE or IPSec, and not a mix of both per device.
• You can assign weights to the tunnels so that more traffic can traverse one tunnel over another if necessary.
• Traffic redirection into the tunnels is accomplished through a new SIG service route, which reduces the administrative
overhead of configuring static routes that require site-specific next-hop IP addresses. The SIG service route tracks thestate of the SIG tunnels, and if all are marked down, the SIG service route is removed from the routing table.
• You can also configure traffic redirection to Zscaler through centralized data policy, giving additional flexibility andgranularity to choose specific application traffic.
Clipboard-list Note
Moving forward, all new features (including SIG route and SIG data policy) leverage the SIG feature template. The SIG
feature template allows you to configure automatic Zscaler and Umbrella tunnels, and manual third-party tunnels.
Tunnel types include IPSec and GRE.

©2024 Zscaler, Inc. All rights reserved.

18

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Cisco Catalyst SD-WAN 20.5/17.5 code versions (Zscaler Automatic IPSec Tunnel Provisioning)
In 20.5/17.5, there were several updates to the SIG feature template, including accommodations for automatic discovery
and tunnel provisioning to the closest Zscaler data centers based on geolocation. Layer 7 health checking is automatedand supported for vEdge WAN Edge routers as well. Only one automatic active/standby Zscaler tunnel pair is supported
in this version.

Cisco Catalyst SD-WAN 20.6/17.6 code versions (L7 Health Checks for IPSec Auto Tunnels for IOS
XE SD-WAN routers and Cloud onRamp for SaaS over SIG Tunnel Support)
In 20.6/17.6, up to four pairs of active/standby IPSec tunnels are supported with automatic provisioning. L7 automatedhealth checking is introduced as an in-product BETA feature for Zscaler IPSec Auto Tunnels for IOS XE SD-WAN routers.
Official support for IOS XE SD-WAN L7 health checking for automatic IPSec Zscaler tunnels is in version 20.6.2/17.6.2. You
can use loopback interfaces as source interfaces for SIG tunnels for IOS XE SD-WAN routers only. Cloud OnRamp for SaaS
over SIG tunnels is also a newly supported feature in this version.

Cisco Catalyst SD-WAN 20.7/17.7 code versions (VRRP Interface Tracker support for SIG Tunnels)
In 20.7/17.7, VRRP tracking for SIG and Tunnel interfaces is supported for IOS-XE SD-WAN routers. If a tunnel that is being
tracked goes down, the VRRP primary WAN Edge router decrements its priority and the backup VRRP router transitions to
the primary role. For vEdge, this feature was introduced in 20.4 in CLI, but SD-WAN Manager feature template support isintroduced in 20.7.

Cisco Catalyst SD-WAN 20.8/17.8 code versions (Multiple SIG Enhancements)
The following SIG enhancements were introduced in 20.8/17.8:• Centralized data policy fallback support: In the event of a SIG tunnel failure, you can take the SD-WAN overlay routes
to avoid traffic blackholing (IOS XE SD-WAN only).
• ECMP based on source IP address: This allows you to direct traffic with the same source IP address to the same SIG
tunnel instead of being potentially hashed to multiple SIG tunnels (IOS XE SD-WAN only).
• IPSec tunnel creation improvements for active/active SIG tunnels: This feature ensures that IPSec control and data
connections are pinned and exit out the same physical interface. You can potentially route DNS traffic for L7 healthchecks out the incorrect interface when using loopback interfaces as the source interface for GRE or IPSec tunnels, so
a configuration workaround is required in this and previous releases (IOS XE SD-WAN only).
• Layer 7 health check for generic (manual) SIG tunnels using the SIG feature template.

Cisco Catalyst SD-WAN 20.9/17.9 code versions (Zscaler Automatic GRE Tunnel Provisioning and
SIG Tunnel Monitoring)
In 20.9/17.9, the following SIG enhancements were introduced:• Automatic provisioning of GRE-based SIG tunnels, which includes support for L7 heath checks, SIG data policy
fallback, multiple active/active tunnels with weighted load-balancing option, and ECMP traffic load balancing basedon Source IP address (IOS XE SD-WAN only).
• SIG tunnel monitoring, which provides enhanced monitoring and visibility for automatic SIG tunnels, which includes
state of the SIG tunnel, and various security event notifications (IOS XE SD-WAN and automatic SIG tunnels only).
• Global SIG credentials template enhancement: With this enhancement, there is no longer a way to create a separate
SIG credentials feature template and a requirement to manually add the SIG credentials template to the device
template under the Additional Templates section. Now, a credentials template is filled out only one time when a SIG
feature template is first created with a specific SIG provider. The credentials template is added automatically to a
device template when the SIG feature template is added.

©2024 Zscaler, Inc. All rights reserved.

19

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

The SIG features and hardware/software support are summarized in the following tables:
FeatureIOS XE SD-WAN
Min Code Version

vEdge Min
Code Version

L7 Health Check Support(IOS XE SD-WAN/vEdge)

IPSec or GRE Manual (3rd party/generic) tunnels
using SIG Feature Templates (Up to 4 active/
standby tunnel pairs with 4-tuple ECMP/weighted
load balancing)

17.4

20.4

17.8/ 20.8*

IPSec Zscaler Auto Tunnels (One active/standby
tunnel pair)

17.5

20.5

N/A/ 20.5

IPSec Zscaler Auto Tunnels (Up to 4 active/standby
tunnel pairs with 4-tuple ECMP/weighted loadbalancing)

17.6

20.6

17.6.2/20.6

GRE Zscaler Auto Tunnels (Up to 4 active/standby
tunnel pairs with 4-tuple ECMP/weighted loadbalancing)

17.9**

N/A

17.9/ N/A

*If you need earlier GRE support requiring L7 health checks, use traditional active/standby tunnels utilizing Interface VPN
templates. Use Auto Tunnels and SIG feature templates whenever possible.
**Caveat: GRE auto tunnel loopback as a source interface tunnel is not supported until 17.9.2.
FeatureIOS XE SD-WAN Min
Code Version

vEdge Min Code Version

Fallback Routing Support (IOS XE
SD-WAN/vEdge)

SIG Route

17.4

20.4

17.4/ 20.4

SIG Data Policy

17.4

20.4

17.8/ N/A*

*Without Fallback Routing support for SIG data policy, SIG traffic can blackhole if the SIG tunnels are down. In earlier code
versions, rely on the SIG route for SIG traffic if possible, so SIG traffic falls back to routing when the SIG tunnels are down.
FeatureIOS XE SD-WAN Min Code Version

vEdge Min Code Version

Cloud OnRamp for SaaS via SIG Tunnel

17.6

20.6

VRRP Interface Tracker Support for SIG Tunnels

17.7

20.7 (20.4 in CLI)

SIG ECMP based on Source IP address

17.8 (CLI add-on template)

N/A

SIG Tunnel Monitoring

17.9

N/A

Global SIG Credentials Template Enhancement

17.9

20.9

©2024 Zscaler, Inc. All rights reserved.

20

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

DesignThe following sections describe the architecture behind Cisco SD-WAN deployments.
There are several points to consider when designing for Cisco Catalyst SD-WAN and Zscaler integration. It is also
important to understand what features are supported in any code version, as this can affect the SIG configuration anddesign.
• What tunnel protocol do you use? IPSec or GRE? Are there any design restrictions related to the tunnel protocol type?
• What tunnel liveliness methods are available? Do tunnels support L7 health checking?
• What is the ECMP routing behavior for multiple, active tunnels?
• Where are your primary vs secondary Zscaler data centers located?
• What are the high availability and load balancing options?
• What method do you use to redirect traffic from service-side VPN to the SIG tunnel? Is a fallback method supported?
• Are you using single Edge or dual Edges?
• Are you using automatic or manual tunnels?
The following topics address these considerations.

GRE and IPSec Tunnels
Zscaler supports both GRE and IPSec tunnels from Edge devices to transport internet traffic that first traverses the ZIA
Public Service Edge.
Clipboard-list Note
An active IPSec tunnel is defined by a unique 4-tuple of source IP address/interface, source port, destination IP
address, and destination port pair. Multiple IPSec tunnels can exist that reference the same source or destination
IP address, but each tunnel must have a unique 4-tuple for the tunnel to be up and operational. IPSec tunnels are
dynamically added on the Zscaler side, so their source IP addresses and source ports can change.
GRE tunnels do not have source or destination ports and are statically mapped using source IP address via API or
manual configuration on the Zscaler side, meaning that multiple GRE tunnels cannot be sourced from the same IP
address. Also, since they are mapped manually, their source IP addresses cannot change when mapped.

Packet Format and NAT
GRE is neither TCP nor UDP but has its own protocol number (47). Because GRE is a protocol without source or destination
ports, GRE packets can't be translated by Port Address Translation (PAT) devices. You can translate the source IP addressof a GRE packet with Network Address Translation (NAT) with no overload, which includes static or dynamic NAT, where asingle IP address is mapped only to a single publicly routable IP address. This is because no ports must be mapped.

Figure 3. GRE packet encapsulation©2024 Zscaler, Inc. All rights reserved.

21

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

An IPSec packet uses ESP—also a protocol without ports and unusable by PAT devices. IPSec traffic can use NAT-T totransport packets. If both ends of the IPSec connection support NAT-T, then Nat-Discovery packets are exchanged during
the ISAKMP exchange. If NAT is detected, then ISAKMP packets change from UDP port 500 to UDP port 4500. ESP data
packets are encapsulated inside a UDP packet with source and destination ports equal to 4500. Now you can translate
the packet by a PAT device.

Figure 4. IPSec packet encapsulation (Tunnel Mode)

Throughput
Zscaler GRE tunnels support higher throughput than IPSec tunnels in the Zscaler cloud. IPSec tunnels can support 400
Mbps each while GRE tunnels can support 1 Gbps each. Contact your Zscaler Account team for more information on
bandwidth support. Bandwidth support can vary depending on the Zscaler cloud and ZIA Public Service Edge you areconnecting to.

Tunnel Source IP Addressing
Zscaler GRE tunnels require a source IP address on the WAN Edge router that is a separate, unique IP public address
per destination that is constant or static. This source IP address is registered on the ZIA through APIs and is used asauthentication for the GRE tunnel. Zscaler IPSec tunnels are either static or dynamic addressing and is not required tohave a separate, unique IP public address (as long as the source port varies per tunnel destination). IKEv2 is used for IPSectunnel authentication to ZIA.
Clipboard-list Tech Tip
GRE tunnels are not influenced by NAT defined on the interface of a WAN Edge router; their source IP address remains
unchanged as it transits the WAN Edge router. GRE tunnels must be either directly sourced by a public IP address or
be subjected to a One-to-One NAT translation by an external device. Source IP address for IPSec tunnels, on the other
hand, are subjected to NAT defined on the interface of a WAN Edge router as traffic transits.

©2024 Zscaler, Inc. All rights reserved.

22

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Tunnel Liveliness
GRE Keepalives and DPD
GRE Keepalives for GRE tunnels and DPD for IPSec tunnels are traditional methods for a local router to determine whether
the remote router at the end of a tunnel is reachable and able to forward traffic. Zscaler best practices advises that you
send GRE Keepalives and DPD packets no more than once every ten (10) seconds.
Clipboard-list Tech Tip
If the router sits behind any NAT device, GRE keepalives are not passed. If the router is behind a NAT device, Zscaler
recommends that you disable GRE keepalives by setting the interval and retries to zero (0). GRE data packets can’t betranslated by PAT devices, but can be translated through a NAT device. NAT devices have only one IP address mapped
to one publicly routable IP address because port mapping isn’t required.
Cisco IOS XE SD-WAN routers do not support GRE keepalives through feature templates, only Cisco vEdge routers do.
For Cisco IOS XE SD-WAN routers, you can configure GRE keepalives through the CLI or CLI add-on feature templates.
Cisco vEdge routers currently support only periodic DPD. On-demand DPD is currently the default for Cisco IOS XE SDWAN routers.

Layer 7 Health Checks
GRE Keepalives and DPD can validate whether the network path is up between the tunnel source and destination, but
the mechanisms cannot verify whether a particular service or application is up and operational beyond the tunnel and
ZIA Public Service Edge.
An L7 health check monitors latency and reachability based on HTTP request and response probes to a URL that isreachable through the Zscaler tunnels, and allows you to fail over to an alternate tunnel when reachability fails or latency
degrades beyond an acceptable threshold.
To check the health of the application stack of the ZIA Public Service Edge, Zscaler recommends not performing L7
health checks to commonly visited websites. Instead, use the following non-public URL for the tracker. It is only reachable
through a Zscaler tunnel: http://gateway.<Zscaler Cloud Name>.net/vpntest. Do not send L7 health checks
more than once every 5 seconds.

ECMP Routing
The following sections explain ECMP routing.

4-Tuple ECMPIn the presence of multiple, equal-cost active paths, traffic is normally routed to an interface based on the hashing of
the IP flow 4-tuple (source IP address + destination IP address + source port + destination port). Because it is based on ahash, the traffic distribution might not be exactly equal across the tunnels but with enough variability in IP addressing andports in the network traffic, traffic distribution is more evenly distributed across the ECMP interfaces.

Figure 5. 4-Tuple ECMP routing©2024 Zscaler, Inc. All rights reserved.

23

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

There are several applications that are known to fork off multiple sessions for a single user session (Microsoft 365, Google
Services, Facebook, etc.). If you have two active SIG tunnels that are pinned to two different Zscaler data centers, ECMP
could pin flows from a single user to separate tunnels. The cloud application could see different client IP addresses for thesame session, since NAT is applied to their source IP addresses from two different data centers, and thus, session resets
from the server could occur.

Figure 6. Single user session hashing to multiple data centers using 4-tuple ECMP

Clipboard-list Note
Be careful when designing using multiple active/active or active/standby links with 4-tuple hashed ECMP (default
setting). Especially in the case of routed dual-Edge sites, you must be careful that hashed sessions for the same user are
not distributed over multiple links going to different Zscaler data centers. You must also consider how traffic is hashedduring failure scenarios as well.
There might be cases where there are active/active tunnels going to the same Zscaler data center and users could be
experiencing application performance issues due to a single user session taking multiple, equal-cost paths if tunnels
are experiencing varying levels of latency or loss. In these cases, you could ensure that users are not being hashed todifferent Edge devices or different transports.

Source IP-Based ECMPStarting in 20.8/17.8, you can configure ECMP to hash according to source IP rather than a 4-tuple. This would allow you to
direct traffic with the same source IP address to the same SIG tunnel instead of being potentially hashed to multiple SIG
tunnels. Note that this is supported only by IOS XE SD-WAN routers. It is enabled with the command ip cef loadsharing algorithm src-only through an add-on CLI template. This gives you more design flexibility in configuring
your tunnel destinations and setting up active/standby pairs.

Figure 7. Source IP-based ECMP routing

Clipboard-list Note
In Edge versions prior to 17.12, you can figure source IP-based ECMP only when the WAN Edge router is in CLI mode.
If you try to use an add-on CLI template, the ECMP configuration returns to the default, which is 4-tuple. This affects
hardware-based IOS XE SD-WAN routers and is fixed in 17.12.

©2024 Zscaler, Inc. All rights reserved.

24

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Primary vs. Secondary Data Center Placement
The primary Zscaler data center (DC) is typically chosen to be the closest data center to your remote site and used foryour active tunnels. The secondary data center is typically chosen as the next closest data center to your remote site andused for your standby tunnels.
It is not recommended to design active/active tunnels going to multiple data centers, even if you make use out of source
IP-based ECMP. Latency/performance could vary from user to user depending on which tunnels are taken to Zscaler.

Figure 8. Active/Standby Zscaler tunnels going to Primary/Secondary DCs©2024 Zscaler, Inc. All rights reserved.

25

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Zscaler Active/Standby Tunnel Combinations
The following shows examples of different active/standby tunnel combinations to ZIA over dual internet and hybrid
deployments (MPLS and internet). The deployed tunnels are either GRE or IPSec, and cannot be a combination of both.
Up to four active/standby pairs are supported. Route or policy directs traffic out the active tunnels to Zscaler. Standby
tunnels are fully up and operational. However, traffic isn’t forwarded over these standby tunnels until their corresponding
active tunnel pair partner is marked down or exceeds the latency threshold of the L7 health checks.

One Active/Standby Tunnel Pair
The following diagram shows an example of one active and one standby tunnel deployment at sites with single anddual internet circuits. In hybrid deployments, an MPLS path might offer a backhauled path to the internet via an internet
gateway at a data center or regional hub site. In either deployment, if the ZIA Public Service Edge or active tunnel
becomes unreachable or exceeds the latency threshold (with L7 health checks enabled), then the standby tunnel isactivated. In the hybrid deployment, if the internet networking (INET) transport goes down, or if both tunnels over the
INET transport exceed the latency thresholds (with L7 health checks enabled), then traffic can still take the default route
over the SD-WAN overlay over the MPLS transport to the data center. Traffic can access the internet, either through an onpremises security stack or via a separate SIG tunnel originating from the data center hub router.

Figure 9. Active/Standby tunnel deployment on dual INET and hybrid transports©2024 Zscaler, Inc. All rights reserved.

26

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Multiple Active/Active Tunnels with ECMP
Increased cloud traffic and bandwidth limits on Zscaler tunnels require support for multiple active tunnels.
The following diagram shows an example of an active/active tunnel deployment at sites with single and dual internet
circuits. In either deployment, if an active tunnel becomes unreachable or exceeds the latency threshold (with L7 healthchecks enabled), then traffic is rehashed to one of the remaining tunnels. In the hybrid deployment, if the INET transport
goes down, or if all tunnels over the INET transport exceed the latency thresholds (with L7 health checks enabled), thentraffic can still take the default route over the SD-WAN overlay over the MPLS transport to the data center. Traffic canaccess the internet through an on-premises security stack or via a separate SIG tunnel originating from the data center
hub router. In either deployment, if the ZIA Public Service Edge becomes unreachable, traffic can fall back to the data
center over the SD-WAN overlay.

Figure 10. Multiple Active/Active tunnels on dual INET and hybrid transports©2024 Zscaler, Inc. All rights reserved.

27

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Multiple Active/Standby Tunnel Pairs
The following diagram shows an example of a multiple active/standby tunnel pair deployment at sites with dual internet
and hybrid circuits. In either deployment, if an active tunnel becomes unreachable or exceeds the latency threshold(with L7 health checks enabled), then its corresponding standby tunnel is activated. In the hybrid deployment, if the
INET transport goes down or if all tunnels over the INET transport exceed the latency thresholds (with L7 health checks
enabled), then traffic can still take the default route over the SD-WAN overlay over the MPLS transport to the data center.
Traffic can access the internet through an on-premises security stack or via a separate SIG tunnel originating from the data
center hub router. In either deployment, if the ZIA Public Service Edge becomes unreachable, traffic can fall back to thedata center over the SD-WAN overlay.
Clipboard-list Note
In this scenario, 4-tuple ECMP is being used which is why the standby tunnels are going to the same DC as the active
tunnels. You do not want a single user session to go to two different DCs if one of the standby links were to go active.
Starting in 20.8/17.8 code, you can configure source IP-based ECMP, and use a secondary DC for the standby tunnels
instead.

Figure 11. Multiple Active/Standby tunnel pairs©2024 Zscaler, Inc. All rights reserved.

28

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Active/Active Tunnels with Weighted Load Balancing
The following diagram shows an example of an active/active tunnel deployment spread across two internet transports.
Available bandwidth might differ between the transports so you can assign weights to each tunnel and different traffic
bandwidth amounts traverse each transport. In this example, weights are configured for each tunnel so that 80% of thetraffic traverses INET A, while 20% of the traffic traverses the INET B. If an active tunnel becomes unreachable or exceeds
the latency threshold (with L7 health checks enabled), then traffic is rehashed to one of the remaining tunnels.

Figure 12. Active/Active weighted tunnel deployment on two internet transports

User Traffic Redirection
After the GRE or IPSec tunnels are configured and activated, there are two ways to direct user traffic to the tunnel:• With a static route to rely on destination-based routing (typically a default route where all internet-bound traffic issent). 20.4/17.4 code version introduces a new type of route for Zscaler or other third-party tunnels called a Service
Route, which has a next hop that points to the SIG service.
• With a centralized data policy that allows you to customize the traffic sent to the Zscaler service. 20.4/17.4 supports
centralized policy for both Cisco vEdge and Cisco IOS XE SD-WAN devices where you can rely on prefix-lists andapplications lists to direct desired traffic to the SIG service.

Clipboard-list Tech Tip
If both service routes and centralized policy are configured to direct user traffic, centralized policy takes precedence.
You might want to configure both a SIG service route and policy in dual-edge branches with Layer 3 routing. The SIG
service route is redistributed into a routing protocol at the local site. If the SIG tunnels become unreachable on anedge router, the route is withdrawn so traffic is directed to the opposite edge with active SIG tunnels. After traffic
reaches the edge router with active SIG tunnels, centralized policy (or service route) is used to direct traffic to the SIG
tunnel.
Fallback routing was not introduced for centralized policy until 20.8/17.8 for Cisco IOS XE SD-WAN only. Without
fallback routing, traffic can blackhole when the SIG tunnel becomes unavailable. Use a SIG service route for SIG
traffic instead as a workaround.

©2024 Zscaler, Inc. All rights reserved.

29

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Service VPNs
The Zscaler tunnel using SIG feature templates originates from the transport side, but multiple service-side VPNs can use
this tunnel to send traffic to Zscaler. Each service-side VPN uses a SIG route or data policy (or both) to direct traffic to
the Zscaler tunnel. VRF segmentation is not extended to Zscaler, so the WAN Edge keeps a table to handle return traffic
coming from Zscaler and sends it back to the correct service VPN. This means there is no support for overlapping IP
subnets in service VPNs on a single WAN Edge that uses the same Zscaler tunnels.

Figure 13. Service-side VPNs

WAN Edge with Zscaler Site Tunnel Design
This section covers the various aspects of single WAN Edge and dual WAN Edge site designs with Zscaler integration. Each
WAN Edge router supports up to 4 active/standby tunnel pairs. For multiple active/standby tunnel pairs, consider using IP
source-based ECMP for load-balancing traffic.
Clipboard-list Note
The source IP address of an IPSec tunnel is subjected to NAT/PAT defined on the WAN Edge interface, while the source
IP address of a GRE tunnel is not. The source IP address of a GRE tunnel will pass unchanged. Note that NAT must still
be defined on each physical interface where Zscaler tunnels are sourced for both GRE and IPSec tunnels so API calls
can succeed.
In addition, if an external device is used to NAT the source IP address of a tunnel, IPSec tunnels can use dynamic NAT/
PAT, while GRE tunnels each must use unique One-to-One NAT addressing.

©2024 Zscaler, Inc. All rights reserved.

30

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Single WAN Edge Design
This section shows a few examples of single WAN Edge designs with Zscaler integration.
Hybrid transport with 1 active/standby tunnel:• IPSec: The tunnel source for both the active and standby tunnels is the INET A physical interface, which can bea publicly routable or a private IP address. If it is a private address, NAT/PAT is required by an external device totranslate the tunnel source IP address into a publicly routable IP address.
• GRE: The tunnel source for both the active and standby tunnels is the INET A physical interface, which can be apublicly routable or a private IP address. If it is a private address, One-to-One NAT is required by an external device
to translate the tunnel source IP address into a publicly routable IP address.

Figure 14. Single WAN Edge, Hybrid Transport, one Active/Standby Zscaler Tunnel©2024 Zscaler, Inc. All rights reserved.

31

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Hybrid transport with multiple active/standby tunnels:• IPSec: The tunnel source is a loopback interface for each active/standby pair. You can privately address the loopback
interfaces. If the INET A interface is privately addressed, NAT/PAT on an external device is needed to make the tunnelsource IP addresses publicly routable.
• GRE: The tunnel source is a loopback interface for each active/standby pair. You can address the loopback interfaces
either publicly or privately. If private addressing is used, you must translate each tunnel source IP address to a unique
one-to-one publicly-routable address by an external device.
Clipboard-list Note
With this design, a CLI add-on template for router local policy is required for successful L7 health checking for IOS XE
SD-WAN routers. Also, there is no support for loopback interfaces as tunnel sources with the vEdge platform.

Figure 15. Single WAN Edge, Hybrid Transport, Multiple Active/Standby Zscaler tunnels©2024 Zscaler, Inc. All rights reserved.

32

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Dual-Internet transport with 1 active/standby tunnel per transport:• IPSec: The tunnel source for the active/standby tunnel pair over INET A is the INET A physical interface, and for theactive/standby tunnel pair over INET B is the INET B physical interface. You can use a publicly routable or a private
IP address for the tunnel source IP address. If it is a private address, NAT/PAT is required by an external device totranslate the tunnel source IP address into a publicly routable IP address.
• GRE: The tunnel source for the active/standby tunnel pair over INET A is the INET A physical interface, and for theactive/standby tunnel pair over INET B is the INET B physical interface. You can use a publicly routable or a private IP
address for the tunnel source IP address. If it is a private address, One-to-One NAT is required by an external device
to translate the tunnel source IP address into a unique, publicly routable IP address.

Figure 16. Single WAN Edge, Dual-Internet Transport, one Active/Standby tunnel per transport©2024 Zscaler, Inc. All rights reserved.

33

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Dual WAN Edge Design
This section shows a few examples of dual WAN Edge designs with Zscaler integration. The dual routers use VRRP or
routing on the service side.
Hybrid transport with 1 active/standby tunnel per WAN Edge:• IPSec: The tunnel source for the active/standby tunnel pair on both WAN Edge routers is the INET A physical interface,which for the B-side router, is on the TLOC extension link between the routers. You can use a publicly routable or a
private IP address for the tunnel source IP address. The B-side router’s tunnel source IP address is subjected to NAT/
PAT on router A’s INET A interface. If router A’s INET A interface is a private address, NAT/PAT is required by an external
device to translate the tunnel source IP address into a publicly routable IP address.
• GRE: The tunnel source for the active/standby tunnel pair on both WAN Edge routers is the INET A physical interface,which for the B-side router, is on the TLOC extension link between routers. You can use a publicly routable or a
private IP address for the tunnel source IP address. The B-side router’s tunnel source IP address is not subjected to
NAT on router A’s INET A interface and will stay unchanged. If either tunnel source is a private address, a One-to-One
NAT is required by an external device to translate each tunnel source IP address into a unique, publicly routable IP
address.

Figure 17. Dual WAN Edge, Hybrid Transport, one Active/Standby tunnel per WAN Edge

©2024 Zscaler, Inc. All rights reserved.

34

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Dual-Internet transport with 1 active/standby tunnel per WAN Edge:• IPSec: The tunnel source for the active/standby tunnel pair on WAN Edge A is the INET A physical interface, and for
WAN Edge B, it is the INET B physical interface. You can use a publicly routable or a private IP address for the tunnelsource IP address. If either INET A or INET B interface has a private address, NAT/PAT is required by an external device
to translate the tunnel source IP address into a publicly routable IP address.
• GRE: The tunnel source for the active/standby tunnel pair on WAN Edge A is the INET A physical interface, and for
WAN Edge B, it is the INET B physical interface. You can use a publicly routable or a private IP address for the tunnelsource IP address. If either tunnel source is a private address, a One-to-One NAT is required by an external device totranslate the tunnel source IP address into a unique, publicly routable IP address.

Figure 18. Dual WAN Edge, Dual Internet, one Active/Standby tunnel per WAN Edge

©2024 Zscaler, Inc. All rights reserved.

35

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Dual-Internet transport with 2 active/standby tunnels per WAN Edge:• IPSec: The tunnel source for the active/standby tunnel pair on both WAN Edge routers is each INET physical interface.
You can use a publicly routable or a private IP address for the tunnel source IP address. The B-side router’s INET A
tunnel source IP address is subjected to NAT/PAT on router A’s INET A interface, and the A-side router’s INET B tunnelsource IP address is subjected to NAT/PAT on router B’s INET B interface. If the INET interfaces connecting directly tothe transports are privately addressed, NAT/PAT is required by an external device to translate each tunnel source IP
address into a publicly routable IP address.
• GRE: The tunnel source for the active/standby tunnel pair on both WAN Edge routers is each INET physical interface.
You can use a publicly routable or a private IP address for the tunnel source IP address. The B-side router’s INET A
tunnel source IP address is not subjected to NAT on router A’s INET A interface, and the A-side router’s INET B tunnelsource IP address is not subjected to NAT on router B’s INET B interface—each GRE tunnel bypasses NAT. If any tunnelsource is a private address, a One-to-One NAT is required by an external device to translate each tunnel source IP
address into a unique, publicly routable IP address.

Figure 19. Dual WAN Edge, Dual Internet, two Active/Standby tunnels per WAN Edge

©2024 Zscaler, Inc. All rights reserved.

36

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Dual WAN Edge with Zscaler Site Service-Side Design
For dual-router sites, you can achieve redundancy on the service-side VPNs with VRRP (layer 2) or routing (layer 3). When
you are doing fallback routing with a SIG route or SIG data policy, you must be careful when you have a DIA NAT routepresent. If the SIG tunnel becomes inactive and traffic is subjected to fallback routing, traffic can take the DIA NAT default
route (preferred over the default route from the overlay), and that might be undesirable.

VRRP
With VRRP, one WAN Edge router is declared primary and the other one standby on a per-VPN basis. The primary routerforwards Zscaler traffic to Zscaler tunnels directly connected to the WAN Edge router, either through a SIG route or
through centralized data policy. Use a different VRRP primary per VPN to utilize the Zscaler tunnels of both WAN Edgerouters.
• VRRP interface tracker: Starting in 20.7/17.7, you can track and bind the SIG tunnel to the VRRP protocol. If the tunnel
goes down, the VRRP primary decrements its priority and the backup router takes over the primary role.
• TLOC change preference: Starting in 20.7/17.7, the TLOC preference of the VRRP primary router gets increased by aconfigured value to avoid asymmetric traffic from other SD-WAN sites by ensuring traffic from across the overlay(WAN to LAN) is sent to the VRRP primary router. LAN to WAN traffic already uses the primary VRRP router as thedefault gateway.

RoutingWith routing, be careful with the ECMP route hashing, as a single user session could be split between SD-WAN routers,
each with their own active tunnels, which could have performance implications. You can set up routing metrics so that
there is a primary/secondary router per VRF. Even if you are using data policy for SIG traffic forwarding, you can utilize the
SIG route to advertise a default into the service-side routing protocol. Be careful with redistributing the SIG default route,the NAT DIA default route, and the overlay default route (default route that comes from another site through the SD-WAN
overlay) into the service-side routing protocol at the same time—the default metric behavior of each varies depending on
the routing protocol. The following is a summary of the behavior in this code version.
Baseline
The following shows the admin distance and metric for each default route type installed in the service VPN of the WAN
Edge router. The SIG route is preferred with an admin distance of 2.
Default Route

Route Type

Admin Distance/Metric

SIG route (0.0.0.0/0)*

S (Static)[2/65535]

NAT DIA route (0.0.0.0/0)

Nd (NAT DIA)

[6/0]

Overlay default route (0.0.0.0/0)m (OMP)[251/0]

OSPF
In order to inject a default route into OSPF, you must use the default-originate option in the OSPF protocol. By default,
the route appears in the next-hop router as an E2 route with an admin distance of 110 and a metric of 1, regardless ofwhich route is installed in the routing table on the WAN Edge router. For example:
O*E2 0.0.0.0/0 [110/1] via 10.219.100.6, 00:00:22, GigabitEthernet2/0/1©2024 Zscaler, Inc. All rights reserved.

37

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

BGP
To inject the different default routes into EBGP on the service side, you must redistribute each protocol in the BGP featuretemplate and include the default-originate configuration in BGP as well.
Use redistribute omp for the OMP default route, use redistribute nat for the DIA NAT route, and use
redistribute static for the SIG route. By default, the following BGP routes with these default metrics are generated
in this lab topology, with the NAT DIA route being preferred with a metric of 0.
Default Route

Route Type and Admin Distance/Metric

SIG route (0.0.0.0/0)

B*

0.0.0.0/0 [20/65535]

NAT DIA route (0.0.0.0/0)*

B*

0.0.0.0/0 [20/0]

Overlay default route (0.0.0.0/0)

B*

0.0.0.0/0 [20/1000]

To change the metrics to prefer the SIG route, define a router policy for each redistribution statement in the BGP featuretemplate that needs a metric modified and add them to the localized policy attached to the WAN Edge router.
EIGRP
To inject the different default routes into EIGRP on the service side, you must redistribute each protocol in the EIGRP
feature template.
Use redistribute omp for the OMP default route, use redistribute nat-route for the DIA NAT route, and use
redistribute static for the SIG route. By default, the following External EIGRP routes with these default metrics are
generated in this lab topology, with both the NAT DIA route and the OMP route being preferred with a metric of 5120.
Default Route

Route Type and Admin Distance/Metric

SIG route (0.0.0.0/0)

D*EX 0.0.0.0/0 [170/76805120]

NAT DIA route (0.0.0.0/0)*

D*EX 0.0.0.0/0 [170/5120]

Overlay default route (0.0.0.0/0)*

D*EX 0.0.0.0/0 [170/5120]

To change the metrics to prefer the SIG route, use a CLI add-on template to define the EIGRP metric associated with eachredistribute statement. For example, the following assigns the best metric to the SIG default route, the second-best metricto the NAT DIA default route, and the third best metric to the OMP default route metric.
router eigrp eigrp-name!
address-family ipv4 unicast vrf 1 autonomous-system 100!
topology baseredistribute static metric 1000000000 0 255 1 1500
redistribute nat-route dia metric 1000000 100 255 1 1500
redistribute omp metric 100000 1000 255 1 1500

©2024 Zscaler, Inc. All rights reserved.

38

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

SIG Service
Starting in 20.4/17.4, Zscaler tunnels can make use of the SIG service construct that was introduced in Cisco SD-WAN
Manager for integration with Cisco Umbrella SIG. The SIG service keeps track of the state and next hop of the tunnels,in addition to redirecting traffic into the tunnels from the service VPN. Traffic redirection at the branch is implemented
locally through service routing (defined in the service VPN feature templates) or as a centralized data policy action.

Figure 20. SIG service logical representation©2024 Zscaler, Inc. All rights reserved.

39

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

New SIG Workflow
Starting in 20.4/17.4, a new unified SIG workflow is introduced with the SIG feature template, which greatly simplifies
the SIG tunnel configuration process regardless of the tunnel type (Umbrella, Zscaler, other third-party IPSec or GRE
tunnels). Only one SIG template is needed to configure multiple tunnels and is attached to the device template under
the transport VPN. A configuration is introduced in IOS XE SD-WAN which allows multiple service VPNs to use the tunnel
created with the SIG template (tunnel VRF multiplexing).
Clipboard-list Tech Tip
Only one SIG template is allowed per device template.
In SD-WAN Manager version 20.9, the SIG template is divided into several sections:
1. Device Type, Template Name, Description, and SIG Provider (Umbrella, Zscaler, or Generic).
2. Tracker: Allows you to configure custom L7 health check tracker information.
3. Configuration: Allows you to specify different tunnel type (IPSec or GRE) and other tunnel characteristics, such as
tunnel name, tracker name, tunnel source, whether the tunnel is attached to a primary or secondary data center(which is specified or discovered later) and advanced options, like IP MTU and other tunnel settings.
4. High Availability: Allows you to choose up to 4 active tunnels or 4 active/standby tunnel pairs by choosing thetunnels defined in the Configuration section under the Active or Backup column. You can also modify traffic ratios
for the tunnels.
5. Advanced Settings (if applicable): Allows you to define Zscaler primary or secondary data centers and Zscaler
location name if desired, and advanced Zscaler settings (XFF Forwarding, Enable IPS Control, etc).

Figure 21. SIG template configuration and High Availability sections

Clipboard-list Tech Tip
In 20.4/17.4, the only two tunnel types that are offered are Umbrella and Third Party. You can configure Zscaler manual
tunnels (IPSec or GRE) using the Third Party option. Starting in 20.5/17.5, the three tunnel types that are offered are
Umbrella, Zscaler, and Generic. To configure automatic IPSec or GRE Zscaler tunnels, choose the Zscaler option. You
can configure Zscaler manual tunnels (IPSec or GRE) using the Generic option. Zscaler recommends you use automatic
tunnels if available.

©2024 Zscaler, Inc. All rights reserved.

40

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Automatic Zscaler Tunnels
Automatic Zscaler Tunnels are supported for IPSec and GRE tunnels. The feature provides a level of automation in
configuring tunnels, such as automatic tunnel destination discovery, location registration in ZIA, automatic configurationof authentication parameters, and automatic configuration of L7 health checks. The feature gives you secure andsimplified management and allows you to deploy Zscaler tunnels across a large number of branches.
Clipboard-list NotevEdge does not support GRE automated tunnels, only manual ones.

IPSec
1. Automatic Zscaler IPSec tunnels are introduced in 20.5/17.5. After automatic tunnels (through the SIG featuretemplate) and the SIG credentials feature template are added to the device template and are pushed to the WAN
Edge device, the following API steps occur from the WAN Edge router to provision the IPSec tunnels.
2. An authenticated session request is made to the ZIA by sending an API key, username, password, and timestamp.
The requestor receives a cookie from Zscaler, which is then used in subsequent calls as part of the authenticatedsession.
3. VPN credentials are added for each tunnel. Each tunnel has a unique name, FQDN, and pre-shared security key thatis generated by the WAN Edge device and then shared to the Zscaler cloud. Zscaler returns a tunnel ID associatedwith each tunnel. For future edits and modifications, the WAN device refers to the tunnel ID.
4. Next, the VPN credential associated with the tunnel is added to a location before it is usable by Zscaler policy. If it is
the first tunnel for a WAN Edge device, create a location with a unique location name and add it to ZIA via an HTTP
POST. The tunnel VPN credentials are added to the location.
5. A final API activates the configuration changes made in ZIA.
6. Primary and secondary data centers are retrieved from ZIA.
Another sequence of API calls happens when a tunnel is deleted. API HTTP responses are received and the last response
code is recorded for troubleshooting purposes. After the APIs are completed, you get a non-zero location ID and nonzero tunnel IDs. Whether the tunnel comes up and active depends on the Internet Key Exchange (IKE) negotiation. See
the Operate section for more information on troubleshooting.

Figure 22. Advanced Settings for Zscaler Auto Tunnels©2024 Zscaler, Inc. All rights reserved.

41

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Advanced Settings for Zscaler Auto Tunnels
You can enable the following Zscaler advanced features from the SD-WAN SIG feature template:• Primary Data-Center/Secondary Data-Center: By default, the primary and secondary data centers are automaticallyselected. Alternatively, you can manually choose the data centers. If a Global variable is selected, you can choose
from a drop-down menu of data centers. Before 20.9 code, this list of data centers might be static and theinformation not completely current. If you choose device specific input, an FQDN is required for the variable for
an IPSec tunnel, and a destination IP address is required for the variable for a GRE tunnel. For the latest list of data
centers, go to https://config.zscaler.com (then choose the cloud name from the drop-down menu).
• Zscaler Location Name
• Authentication Required: If enabled, you can enable the Surrogate IP feature with its corresponding parameters• XFF Forwarding• Enable Firewall• Enable IPS Control• Enable Caution• Enable AUP and additional AUP parameters
For additional information on these advanced location features, see Configuring Locations (government agencies, see
Configuring Locations).

Figure 23. SIG feature template Advanced Settings©2024 Zscaler, Inc. All rights reserved.

42

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Layer 7 Health Check for Auto Tunnels
L7 health checks are enabled by default on all auto-tunnels provisioned with the Secure-Internet-Gateway templates.
The L7 health check is implemented as an HTTP request. It measures route-trip latency and compares it to the thresholdset. Customize the tracker if you want to change the default parameters or use a different service URL. The default settingsare:• Interval: 30 seconds• Multiplier: 2• Threshold: 1000 msec
• Service URL for Zscaler tunnel, enter: http://gateway.<Zscaler Cloud Name>.net/vpntest
For Cisco IOS XE SD-WAN, a Loopback 65530 interface in VRF 65530 is created and used to source the L7 health checkprobes through each active and backup tunnel. You must configure a tracker source IP address, which is a private RFC 1918
address that should not overlap with other interfaces.
For Cisco vEdge, a loopback 65530 in VPN 65530 is created by default, sourced from 192.168.0.2/32. There is no need toconfigure a tracker source IP address for Cisco vEdge.
For any tunnels that fail to receive a response within the interval and retransmit timers, or for any tunnels that exceed thelatency threshold, the tunnel tracker status is marked down and the VPN routes pointing to this tunnel is marked standby.
Crypto IKE stays up for the IPSec tunnel and tunnel status also stays up for the GRE tunnel, but the routes are withdrawn.
When the tracker status goes Up (probes become reachable again or latency improves below the threshold), the tunnel
can become active again and the VPN routes can be added back.

General Configuration StepsMultiple automatic Zscaler tunnels are implemented by:• Creating a SIG Credentials feature template for API access to Zscaler. (In 20.9 and above, this is done after creating thefirst Zscaler SIG feature template; you are prompted with a link to configure the SIG credentials feature template.)• Creating a SIG feature template to define the tracker information, tunnel types, parameters, advanced settings, andhigh availability information.
• Adding the SIG template and SIG Credentials feature template to the transport VPN (VPN 0) in a device template.
• Adding a SIG Service route in the service VPN or adding centralized data policy to redirect user traffic to the SIG
service.

Configuration Prerequisites
For Zscaler automatic tunnels to succeed, observe the following prerequisites:• Configure ZIA Admin Portal with a partner key, username, and password (which belongs to the partner admin role).
• Enable NAT on the internet-facing interface on the WAN Edge router. In Cisco IOS XE SD-WAN, there is a loopback65528 in VRF 65528 by default with an IP address of 192.168.1.1 that is used as the source interface for API calls. A NAT
Dedicated Internet Access (DIA) route is used to direct API traffic into the underlay.
• A DNS server configuration should exist in the transport VPN (VPN 0) and be reachable from the transport VPN (VPN
0). An Internet DNS server is often used for this purpose. The Zscaler base URI must be resolved from the WAN Edgerouter for API calls, along with the Layer 7 health check URI. The Zscaler base URI is zsapi.<zscalercloud>.net/
api/v1 where values for <zscalercloud> are the Zscaler Cloud domain. The automated Layer 7 health check URL
is http://gateway.<zscalercloud>.net/vpntest• Configure Network Time Protocol (NTP) to ensure that the WAN Edge router clock is accurate (for Zscaler API calls).
This isn’t required, but is highly recommended.
©2024 Zscaler, Inc. All rights reserved.

43

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Design Considerations
Review the following considerations:

Basic• NAT is required on each outgoing tunnel WAN interface for API calls to succeed.
• DNS server configuration is required in VPN 0 and reachable from VPN 0 so Zscaler API and L7 heath check URLs canbe resolved.
• NTP configuration is highly recommended so clocks are synced to ensure successful API calls.
• Do not change Site ID or System IP Address of a WAN Edge router when you have a SIG feature template attached.
Remove the SIG feature template to remove the tunnels, make the Site ID and/or System IP address change, then reattach the SIG feature template.

ZIA Admin Portal
When using automated tunnels, Zscaler recommends that you avoid making manual changes to the tunnels and locationsin the ZIA Admin Portal as much as possible. Use SD-WAN Manager to make modifications to those parameters.

ECMP Tunnels• When configuring multiple active/active tunnels, each tunnel is required to have a unique source IP/source port/
destination IP/destination port. For multiple, active tunnels over the same transport, you can use loopback interfaces
defined in VPN 0 to source multiple active tunnels from. vEdge routers do not support loopback interfaces for tunnelsources.
• There are several applications that are known to fork off multiple sessions for a single user session (Microsoft 365,
Google Services, Facebook, etc). If you have two active SIG tunnels that are pinned to two different Zscaler data
centers, 4-tuple ECMP (the default) could pin flows from a single user to separate tunnels. The cloud application
could see different client IP addresses for the same session, since NAT is applied to their source IP addresses fromtwo different data centers, and thus, resets from the server could occur. It is required to use the same SIG data center
for any active/active tunnels.
• There might be performance implications to applications using active/active tunnels and 4-tuple ECMP if the tunnels
have significant performance differences. Use source IP-based ECMP to prevent a single-user session from hashingover multiple tunnels.
• Source IP-based ECMP is not supported for vEdge routers. It is supported for IOS XE SD-WAN routers and you canconfigure it only when the WAN Edge router is in CLI mode before version 17.12. If you try to use an add-on CLI
template, the ECMP configuration goes back to the default, which is 4-tuple. This a affects hardware-based IOS XE
SD-WAN routers and is fixed in 17.12.

Auto Tunnels• There is no support for vEdge auto GRE tunnels.
• When the WAN Edge routers retrieve a list of the closest GRE or IPSec Zscaler data centers through the API, thewithinCountry flag is set to true. This can impact the ability of the WAN Edge to connect to the closest data center
if this device is near the border of a country, and the router could connect to a data center further away (withincountry). This is addressed in SD-WAN Manager version 20.14.
• You can enable several advanced security features on Zscaler through APIs from the SD-WAN Manager GUI. Zscaler
recommends you leave all features off as default, deploy the feature template, bring the tunnels up, then go back toedit the SIG template and enable the desired features/services. Some features might not have the proper licenses
or permissions to enable, so you could get a failed HTTP response and a location might not get created if you aretrying to create tunnels at the same time. It simplifies troubleshooting if you enable them separately from configuring
tunnels for the first time.
©2024 Zscaler, Inc. All rights reserved.

44

Zscaler and CISCO Catalyst SD-WAN Deployment Guide• In SD-WAN Manager version 20.5, you cannot configure values greater than 255 for Idle-time-to-dissociation and
Refresh-time (part of Authentication/Surrogate IP feature and Surrogate IP for Known Browser feature) in the SIG
template UI. The workaround in IOS XE SD-WAN Edge routers is to use a CLI add-on template. To learn more, refer
to Cisco IOS XE Catalyst SD-WAN Qualified Command Reference for additional information on Zscaler advanced
features CLI commands. This is fixed in SD-WAN Manager 20.6.

L7 Health Checks• In the 20.5 Cisco SD-WAN Manager version, L7 health checks are supported only for Cisco vEdge routers. Healthchecks are not supported for Cisco IOS XE SD-WAN Edge routers until the 20.6 Cisco SD-WAN Manager version.
• Starting in 20.5/17.5, you can manually configure GRE or IPSec tunnels using the generic SIG tunnel option in the SIG
feature template. L7 health checking is not supported for the generic SIG tunnel option, until 20.8/17.8.
• L7 health checks are sent out on all SIG tunnels across all high availability configurations. L7 health checks can promotea standby tunnel to an active tunnel, potentially impacting existing sessions.
• Do not use custom L7 health check trackers destined to commonly visited websites, because it might cause cloudsecurity provider IP address space to be blocked. Use http://gateway.<Zscaler Cloud Name>.net/vpntest
as the service URL. Use only HTTP:// in the service URL to Zscaler. HTTPS:// is not valid, even though the Cisco SDWAN Manager might accept it.
• L7 health checks should not be sent more than once every 5 seconds.

GRE• GRE tunnel source IP addresses are not affected by NAT/PAT defined on an interface (like IPSec tunnel source IP
addresses are). This means that you must address GRE tunnel source IP addresses with either a publicly routable
IP address or through One-to-One NAT on an external device. Because the tunnel source IP address is used forregistration with Zscaler, each GRE tunnel source IP address must be unique and should be static and not change.
• Loopback interfaces as tunnel sources for GRE are not supported until 17.9.2 and higher.
• GRE Keepalives are disabled by default in Cisco IOS XE SD-WAN devices. To configure GRE keepalives, configure a
CLI add-on feature template. The command is keepalive [[seconds] retries] under the tunnel interface
configuration.

Cisco IOS XE SD-WAN• On an IOS XE SD-WAN router with multiple internet interfaces accessing Zscaler tunnels or multiple active tunnels
sourced by loopbacks on a router with more than one transport of any type, there might be an issue where ISAKMP
traffic fails to take the correct interface outbound, which can prevent IPSec tunnel formation. This was fixed 20.8/17.8,
but there are still cases where DNS requests for health checks might take an incorrect interface. To work around this,use a CLI add-on policy to use a local Policy-Based Routing (PBR) policy to force DNS or any other local router control
traffic to use the proper physical interface (see the Deploy section for multiple active/active tunnels).
• As referenced by Field Notice FN72510, Cisco IOS XE Software: Weak Cryptographic Algorithms Are Not Allowed
by Default for IPSec Configuration in Certain Cisco IOS XE Software Releases. This affects platforms starting in 17.11.1aand later, and, in a new deployment, will not allow you to configure null encryption for IPSec SIG tunnels. As aworkaround, enter crypto engine compliance shield disable in the CLI add-on template or in CLI mode
and issue a reload. Cisco does not recommend this option as weak cryptographic algorithms are insecure and do notprovide adequate protection from modern threats.

Cisco vEdge• vEdge does not support loopback interfaces for tunnel sources.
• vEdge does not support Zscaler GRE auto tunnels.
• vEdge does not support fallback for data policy for traffic redirection to a SIG tunnel.
• vEdge does not support SIG tunnel monitoring enhancements.
©2024 Zscaler, Inc. All rights reserved.

45

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

DeployThe following basic steps are needed to configure auto tunnels successfully:• Deploy: ZIA for API Access. This allows Cisco SD-WAN Manager to send API calls to ZIA to provision IPSec tunnels andZscaler locations.
• Deploy: Cisco WAN Edge Prerequisites.
• Verify NAT, DNS, and clock/NTP settings.
• Create a SIG credentials feature template. This uses information obtained from ZIA you configured while setting
up ZIA for API access.
• If you plan on using Null Encryption, which is the default for Zscaler SIG tunnels, disable crypto complianceby entering crypto engine compliance shield disable in the CLI add-on template or in CLI mode
and issue a reload. Refer to Field Notice FN72510. Compliance is enforced starting in 17.11.1a for many platforms
and won’t allow you to configure weak cryptographic algorithms. While not recommended, disabling crypto
compliance is a workaround in order to use the Null Encryption option.
• Deploy an IPSec Auto Tunnel use case. You can choose different use cases. Active/Standby tunnels and Active/
Active tunnels using hybrid or dual-internet transports and configured with a SIG route or centralized policy are a few
examples. For each use case, the following is needed:• Create a SIG feature template: This allows you to define multiple tunnels of certain types (Umbrella, Zscaler, or
generic), and allows you to define specific characteristics about each tunnel. Then, you can define which tunnels
are active and which are backup.
Clipboard-list Tech Tip
After a tunnel type is selected in the SIG Feature Template, you can only configure additional tunnels of that same
type in that specific feature template. With Zscaler tunnels using the SIG template, IPSec or GRE tunnels are bothsupported, but a mix of both is not supported in the same feature template. L7 health checking is not supported inthis code version for generic tunnels.
• Add the SIG and SIG credentials feature template to the device template of the device you want to configure with
IPSec auto tunnels.
• Add a route or modify centralized policy for traffic redirection to the Zscaler tunnels.
Clipboard-list Tech Tip
Before moving forward, ensure that the WAN Edge router has a device template deployed from Cisco SD-WAN
Manager with, at minimum, basic connectivity to the internet. For details on a base template example, see Appendix A:
Cisco Branch Base Feature Templates and Configuration Values Used.

Deploy: ZIA for API AccessIn this section, the Zscaler side is configured for API access, which is needed when configuring the WAN Edge router for
automated IPSec or GRE tunnels. When attaching SIG templates which contain Zscaler tunnels starting in 20.5 SD-WAN
Manager code and later, a SIG Credentials template is required as part of the device template. This SIG Credentials featuretemplate needs information from the Zscaler UI in order for API calls to Zscaler to succeed. It is noted in the following
appropriate sections the information needed for the SIG Credentials feature template on SD-WAN Manager, which is
configured in a later section.
Note that login IDs and passwords in the following images might be obscured for security reasons.
©2024 Zscaler, Inc. All rights reserved.

46

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 1: Log In to ZIA
1. Log in to Zscaler using your administrator account. The login URL is
https://admin.<Zscaler Cloud Name>.net, where <Zscaler Cloud Name> is the Zscaler cloud to which you
have admin rights.

Figure 24. Login to ZIA

2. If you are unable to log in using your admin account, contact Zscaler Support.

Procedure 2: Find Zscaler Organization Domain and Partner Base URI
You need the Zscaler Organization Domain and Partner Base URI for the Cisco SD-WAN Manager SIG credentials featuretemplate.
1. Go to Administration > Settings > Company Profile. On the Organization tab, manually note the domain namelisted under the Domains field (in this example, ciscotest.net). If multiple domains exist, select only one of them.

Figure 25. Company profile©2024 Zscaler, Inc. All rights reserved.

47

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Clipboard-list Tech Tip
The Domains value in this section is used in the Organization field in the Cisco SD-WAN Manager SIG credentials
feature template.

Cisco SD-WAN Manager
SIG
Credentials
Parameter
Organization

ZIA Admin Portal Location

Zscaler Parameter

Zscaler Value

Administration > Settings> Company Profile >Organization

Domains

ciscotest.net(example)

2. Go to Administration > Authentication > Cloud Service API Security. On the Cloud Service API Key tab at the topof the page, copy the base URL for your API (in this example, zsapi.zscalerbeta.net/api/v1).

Figure 26. API key management

Clipboard-list Tech Tip
The base URL value in this section is used in the Partner Base URI field in the Cisco SD-WAN Manager SIG credentials
feature template.

©2024 Zscaler, Inc. All rights reserved.

48

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Cisco SD-WAN Manager
SIG
Credentials
Parameter

ZIA Admin Portal Location

Zscaler Parameter

Zscaler Value

Organization

Administration > Company
Profile > Organization

Domains

ciscotest.net (example)

Partner Base URI

Administration >Authentication > Cloud
Service API Security > Cloud
Service API Key

Base URL for your API

zsapi.zscalerbeta.net/api/v1(example)

Procedure 3: Add and Verify SD-WAN Partner Key
To enable ZIA for API access, the first step is to create a SD-WAN partner key. The partner key is an API key used as
one form of authentication. The second form of authentication is an admin partner username and password, which is
explained later in this deployment guide. Use this admin credential set for API calls. It doesn't work for logging in to the
ZIA Admin Portal.
1. Go to Administration > Settings > Cloud Configuration > Partner Integrations.

Figure 27. Partner integrations©2024 Zscaler, Inc. All rights reserved.

49

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

2. At the Partner Integrations section of the ZIA Admin Portal, select the SD-WAN tab. If a key already exists with aPartner Name Cisco Viptela, then skip to Step 6. Only one key can exist per partner name. Take care when deletingor modifying the partner key because API calls to Zscaler fail if other Cisco SD-WAN Manager instances are using thecurrent key.
3. Click Add Partner Key.

Figure 28. Add partner key

4. Under the Name drop-down menu, select which SD-WAN vendor you want to create a partner key. After selecting
Cisco SD-WAN, click Generate.

Figure 29. Generate partner key©2024 Zscaler, Inc. All rights reserved.

50

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

5. See the partner key you created (Cisco SD-WAN in this case) in the Partner Integrations window. A red circle with anumber above the Activation icon on the bottom left-side navigation is also displayed. Although you have created apartner key, the configuration change is pending. Only after activation does this configuration become active.

Figure 30. Partner key complete

6. Ensure to copy the Key value as it is required in a future step when configuring the SIG credentials feature templatein the Cisco SD-WAN Manager Network Management System (NMS).
Clipboard-list Tech Tip
The Cisco Viptela partner key value in this section is used in the Partner API Key field in the Cisco SD-WAN
Manager SIG credentials feature template.

Cisco SD-WAN Manager
SIG
Credentials
Parameter

ZIA Admin Portal Location

Zscaler Parameter

Zscaler Value

Organization

Administration > Company
Profile > Organization

Domains

ciscotest.net (example)

Partner Base URI

Administration >Authentication > Cloud
Base URL for your API
Service API Security > Cloud
Service API Key

zsapi.zscalerbeta.net/api/v1(example)

Partner API Key

Administration > Settings> Cloud Configuration >Partner Integrations > SDWAN

ABCdef123GHI (example)

Partner Name (Cisco SDWAN or Cisco Viptela) Key©2024 Zscaler, Inc. All rights reserved.

51

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 4: Add a Partner Administrator Role
You must create a partner administrator role and assign it to the administrator user that is used to authenticate against the
Zscaler ZIA Provisioning API. By creating a partner administrator role, you can define the permissions and access to grant
to a third-party partner, such as a SD-WAN partner.
1. Go to Administration > Authentication > Administrative Controls > Role Management.

Figure 31. Role management

2. If a partner administrator role has already been created with full access, use this role, or create a separate one. A
partner administrator role is listed as Type Partner Admin, including a Policy keyword listed under the Full Accesscolumn. If you use an existing role, note the Name, and go to Procedure 5: Create a Partner Administrator to create apartner administrator login ID and password.
3. To create a new partner administrator role, click Add Partner Administrator Role.

Figure 32. Add partner administrator©2024 Zscaler, Inc. All rights reserved.

52

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

4. Enter the name of the partner administrator role you want to create.
5. Change the Access Control to Full. Full Access Control allows partner admins to view and edit VPN credentials andlocations that the Cisco SD-WAN Manager NMS is managing via the ZIA Provisioning API. This is necessary for the
Cisco SD-WAN Manager NMS to create new VPN credentials and locations in ZIA for branches.
6. Click Save to return to the previous screen.

Figure 33. Partner administrator role©2024 Zscaler, Inc. All rights reserved.

53

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 5: Create a Partner Administrator
The last step required is to create a partner administrator.
1. Go to Administration > Administration Controls > Administrator Management.

Figure 34. Administrator management

2. On the Administrator Management window under the Administrators tab, select Add Partner Administrator.

Figure 35. Add partner administrator©2024 Zscaler, Inc. All rights reserved.

54

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

3. On the Add Partner Administrator window, fill in the required fields:
a. Login ID: This includes @domain which fills in automatically to the right if there is only one domain with thisaccount. If there are multiple domains associated with this account, choose the correct one from the dropdown menu.
b. Email: Any address in email format and equal to the login ID, but cannot already exist in the current cloud (itshould not be referenced anywhere).
c. Name: Name or label associated with the login ID (it should not be referenced anywhere).
d. Partner Role: Select the role created in Procedure 4: Add a Partner Administrator Role.
e. Status: Enable or disable the Partner Administrator account. By default, it is enabled.
Clipboard-list Note
Save the Login ID @ Domain value and Password settings, as you need to enter them in the Cisco SD-WAN Manager
NMS when configuring the SIG credentials template.
4. Click Save.

Figure 36. Save partner admin

Clipboard-list Tech Tip
The Login ID @ domain value in this section is used in the Username field, and the Password value in this section is usedin the Password field in the Cisco SD-WAN Manager SIG credentials feature template.

©2024 Zscaler, Inc. All rights reserved.

55

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Cisco SD-WAN Manager
SIG
Credentials
Parameter

ZIA Admin Portal
Location

ZscalerParameter

Zscaler
Value

Organization

Administration > Company
Profile > Organization

Domains

ciscotest.net (example)

Partner Base URI

Administration >Authentication > Cloud
Service API Security > Cloud
Service API Key

Base URL for your API

zsapi.zscalerbeta.net/api/v1(example)

Username

Administration >Administration Controls >Administrator Management> Administrators

Partner Admin Login ID

sd-wan@ciscotest.net(example)

Password

Administration >Administration Controls >Administrator Management> Administrators

Partner Admin Password(hidden)Partner API Key

Administration > Settings> Cloud Configuration >Partner Integrations > SDWAN

Partner Name (Cisco SDWAN or Cisco Viptela) Key

ABCdef123GHI (example)©2024 Zscaler, Inc. All rights reserved.

56

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 6: Activate Pending Changes
Note that the new configurations are not enabled until activation occurs.
Click Activation on the left-side navigation, and then click Activate to enable the pending configuration changes.

Figure 37. Activate changes

After activating pending changes, Activation Completed! appears.

Figure 38. Activation completed©2024 Zscaler, Inc. All rights reserved.

57

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Deploy: Cisco WAN Edge Prerequisites
In this section, the prerequisites are checked and deployed.

Procedure 1: Log In to the Cisco Catalyst SD-WAN Manager
1. Open a web browser and enter the URL for your vManage instance(https://<Cisco SD-WAN Manager IP address>:8443). For best results, use a Google Chrome or Mozilla
Firefox browser.
2. Enter the admin username and password.

Procedure 2: Ensure Prerequisites are Met
1. Verify that NAT is enabled on the internet interface that is used to access Zscaler.
This is needed for API calls requested against the ZIA Public Service Edge because a NAT DIA route is used to direct
the API traffic out of the underlay. Enable a NAT in each internet interface deployed where Zscaler tunnels are built.
The following is the relevant feature template information that is required:
Modifications to Feature Template: BR_VPN0_INET
SectionParameter

Type

Variable/Value

NAT

NAT

GlobalOn

NAT Type

GlobalInterface

2. Verify that a primary and/or secondary DNS server is defined in the VPN 0 feature template. API calls are made to
the base URI: zsapi.<Zscaler Cloud Name>.net/api/v1 oradmin.<Zscaler Cloud Name>.net/api/v1 where values for <Zscaler Cloud Name> are the Zscaler Clouddomain. The automated L7 health check URL also needs DNS resolution. It is
http://gateway.<Zscaler Cloud Name>.net/vpntest.
The following is the relevant feature template information that is required (which can be global or device-specificvalues):Modifications to Feature Template: BR_VPN0
SectionParameter

Type

Variable/Value

DNS

Primary DNS Address(IPv4)

Global208.67.222.222

Secondary DNS Address(IPv4)

Global208.67.220.220©2024 Zscaler, Inc. All rights reserved.

58

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

3. Verify Network Time Protocol (NTP) is enabled, synced, and the clock is correct. An authentication session can failwith Zscaler due to the clock time being mismatched. Configuring NTP and ensuring the NTP server time is synced is
one way to prevent authentication issues.
WAN_EdgeE#show clock
01:49:13.091 UTC Fri Sep 3 2021
WAN_EdgeE#show ntp association
address ref clock st when poll reach delay offset disp*~64.100.100.1 127.127.1.1 5 157 1024 377 3.000 -3.500 2.050* sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured
NTP is configured in a separate feature template and added to the device template in the basic information section.
In the example topology, the source interface is the internet interface in VPN 0, because the NTP server is on theinternet.
Feature Template Name: NTP
SectionParameter

Type

Variable/Value

ServerHostname/IP address

Globaltime.google.com

Source Interface

Device Specificntp_server_source_int©2024 Zscaler, Inc. All rights reserved.

59

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 3: Create a SIG Credentials Feature Template
Starting in 20.9 SD-WAN Manager code versions, the SIG credentials feature template is created automatically and isfilled out only one time when a SIG feature template is first created with a specific SIG provider and software platform(vEdge or IOS XE SD-WAN). The credentials template is then added automatically to a device template when the SIG
feature template is added. Before the 20.9 SD-WAN Manager code version, there is a SIG credentials feature template you
must create and configure separately and then manually add to a separate section of the device template when the SIG
template is added.
If using 20.9 SD-WAN Manager code and later, create the first Zscaler SIG feature template to create the global Zscaler SIG
credentials feature template. If using 20.8 SD-WAN Manager code and earlier, create a separate SIG Credentials featuretemplate.
1. In the top left corner of Cisco SD-WAN Manager, click the hamburger icon to open the menu.
2. Go to Configuration > Templates > Feature or Feature Templates at the top of the page.

Figure 39. Configure template

3. Click Add Template.
4. In the Select Devices section, select the devices from the list that potentially can use this template. To select all IOS
XE SD-WAN devices that can support SIG Templates, you can select all platforms except ISR 1100 (Viptela OS), vEdge
devices, CG platforms, the IR8140 and IR8340, and the vManage and SD-WAN from the device model list (in the 20.9
release).
5. In SD-WAN Manager version 20.9 and later, in the VPN section, select Cisco Secure Internet Gateway (SIG).

©2024 Zscaler, Inc. All rights reserved.

60

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Figure 40. Add Template

6. In other SD-WAN Manager versions, in the Other Templates section, select Cisco SIG Credentials.

Figure 41. Cisco SIG credentials

7. In SD-WAN Manager version 20.9 and later, leave everything as is. The Template Name (Cisco-Zscaler-GlobalCredentials) and Description (Global credentials for zscaler) are already filled in, and the SIG Provider is alreadyselected (Zscaler).
In other SD-WAN Manager versions, enter the Template Name (xeSig_Credentials) and Description (IOS XE
Sig Credentials Template), and next to SIG Provider, select Zscaler.

©2024 Zscaler, Inc. All rights reserved.

61

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

8. Fill in the Organization, Partner Base URI, Username, Password, and Partner API Key. These parameters wereobtained from the Zscaler configuration section:
Cisco SD-WAN
Manager SIG
Credentials
Parameter

ZIA Admin Portal
Location

ZscalerParameter

Zscaler
Value

Organization

Administration > Company
Profile > Organization

Domains

ciscotest.net (example)

Partner Base URI

Administration >Authentication > Cloud Service
API Security > Cloud Service
API Key

Base URL for your API

zsapi.zscalerbeta.net/
api/v1 (example)

Username

Administration >Administration Controls >Administrator Management >Administrators

Partner Admin Login ID

sd-wan@ciscotest.net(example)

Password

Administration >Administration Controls >Administrator Management >Administrators

Partner Admin Password(hidden)Partner API Key

Administration > Settings >Cloud Configuration > Partner
Integrations > SD-WAN

Partner Name (Cisco SDWAN or Cisco Viptela) Key

ABCdef123GHI(example)

Figure 42. Zscaler settings

9. Click Save. For SD-WAN Manager versions 20.9 and later, you are returned to a SIG feature template where you cancontinue to configure a SIG template, or click Cancel to configure a SIG template at a later time.
©2024 Zscaler, Inc. All rights reserved.

62

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Deploy: Cisco WAN Edge Auto IPSec or GRE Tunnels (One Active/Standby Pair,
Hybrid Transport)
In this section, you’ll configure one active/standby auto tunnel pair on the internet transport: one to the primary Zscaler
DC and one to the secondary Zscaler DC. Traffic is forwarded on the active tunnel to the primary DC until the active
tunnel is declared to be down (through L7 health checking and/or DPD). After the primary DC is down, the standby tunnel
to the secondary DC becomes active. When the tunnel to the primary DC recovers, it becomes active again and thetunnel to the secondary DC goes into standby.
The following deployment use case contains the following features:• One active/standby IPSec or GRE auto tunnel pair on a single internet transport. The active tunnel connects to a
primary Zscaler DC and the standby tunnel connects to a secondary Zscaler DC.
• SIG service route for redirecting traffic to Zscaler tunnels• Customized L7 Health Tracker (optional)• Advanced Zscaler features (optional)• Customized Zscaler tunnel destinations (optional)

Figure 43. Cisco WAN Edge Auto IPSec or GRE tunnels©2024 Zscaler, Inc. All rights reserved.

63

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 1: Create a SIG Template
1. On the Configuration > Templates > Feature Templates page, click Add Template and select devices.
2. In the VPN section, select Cisco Secure Internet Gateway (SIG).

Figure 44. Cisco SIG

3. Enter the Template Name (xeSig_Zscaler) and Description (Cisco IOS XE Sig Zscaler Template).
4. Next to SIG Provider, select Zscaler.
5. (Cisco IOS XE SD-WAN ONLY) A source IP address for the L7 health tracker is required. This field is a private, unique
IPv4 address with a /32 prefix. In the Tracker (Beta) section next to Source IP Address, choose Device Specific fromthe drop-down menu. The variable for this parameter is labeled vpn_trackersrcip. Note that this field is required
for Cisco IOS XE SD-WAN routers. You can turn off health checks under the tunnel configuration advanced settings(not recommended), but you must still configure a global value or device-specific variable for the Tracker Source IP
Address.

Figure 45. Add SIG template

By default, Cisco vEdge routers use source IP address 192.168.0.2 in VRF 65530 for the L7 health tracker.

©2024 Zscaler, Inc. All rights reserved.

64

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

You do not need to explicitly configure a tracker for SD-WAN routers because it is created automatically. By default,
L7 health checks are enabled on each tunnel with the following default properties.
SectionParameter

Type

Variable/Value

TrackerThreshold (msec)

Default

1000

Interval (sec)Default

30

Multiplier

Default

2

API URL of endpoint

Default

http://gateway.<Zscaler
Cloud Name>.net/vpntest

If you choose to change any tracker parameters, configure a custom tracker. A customized tracker configuration isshown in Procedure 5: (Optional) Customize L7 Health Tracker.
6. In the Configuration section, click Add Tunnel.
7. Next to Tunnel Type, select ipsec or gre. The default is ipsec. After you choose a tunnel type, any additional tunnels
configured in the SIG template are automatically chosen to be the same type. GRE is used in this example.

Figure 46. Add tunnel©2024 Zscaler, Inc. All rights reserved.

65

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

8. For Interface Name, use the global parameter type. Specify an Interface Name, which is the keyword ipsec or gre,followed by a number 1-255 (example: ipsec1 or gre1). Name the interface gre101.
9. Next to Description, choose the Global parameter and type an optional Description (e.g., Primary DC Tunnel
1).
10. Next to Tunnel Source Interface, select Device Specific and create a variable for this parameter (e.g.,
pri_tunnel1_src_int).
11. Next to Data-Center, select which data center from which this tunnel terminates. Each data center location (primaryor secondary) is selected automatically when the configuration is deployed, or manually assigned (described later inthis guide).
12. (GRE only) GRE tunnels must register their public source IP address through the API calls. Next to Source Public IP,
select Device Specific and create a variable for this parameter (pri_tunnel1_src_public_ip).

Figure 47. Add Tunnel (GRE)©2024 Zscaler, Inc. All rights reserved.

66

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

13. Leave the parameters under Advanced Options as defaults. Under Advanced Options, the following default options
are set for IPSec tunnels (shown in the first table) and GRE tunnels (shown in the second table).
SectionParameter

Type

Variable/value

Advanced Options >GeneralShutdown

Default

No

Track this interface for SIG

DefaultOn

IP MTU

Default

1400

DPD Interval

Default

10

DPD Retries

Default

3

IKE Rekey Interval (seconds)

Default

14400

IKE Cipher Suite

Default

AES 256 CBC SHA1IKE Diffie-Hellman Group

Default

2 1024-bit modules

IPSec Rekey Interval(seconds)

Default

3600

IPSec Replay Window

Default

512

IPSec Cipher Suite

Default

Null SHA1

Perfect Forward Secrecy

Default

None

Advanced Options > IKE

Advanced Options > IPSec** As referenced by Field Notice FN72510, Cisco IOS XE Software: Weak Cryptographic Algorithms Are Not Allowed by
Default for IPSec Configuration in Certain Cisco IOS XE Software Releases. This affects platforms starting in 17.11.1a and later,and, in a new deployment, will not allow you to configure null encryption for IPSec SIG tunnels. As a workaround, enter
crypto engine compliance shield disable in the CLI add-on template or in CLI mode and issue a reload. Cisco
does not recommend this option as weak cryptographic algorithms are insecure and do not provide adequate protection
from modern threats.
SectionParameter

Type

Variable/value

Advanced Options >GeneralShutdown

Default

No

Track this interface for SIG

DefaultOn

IP MTU

Default

1400©2024 Zscaler, Inc. All rights reserved.

67

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

14. Click Add.
15. In this use case, one additional tunnel is created (the standby tunnel to the secondary data center).
Click Add Tunnel.
SectionParameter

Type

Variable/value

Configuration

Interface Name (1..255)

Globalipsec201

Description

GlobalSecondary DC Tunnel 1

Tunnel Source Interface

Device Specificsec_tunnel1_src_int

Data center

Radio Button

SecondaryData-Center

Radio Button

Secondary

SectionParameter

Type

Variable/value

Configuration

Interface Name (1..255)

Globalgre201

Description

GlobalSecondary DC Tunnel 1

Tunnel Source Interface

Device Specificsec_tunnel1_src_int

Data-Center

Radio Button

SecondarySource Public IP

Device Specificsec_tunnel1_src_public_ip

For GRE, use the following settings:

16. Click Add.
17. Repeat steps 5–16 to define any additional tunnels.
18. After you are finished adding tunnels, configure which interface you want to be active and backup. Under High
Availability, next to Pair-1 under the Active column, select gre101 or ipsec101 from the drop-down menu, and underthe Backup column, select gre201 or ipsec201.

Figure 48. High availability©2024 Zscaler, Inc. All rights reserved.

68

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

19. In Advanced Settings, you can choose the primary and secondary data centers (the default is automatic). You
also can turn on several Zscaler features for the tunnel through the APIs. They include: Zscaler Location Name,
Authentication Required, XFF Forwarding, Enable Firewall, Enable IPS Control, Enable Caution, and Enable AUP. To
learn more, see Configuring Locations (government agencies, see Configuring Locations).
Clipboard-list Tech Tip
Outside of Zscaler Location Name, do not turn on other Zscaler options under Advanced Settings when bringing up
tunnels for the first time. Leave the defaults off to bring up the tunnels. When up, go back and make feature templatechanges to turn on desired features. Certain features might require certain subscriptions or licenses on Zscaler, andit can make troubleshooting more difficult if you turn on some of the features before bringing up the tunnels for the
first time.

20. Under Advanced Settings, keep the defaults and click Save at the bottom of the screen to save the featuretemplate.

Procedure 2: Add the Tunnel Configuration to the Device Template
1. In Cisco SD-WAN Manager, go to Configuration > Templates > Device, and select the Device Templates tab. To theright of the device template you want to modify, click … and select Edit from the drop-down menu.

Figure 49. Cisco SD-WAN Manager template

2. Under the Transport & Management VPN section, select Cisco Secure Internet Gateway on the right-hand side. The
Cisco Secure Internet Gateway field is inserted into the Transport & Management VPN section. From the dropdown menu, select the SIG feature template recently created (xeSig_Zscaler).

Figure 50. Cisco SIG©2024 Zscaler, Inc. All rights reserved.

69

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

3. Before you can save the device template, you must attach the SIG Credentials template. In SD-WAN Manager version
20.9 and later, this is done automatically when a SIG feature template is attached to the device template. If runningan earlier SD-WAN Manager version, next to Cisco SIG Credentials *, attach the SIG credentials feature template thatwas built in the Deploy: Cisco WAN Edge Prerequisites section.

Figure 51. Cisco SIG credentials

4. Click Update.
5. To the right of the device configuration being updated, click … and select Edit Device Template from the drop-down
menu.

Figure 52. Edit device template

6. Fill in the missing variable values. Fill in the Tunnel Source Interface for the primary and secondary tunnels andwhich physical interface the tunnel are routed through (this is especially important if the source interface is aloopback interface). If you have configured a GRE tunnel, specify the Source IP Address for the tunnel that isregistered on Zscaler. Fill in the source IP address for the L7 health check.
7. Click Update.

Figure 53. Cisco SIG update

8. Deploy template changes by clicking Next, then Configure Devices. The configuration changes are pushed and Cisco
SD-WAN Manager returns success.

©2024 Zscaler, Inc. All rights reserved.

70

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 3: Add Service RouteThe last step is to redirect traffic. In this section, a SIG service route (default route) is installed into the service VPN to
direct service-side internet traffic to Zscaler. You can configure this in all service VPN templates to redirect traffic. The
SIG service route is not an optional setting, but if a SIG tunnel is not up and operational on the router, the route is notinstalled. You can either modify the service VPN template currently in use or create a separate service VPN template forrouters that use the SIG service route. In this example, the current service VPN feature template is modified.
1. On the Cisco SD-WAN Manager page, select the Configuration > Templates > Feature tab and find the branchservice VPN feature template to modify (e.g., xeBR_VPN1).
2. To the right of the feature template, click … and select Edit from the drop-down menu.

Figure 54. Cisco SD-WAN Manager feature

3. Click the Service Route.
4. Click the New Service Route button.
5. Next to Prefix, enter 0.0.0.0/0. The Service defaults to SIG. Click Add to add the service route to theconfiguration, then click Update to save the xeBR_VPN1 feature template.

Figure 55. New service route

6. Click Next, then Configure Devices. Confirm changes on multiple devices if needed and click OK. The status of theconfiguration change returns with Success.

©2024 Zscaler, Inc. All rights reserved.

71

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 4: Verify Tunnel Operation
1. In the SD-WAN Manager GUI under Monitor > Tunnels, click the SIG Tunnels tab to view the tunnel status and any
events related to the SIG tunnel.

Figure 56. Monitor SIG Tunnels

2. In the SD-WAN Manager GUI under Monitor > Devices, click the WAN Edge router on which you want to verify thetunnel operation.
3. Under Applications > Interface, click Real Time at the top right of the chart. You can also click the interface you areinterested in on the right-hand side of the chart.

Figure 57. WAN Edge tunnel interface©2024 Zscaler, Inc. All rights reserved.

72

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

4. If the interface you are interested in is missing from the graph, scroll down past the chart to see the entire list ofinterfaces. Click the checkbox on the left for the interface you want to display on the chart. You can also view thestate and statistics of the various interfaces on the device from this list.

Figure 58. Interface state and statistics

See the Operate section of this guide for additional monitoring and troubleshooting information.

Procedure 5: (Optional) Customize L7 Health Tracker
In this section, the L7 health tracker is customized.
1. In the SD-WAN Manager GUI, go to Configuration > Templates and click the Feature Templates tab. To the rightof the SIG feature template that was created in the earlier section (xeSig_Zscaler), click … and select Edit from thedrop-down menu.
2. In the Tracker (Beta) section, click the New Tracker button. Next to Name, select the Global parameter and enter
the name for the tracker (zscaler_L7_health_check), which is a label referenced by each tunnel using the
tracker.
3. For Interval, the default is 60 seconds and the minimum allowed is 20 seconds. Change the parameter to Global,
and enter 20. For the API URL of endpoint, enter http://gateway.<Zscaler Cloud Name>.net/vpntest forthe specific Zscaler cloud you belong to.

Figure 59. New tracker©2024 Zscaler, Inc. All rights reserved.

73

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

4. Click Add.
5. Before finishing the update to the feature template, reference the new L7 health tracker by the tunnels alreadycreated. Under Configuration next to each tunnel, click the Edit icon.

Figure 60. Add tunnel

6. Next to Tracker, choose the Global parameter, then in the drop-down menu, select the L7 health check you created,zscaler_L7_health_check.
7. Click Save Changes.

Figure 61. Update tunnel

8. Repeat steps 5–7 with each tunnel.

©2024 Zscaler, Inc. All rights reserved.

74

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

9. Click Update to save changes to the SIG feature template. Click Next, then Configure Devices. You might need toconfirm configuration changes on multiple devices. Select the checkbox and click OK. The configuration changes arepushed out to the attached WAN Edge routers. The status returns Success.
WAN_EdgeG#show endpoint-tracker
Interface

Record Name

StatusTunnel100612

zscaler_l7_health_chec Up

Tunnel100712

zscaler_l7_health_chec Up

RTT in msecs

Probe ID

Next Hop

10

25

None

77

26

None

Procedure 6: (Optional) Enable Advanced Zscaler Features
1. In the ZIA Admin Portal, you can view the gateway options enabled for a location by going to Administration >Resources > Location Management and editing the location in which you are interested. You modify gateway
options via APIs from the Cisco SD-WAN Manager.

Figure 62. Edit location©2024 Zscaler, Inc. All rights reserved.

75

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

2. To change the settings, modify the SIG template feature template in the Cisco SD-WAN Manager. Go to
Configuration > Templates > Feature Templates. Find the name of the SIG template you want to modify(xeSig_Zscaler). Click … to the far right of the template and select Edit from the drop-down menu.
3. Under Advanced Settings, select the Global parameter and click On next to the settings you want to enable. In thisexample, Enable Caution is enabled.
4. Click Update.
Clipboard-list Note
This enables the same Zscaler advanced settings for every device this template is attached to. If you need different
settings for different devices, a separate SIG feature template is required.

Figure 63. Update

5. Click Next, then Configure Devices. Confirm configuration on multiple devices if needed. Configuration changes arepushed to the devices and Success is returned.

©2024 Zscaler, Inc. All rights reserved.

76

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

6. View the location gateway options in the ZIA Admin Portal for changes.

Figure 64. Enable caution

Procedure 7: (Optional) Customize Zscaler Tunnel Destination (Primary and Secondary Data
Centers)
Zscaler recommends that you use automation to determine the primary and secondary data centers. To change thetunnel destination settings to choose your own primary and secondary Zscaler data center locations, modify the SIG
template feature template.
1. Go to Configuration > Templates > Feature Templates. Find the name of the SIG template you want to modify(xeSig_Zscaler). Click … to the far right of the template and select Edit from the drop-down menu.
2. Under Advanced settings, next to Primary Data-Center, select the Device Specific parameter and enter the variable
vpn_zlsprimarydc. Next to Secondary Data-Center, select Device Specific and enter the variable
vpn_zlssecondarydc.

Figure 65. SIG template edit

3. Click Update to save the feature template settings.
Clipboard-list Tech Tip
If you select a global parameter, you can select available Zscaler data centers from the drop-down menu. Select a data
center that is part of your assigned Zscaler cloud. In earlier versions of the code, this list of data centers was static andthus, not fully up-to-date. Use a device specific parameter if you need to specify a data center that is not in the list or
you must specify different data centers for different devices attached to the same feature template. To get the most upto-date list of Zscaler data centers, check: https://config.zscaler.com/<Zscaler Cloud Name>.net/cenr.
In this example, the list for Zscaler cloud Beta is located at https://config.zscaler.com/zscalerbeta.net/cenr.
Note that if you use a variable to specify a data center that is not in the recommended list for that location, then a data
center is chosen automatically.
©2024 Zscaler, Inc. All rights reserved.

77

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

4. At the top of the page, select a device template for which you need to fill in data center values if there is more than
one device attached to the SIG feature template. To the right of the device, click … and select Edit Device Templatefrom the drop-down menu.

Figure 66. Edit device template

5. Enter the values for the Primary and Secondary data centers. Use VPN Host names for IPSec tunnel destinations
and IP addresses for GRE tunnel destinations. Note that auto is an acceptable value for those locations where thetunnels are automatically discovered for you. This example uses the data center locations Frankfurt IV for Primaryand Washington, DC for Secondary.
Clipboard-list Note
If you are filling in values for primary and secondary data center variables, use IP addresses for GRE tunnel destinations
and VPN host names for IPSec tunnel destinations. If IPSec tunnels are used instead, the example would use data
center locations Frankfurt IV (fra4-vpn.zscalerbeta.net) for primary and Washington, DC(was1-vpn.zscalerbeta.net) for secondary.
6. Click Update.

Figure 67. Update device template©2024 Zscaler, Inc. All rights reserved.

78

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

7. Update variable values on other devices attached to device templates using the feature template you just modified.
8. Click Next, then Configure Devices. Confirm configuration changes on multiple devices if needed. Cisco SD-WAN
Manager pushes the configuration changes and indicates Success.
9. Open a client browser at the site, go to https://ip.zscaler.com. Validate that the primary data center is accessed (inthis example, Frankfurt IV).

Figure 68. Zscaler IP config©2024 Zscaler, Inc. All rights reserved.

79

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Deploy: Cisco WAN Edge Auto IPSec or GRE Tunnels (Active/Active Tunnels, Hybrid
Transport)
In this section, two active auto IPSec tunnels are configured, all to the same Zscaler data center. Traffic is forwarded on
both tunnels to the primary data center until a tunnel is declared down (through L7 health checking and/or dead peer
detection). When down, traffic is hashed to the remaining tunnel. When the downed tunnel recovers, it becomes active
again and traffic is hashed to it again.
This deployment use case contains the following features:• One active/active IPSec or GRE auto tunnel pair on a single internet transport. Both tunnels connect to the same
primary Zscaler data center.
• ECMP based on the source IP address.
• Centralized data policy for redirecting traffic to Zscaler tunnels.
• Weighted tunnels.

Figure 69. Cisco WAN Edge auto IPSec tunnels

Clipboard-list Tech Tip
This use case is designed to illustrate how to configure multiple active/active tunnels over a single internet transport.
You can add additional active tunnels (up to 4) or add standby tunnels for any active tunnel as well.
With 4-tuple ECMP hashing, you want to keep all active tunnels pointing to the same Zscaler DC. If you choose to
implement standby tunnels, you want them pointing to the same Zscaler DC as the active tunnels in the event one
or a subset of standby tunnels become active. You do not want equal cost paths where the same user application
session can hash to different Zscaler DCs. Alternatively, use Source IP-based ECMP hashing, which removes thisrestriction.
To accommodate both tunnels to one Zscaler destination, two loopback interfaces are needed for source IP addresses
since each tunnel needs a unique source IP/source port/destination IP/destination port pair.

©2024 Zscaler, Inc. All rights reserved.

80

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 1: Create two loopback interfaces, one for each active tunnel (Cisco IOS XE SD-WAN
only)
1. In the Cisco SD-WAN Manager, go to Configuration > Templates > Feature Templates tab. Click Add Template,select your devices, and under VPN, select Cisco VPN Interface Ethernet.
2. Enter a Template Name and Description. Under basic configuration next to Shutdown, choose the Global
parameter and click No. Next to Interface Name, enter Loopback1, and next to IPv4 Address/prefix-length,choose the Global parameter and type the address (10.10.10.1/32 in this example).
Clipboard-list Note
You must address loopback interfaces used as the source for GRE tunnels with a unique public IP address or a unique
private IP address so that One-to-One NAT can happen with an external device. You might decide to use
device-specific variables rather than global parameters for this reason.

Figure 70. Loopback interface

3. Click Save.

©2024 Zscaler, Inc. All rights reserved.

81

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

4. Copy the previous template and make modifications or create new interface Ethernet feature templates by
repeating steps 1 through 3 so that you have two total loopback addresses with the following characteristics:
Template Type: Feature Template > Cisco VPN Interface Ethernet
Feature Template
Name

SectionParameter

Type

Variable/value

Loopback1

Basic Configuration

Shutdown

GlobalNo

Interface Name

GlobalLoopback1

IPv4

Radio Button

StaticIPv4 Address/prefixlength

Global10.10.10.1/32

Shutdown

GlobalNo

Interface Name

GlobalLoopback2

IPv4

Radio Button

StaticIPv4 Address/prefixlength

Global10.10.10.2/32

Loopback2

Basic Configuration

Procedure 2: Create a local policy-based routing policy (Cisco IOS XE SD-WAN only)
Create a CLI add-on template that configures a local policy-based routing policy. This lets any control traffic pick theproper next-hop interface generated by the router.
1. If you've already created a CLI add-on feature template, edit the feature template and go to step 4. To create a newone, go to Configuration > Templates.
2. Click the Feature Templates tab.
3. Click Add Template.
4. Select the devices the feature template can apply to.
5. Under Other Templates, click Cli Add-On Template.

Figure 71. Other templates©2024 Zscaler, Inc. All rights reserved.

82

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

6. Enter a Template Name (CLI-Template) and Description (CLI Add-on Template).
7. Add the following CLI:
ip access-list extended SIG
10 permit ip host 10.10.10.1 any
20 permit ip host 10.10.10.2 any!
route-map Tunnel-Control permit 10
match ip address SIG
set ip next-hop 64.100.217.1
ip local policy route-map Tunnel-Control
8. Highlight 64.100.217.1 as the next-hop and click (x) Create Variable.

Figure 72. CLI configuration

9. In the dialog window, enter a variable name (Loopback-Tun-Src-Next-Hop-IP). This CLI template can apply toseveral WAN Edge routers. Click Create Variable.

Figure 73. Create variable name

10. Click Save/Update.

©2024 Zscaler, Inc. All rights reserved.

83

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 3: (Optional) IOS XE SD-WAN Only: Configure Source IP-Based ECMP
Clipboard-list Note
In this version of code, you can configure source IP-based ECMP only when the WAN Edge router is in CLI mode. You
first change the WAN Edge router to CLI mode and then you can configure the ip cef load-sharing algorithm
src-only command. You must then keep the router in CLI mode. If you try to use an add-on CLI template (or any
device template), the ECMP configuration returns to the default, which is 4-tuple. This seems to affect hardware-based
IOS XE SD-WAN routers and is fixed in 17.12.
1. Edit the CLI add-on feature template created or modified in Procedure 2.
2. On a separate line in the configuration, enter the command ip cef load-sharing algorithm src-only.

Figure 74. CLI-Template©2024 Zscaler, Inc. All rights reserved.

84

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 4: Create a New SIG Feature Template with Two Active Tunnels (Cisco IOS XE SD-WAN
Only)
1. In the Cisco SD-WAN Manager, go to Configuration > Templates and click Feature Templates. Click Add Template,select the devices the feature template can apply to. Under VPN, select the Cisco Secure Internet Gateway (SIG)
template. Enter the Template Name (xeSig_Zscaler_2_Loopback_Source) and Description (Sig Zscaler 2
Tunnels with Loopback Source).
2. Next to SIG Provider, click Zscaler.
3. Under Tracker (BETA), select Device Specific and use the variable vpn_trackersrcip.
4. Under Configuration, click Add Tunnel.
5. Next to Tunnel Type, select ipsec or gre. The default is ipsec. After you choose a tunnel type, any additionaltunnels configured in the SIG template are automatically chosen for the same type. IPSec is used in this example.
6. Next to Interface Name, use the global parameter type. Specify an Interface Name, which is the keyword ipsec orgre, followed by a number 1-255 (example: ipsec1 or gre1). Name the tunnel ipsec101.
7. Next to Description, choose the Global parameter and enter an optional Description (Primary DC Tunnel 1).
8. Next to Tunnel Source Interface, select Device Specific and create a variable for this parameter (pri_tunnel1_src_int).
Clipboard-list Note
Before version 20.8/17.8, if you are using loopback interfaces as a Tunnel Source Interface, use a global parameter.
When you specify a loopback interface, a Tunnel Route-via Interface field is added to the feature template so you canspecify which physical interface is associated with which loopback interface. This directs data traffic out the properinterface.
9. Next to Data-Center, select the data center that terminates this tunnel (Primary). Each data center location (primaryor secondary) is selected automatically when the configuration is deployed, or is assigned manually in a later section.

Figure 75. Add tunnel©2024 Zscaler, Inc. All rights reserved.

85

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

10. (GRE only) GRE tunnels must register their public source IP address through the API calls. Next to Source Public IP,
select Device Specific and create a variable for this parameter (pri_tunnel1_src_public_ip).
11. Leave the parameters under Advanced Options as defaults.
12. Click Add.
13. Finish configuring the tunnel interfaces by repeating steps 1–12 so that you have two tunnels with the following
characteristics. All active tunnels point to the primary data center.
SectionParameter

Type

Variable/Value

Configuration

Interface Name

Globalipsec101

Description

GlobalPrimary DC Tunnel 1

Tunnel Source Interface

Device Specificpri_tunnel1_src_int

Data-Center

Radio Button

Primary

Interface Name

GlobalIpsec102

Description

GlobalPrimary DC Tunnel 2

Tunnel Source Interface

Device Specificpri_tunnel2_src_int

Data-Center

Radio Button

Primary

Data-Center

Radio Button

Primary

Configuration

14. Under High Availability, add one additional tunnel pair and assign ipsec101 under the Active column for Pair-1 andipsec102 under the Active column for Pair-2.

Figure 76. High availability

15. Click Save to save the new SIG feature template.

Procedure 5: Modify Device Template
Add the SIG feature template to the device template. This step assumes there is no previously defined SIG featuretemplate configuration. If a template configuration is already defined, Zscaler recommends you delete it from the device
template and push the configuration changes to the router before adding the new tunnel configuration.
1. Go to Configuration > Templates. Under the Device Templates tab, next to the device template you want to modify,
click … on the right-hand side, and select Edit from the drop-down menu.
2. Under Transport & Management VPN, click Cisco Secure Internet Gateway on the right-side under Additional
Cisco VPN 0 Templates.
3. Choose the new SIG template created in the last procedure (xeSig_Zscaler_2_Loopback_Source).
4. Click Cisco VPN Interface Ethernet on the right-hand side two times under Additional Cisco VPN 0 Templates andthen select xeLoopback1 for one, and xeLoopback2 for the other.

©2024 Zscaler, Inc. All rights reserved.

86

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Figure 77. Transport & Management VPN

5. Under Additional Templates, choose the CLI Add-On Template created earlier (CLI-Template).
6. Before you save the device template, you must attach the SIG Credentials template. In SD-WAN Manager version
20.9 and later, this is done automatically when a SIG feature template is attached to the device template. If runningan earlier SD-WAN Manager version, next to Cisco SIG Credentials *, attach the SIG credentials feature template thatwas built in the Deploy: Cisco WAN Edge Prerequisites section.
7. Click Update.

Figure 78. Additional templates©2024 Zscaler, Inc. All rights reserved.

87

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

8. Next to the device you need to define values for, click … and select Edit Device Template.
9. Fill in values for the variables created in the feature template.
10. Click Update.

Figure 79. Variable list

The following image shows the updated device template.

Figure 80. Update device template

11. Click Next, then Configure Devices. After the configuration changes are pushed to the WAN Edge, the status
displays as Success.
12. Verify tunnel operation.

©2024 Zscaler, Inc. All rights reserved.

88

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Procedure 6: Add Centralized Data Policy for Traffic Redirection
This section assumes a centralized policy already exists in the network and is activated on the Cisco SD-WAN Controllers.
An example data policy is constructed which directs:• Company destination traffic to take the SD-WAN overlay tunnels.
• DNS requests to use the DIA (if the internet transport fails, traffic is routed over the overlay).
• Box application traffic to use the DIA (if the internet transport fails, traffic is routed over the overlay).
• The remaining traffic over the SIG tunnels.
1. Go to Configuration > Policies > Custom Options > Lists (under Centralized Policy).

Figure 81. Cisco SD-WAN Manager custom options

2. Select Data Prefix from the left-side pane and create a Prefix List called Overlay that contains the 10.0.0.0/8 prefix
and any other site prefix/summary advertised into the SD-WAN overlay.

Figure 82. Define lists©2024 Zscaler, Inc. All rights reserved.

89

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

3. Select Application from the left-side pane and create a New Application List called Box.

Figure 83. Application list name

4. Ensure the WAN Edge router to which you are applying the policy is defined in a site list and there is a VPN list that
contains the VPN to which you want to apply the policy. If not, create the site list.

Figure 84. VPN policy

5. The service VPN for Zscaler traffic is VPN1. Create the VPN list if needed.

Figure 85. New VPN list

©2024 Zscaler, Inc. All rights reserved.

90

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

6. To edit or create a new traffic policy for a WAN Edge router, go to Custom Options and under Centralized Policy,
select Traffic Policy.

Figure 86. Configuration policies

7. Click the Traffic Data tab at the top of the page.

Figure 87. Traffic data

8. If there is already a data policy attached to the WAN Edge router site to which you want to add a SIG data policy,
choose to edit the existing policy, or create a new data policy and import it into the master policy already attachedto the Cisco SD-WAN Controllers. In this example, a new data policy is created and imported into a master policy
already attached to the Cisco SD-WAN Controllers.
9. Click Add Policy and select Create New from the drop-down menu.

Figure 88. Add policy

10. Name the Data Policy (Sig_Data) and give it a Description (Data Policy for Sig Data).

©2024 Zscaler, Inc. All rights reserved.

91

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

11. Click Sequence Type and select Custom.

Figure 89. Sequence type

12. Click Sequence Rule. Select Match and Actions, then click Save Match and Actions. Repeat as needed to complete
the policy.

Figure 90. Sequence rule

In this example, the following policy is configured:
Sequence Rule

Match Parameter

Match Value

Action/s

1

Destination Data Prefix

Overlay

Accept2

DNS

RequestAccept/NAT VPN with Fallback

3

Application/Application Family List

Box

Accept/NAT VPN with Fallback

4<empty>Accept/Secure Internet Gateway
with Fallback

13. (Optional) Change Default Action from Drop to Accept for your policy if necessary.

©2024 Zscaler, Inc. All rights reserved.

92

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Clipboard-list Tech Tip
In earlier versions of IOS XE SD-WAN code and all versions of vEdge code, there is no fallback support for policy,
which means if all the SIG tunnels go down on the router, the data policy still forwards traffic to the SIG service,
resulting in traffic blackholing. If you are running earlier versions of code, you can redesign the policy so SIG trafficis routed normally by using an Accept action and then configuring a SIG service route in the service VPN so SIG
traffic is directed to the SIG tunnel, which supports fallback routing. If the SIG tunnels fail, the SIG service route isremoved so traffic can follow routes in the SD-WAN overlay. Fallback routing for centralized data policy directing
traffic to SIG is supported starting in 20.8.1 SD-WAN Manager/17.8.1 IOS XE SD-WAN versions of code.
14. Click Save Data Policy.
15. Import this new data policy into the master policy already attached to the Cisco SD-WAN Controllers. In the Cisco
SD-WAN Manager, go to Configuration > Policies. Ensure Centralized Policy is selected. Choose to Edit the master
policy (Central_Policy) that is currently activated.

Figure 91. Edit policy

16. Click Traffic Rules at the top of the page so the new data policy is imported into the master policy. Click the Traffic
Data tab. Click Add Policy and choose Import Existing from the drop-down menu.

Figure 92. Traffic data policy©2024 Zscaler, Inc. All rights reserved.

93

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

17. In the dialog window, select the policy name created and click Import.
18. After the policy is imported, apply it to a site list and VPN list. Click Policy Application at the top of the page. Selectthe Traffic Data tab. Under Sig_Data, click New Site/Region List and VPN List.
19. Ensure the radio button From Service is selected so data policy is applied to traffic coming from the service VPN.
Choose Select Site List (Zscaler-DataPolicy-Sites) and Select VPN List (VPN1). Click Add, then Save Policy Changes.
A dialog window appears to push the update policy to the Cisco SD-WAN Controllers.

Figure 93. Policy application

20. Click Activate.

Procedure 7: (Optional) Assign Tunnel Weights
In this section, different tunnel weights are assigned to the active tunnels.
1. In the Cisco SD-WAN Manager, go to Configuration > Templates > Feature Templates. To the right of the SIG
template that was created in the earlier section (xeSig_Zcaler_2_Loopback_Source), click … and select Edit from thedrop-down menu.
2. Under the High Availability section, configure the Active Weight column for each active tunnel.
SectionParameter

Type

Variable/value

High Availability/Pair-1

ActiveGlobalipsec101

Active Weight

Global80

ActiveGlobalIpsec102

Active Weight

Global20

High Availability/Pair-2

3. Click Update to save changes to the SIG feature template.
4. Click Next, then Configure Devices. You might need to confirm configuration changes on multiple devices. Selectthe checkbox and click OK. The configuration changes are pushed out to the attached WAN Edge routers.

©2024 Zscaler, Inc. All rights reserved.

94

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

OperateThe following shows different ways to monitor the Zscaler tunnels.

Verify Cisco Catalyst SD-WAN Tunnel Operation from the Cisco SD-WAN Manager
1. In the Cisco SD-WAN Manager under Monitor > Network, click the SIG Tunnels tab to view the tunnel status andany events related to the SIG tunnel.
2. Click the WAN Edge router that you want to verify the tunnel operation on.

Figure 94. Interface real time

3. Select Applications > Interface > Real Time at the top right of the chart. You can also click the interface you areinterested in on the right-hand side of the chart.
4. If the interface you are interested in is missing from the graph, scroll down past the chart to see the entire list ofinterfaces. Select the checkbox on the left for the interface you want to display on the chart. You can also view thestate and statistics of the various interfaces on the device from this list.

Figure 95. Interface details©2024 Zscaler, Inc. All rights reserved.

95

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Verify Cisco Catalyst SD-WAN Event Logs from the Cisco SD-WAN Manager
1. In the Cisco SD-WAN Manager, go to Monitor > Events.
2. In the top right-side corner, you can select the time frame over which to see the events. The default is over the last
three hours.
3. In the search bar, type something to narrow your search. In this example, you see all the WAN_EdgeB device eventsin the last hour.

Figure 96. Select resource group

Events are generated when a location is created, when VPN credentials are associated with the tunnel, and when thetunnel state comes up.

©2024 Zscaler, Inc. All rights reserved.

96

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Verify Zscaler Tunnel Status in ZIA Admin
If you want to check the status of tunnels to ZIA from your sites, ZIA shows the traffic volume sent/received from your
SD-WAN appliances to see the current state of the tunnels via logging.
In the ZIA Admin Portal, go to Analytics > Insights > Tunnel Insights.

Figure 97. Tunnel insights

On the Insights tab, you can visualize and filter data in various ways. You can select how to categorize all tunnel traffic
to graph from the drop-down menu under Tunnel Insights (by Overall Traffic, Location, Location Group, Location Type,
Tunnel Destination IP, Tunnel Source IP, Tunnel Type, or by VPN Credential). You can also configure the Timeframe,
ChartType, and Metrics you want to view. Additionally, you can filter the data shown in the chart even further by clicking
the Add Filter drop-down menu and selecting various filter types and values.

Figure 98. Tunnel insights

To learn more, see ZIA Tunnel Data Types and Filters (government agencies, see ZIA Tunnel Data Types and Filters).

©2024 Zscaler, Inc. All rights reserved.

97

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Verify Zscaler Tunnel Event Logs in ZIA Admin
Tunnel Logging
To assist in troubleshooting, you can also view the state of all tunnels for your tenant from the ZIA Admin Portal. Click
Logs. From this tab, you can then filter and change the time frame for the tunnels and sites you would like to investigate.

Figure 99. Insights log

For more information, see ZIA Tunnels Insights Logs: Columns (government agencies, see ZIA Tunnels Insights Logs:
Columns).

View API Calls in Zscaler ZIA (Audit Logs)
You can view the changes made to the tenant environment using the Audit Logs feature. This also allows you to view API
calls into the platform.
1. Go to Administration > Authentication > Audit Logs.

Figure 100. Audit logs

2. In the Audit Logs window, you can filter out all changes to only view the API calls by selecting API from the Interface
drop-down menu.

©2024 Zscaler, Inc. All rights reserved.

98

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

A list of all the API interactions is displayed, where the Result column shows whether the call was successful or failed.

Figure 101. Audit logs

Click an icon in the Result column to see the API data that was created or updated from the call.

Figure 102. Configuration changes©2024 Zscaler, Inc. All rights reserved.

99

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Verify Zscaler ZIA Service Configuration
Use the URL https://ip.zscaler.com from a host PC at a site to validate if you are transiting ZIA. This is what you see if you
are not transiting ZIA:

Figure 103. ZIA transit traffic failIf you are transiting ZIA, you see the following:

Figure 104. ZIA transit traffic success

Verify Zscaler Tunnel Operation Using Cisco IOS XE SD-WAN CLI
SSH to the WAN Edge router either directly or through the Cisco SD-WAN Manager (Tools > SSH Terminal) and run thefollowing commands to verify the Zscaler tunnel operation using Cisco IOS XE SD-WAN CLI. Note that after the Zscaler
API calls are successfully completed, IKEv2 and IPSec phase 2 can establish sessions. When this completes successfully, L7
health checks can start running over the tunnels.
• show ip interface brief: Shows interface state.
• show sdwan secure-internet-gateway zscaler tunnels: Shows ZIA tunnel information and last API state(only applies to automatic tunnels).
• show crypto ikev2 session: Shows crypto Internet Security Association and Key Management Protocol(ISAKMP) (v2) sessions.
• show crypto ipsec sa: Shows ipsec encryption/decryption statistics.
• show ip route vrf <service vpn>: Shows routing information for the service VPN.
• show interface <tunnel>: Shows traffic statistics.
• show endpoint-tracker: Shows L7 health tracker information.
• show endpoint-tracker records: Shows L7 health tracker information.
• show ip sla statistics: Shows L7 health tracker information.
The following are examples of these commands:
WAN_EdgeE#sh ip interface brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0/0 64.100.215.2 YES other up up
GigabitEthernet0/0/1 10.215.10.1 YES other up up
GigabitEthernet0/0/2 192.168.215.2 YES other up up
Service-Engine0/4/0 unassigned YES unset up up©2024 Zscaler, Inc. All rights reserved. 100

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

GigabitEthernet0 192.168.255.135 YES other up up
Sdwan-system-intf 10.255.255.215 YES unset up up
Loopback65528 192.168.1.1 YES other up up
Loopback65530 10.11.11.1 YES other up up
NVI0 unassigned YES unset up up
Tunnel0 64.100.215.2 YES TFTP up up
Tunnel2 192.168.215.2 YES TFTP up up
Tunnel100101 64.100.215.2 YES TFTP up up
Tunnel100201 64.100.215.2 YES TFTP up up
WAN_EdgeE#show sdwan secure-internet-gateway zscaler tunnels---------------------------------------------------------------------------Tunnel100101 site215sys10x255x255x215ifTunnel100101 30556720 <removed> add-vpn-credential-info 30558350 location-init-state get-data centers 200
Tunnel100201 site215sys10x255x255x215ifTunnel100201 30556721 <removed> add-vpn-credential-info 30558350 location-init-state get-data centers 200
WAN_EdgeE#show crypto ikev2 session
IPv4 Crypto IKEv2 Session
Session-id:6, Status:UP-ACTIVE, IKE count:1, CHILD count:1
Tunnel-id Local Remote fvrf/ivrf Status
2 64.102.254.147/500 104.129.206.161/500 none/none READY
Encr:AES-CBC, keysize:256, PRF:SHA256, Hash:SHA256, DH Grp:14, Auth sign:PSK, Authverify:PSK
Life/Active Time: 86400/949 sec
Child sa: local selector 0.0.0.0/0 - 255.255.255.255/65535
remote selector 0.0.0.0/0 - 255.255.255.255/65535
ESP spi in/out: 0x99AD50D4/0x3F86E386
Session-id:5, Status:UP-ACTIVE, IKE count:1, CHILD count:1
Tunnel-id Local Remote fvrf/ivrf Status
1 64.102.254.147/500 165.225.8.35/500 none/none READY
Encr:AES-CBC, keysize:256, PRF:SHA256, Hash:SHA256, DH Grp:14, Auth sign:PSK, Authverify:PSK
Life/Active Time: 86400/949 sec
Child sa: local selector 0.0.0.0/0 - 255.255.255.255/65535
remote selector 0.0.0.0/0 - 255.255.255.255/65535
ESP spi in/out: 0x75ABF7D3/0x25E5276B©2024 Zscaler, Inc. All rights reserved. 101

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

WAN_EdgeE#show crypto ipsec sa
interface: Tunnel0
Crypto map tag: Tunnel0-vesen-head-0, local addr 64.102.254.147
protected vrf: (none)
local ident (addr/mask/prot/port): (64.102.254.147/255.255.255.255/0/12387)
remote ident (addr/mask/prot/port): (64.102.254.146/255.255.255.255/0/12426)
current_peer 64.102.254.146 port 12426
PERMIT, flags={origin_is_acl,}#pkts encaps: 32144, #pkts encrypt: 32144, #pkts digest: 32144#pkts decaps: 32144, #pkts decrypt: 32144, #pkts verify: 32144
WAN_EdgeE#show ip route vrf 1…
Gateway of last resort is 0.0.0.0 to network 0.0.0.0
S* 0.0.0.0/0 [2/65535], Tunnel100101
10.0.0.0/8 is variably subnetted, 26 subnets, 3 masks
m 10.4.0.0/30 [251/0] via 10.255.255.202, 2d03h, Sdwan-system-intf[251/0] via 10.255.255.201, 2d03h, Sdwan-system-intf
m 10.4.0.4/30 [251/0] via 10.255.255.202, 2d03h, Sdwan-system-intf[251/0] via 10.255.255.201, 2d03h, Sdwan-system-intf
m 10.4.0.8/30 [251/0] via 10.255.255.202, 2d03h, Sdwan-system-intf[251/0] via 10.255.255.201, 2d03h, Sdwan-system-intf
WAN_EdgeE#show interface Tunnel100101
Tunnel100101 is up, line protocol is up
Hardware is Tunnel
Description: Primary DC Tunnel 1
Interface is unnumbered. Using address of GigabitEthernet0/0/0 (64.100.215.2)
MTU 9950 bytes, BW 100 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 51/255, rxload 5/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel linestate evaluation up
Tunnel source 64.100.215.2 (GigabitEthernet0/0/0), destination 165.225.48.10
WAN_EdgeG#show interface Tunnel100612
Tunnel100612 is up, line protocol is up
Hardware is TunnelInterface is unnumbered. Using address of GigabitEthernet0/0/0 (64.102.254.146)©2024 Zscaler, Inc. All rights reserved. 102

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

MTU 9976 bytes, BW 100 Kbit/sec, DLY 50000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation TUNNEL, loopback not set
Keepalive not set
Tunnel linestate evaluation up
Tunnel source 64.102.254.146 (GigabitEthernet0/0/0), destination 104.129.194.45
Tunnel Subblocks:
src-track:
Tunnel100612 source tracking subblock associated with GigabitEthernet0/0/0
Set of tunnels with source GigabitEthernet0/0/0, 3 members (includes

iterators)

Tunnel protocol/transport GRE/IP
WAN_EdgeE#show endpoint-tracker
Interface
Next Hop

Record Name

Status

RTT in msecs

Probe ID

Tunnel100101
None#SIGL7#AUTO#TRACKER

Up

10

5

Tunnel100201
None#SIGL7#AUTO#TRACKER

Up

11

6

WAN_EdgeE#show endpoint-tracker records
Record Name
Tracker-Type

Endpoint

EndPoint TypeThreshold(ms) Multiplier Interval(s)#SIGL7#AUTO#TRACKER http://gateway.zscalerthree.net/vpn API_URL
interface

1000

2

30

WAN_EdgeE#show ip sla statistics
IPSLAs Latest Operation Statistics
IPSLA operation id: 11
Latest RTT: 32 milliseconds
Latest operation start time: 03:02:28 UTC Wed Nov 24 2021
Latest operation return code: OK
Latest DNS RTT: 10 ms
Latest TCP Connection RTT: 11 ms
Latest HTTP Transaction RTT: 11 ms
Number of successes: 69
Number of failures: 1
Operation time to live: Forever©2024 Zscaler, Inc. All rights reserved. 103

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

IPSLA operation id: 12
Latest RTT: 37 milliseconds
Latest operation start time: 03:02:28 UTC Wed Nov 24 2021
Latest operation return code: OK
Latest DNS RTT: 11 ms
Latest TCP Connection RTT: 15 ms
Latest HTTP Transaction RTT: 11 ms
Number of successes: 69
Number of failures: 1
Operation time to live: Forever

Verify Zscaler Tunnel Operation using Cisco vEdge CLI
SSH to the WAN Edge router either directly or through the Cisco SD-WAN Manager (Tools > SSH Terminal) and run thefollowing commands to verify the Zscaler tunnel operation using Cisco vEdge CLI. Note that after the Zscaler API calls
are successfully completed, IKEv2 and IPSec phase 2 can establish sessions. When this completes successfully, L7 healthchecks can start running over the tunnels.
• show interface | tab | in ipsec: Shows tunnel state.
• show secure-internet-gateway zscaler tunnels: Shows ZIA tunnel information and last API state.
• show ipsec ike sessions: Shows crypto ISAKMP (v2) sessions.
• show tunnel statistics ipsec: Shows ipsec encryption/decryption statistics.
• show ip route vpn <service vpn>: Shows routing information for the service VPN.
• show ip fib vpn <service vpn>: Shows next hop information for the service VPN.
• show ip nat filter or show ip nat filter | tab: Shows active nat translations.
• show interface statistics: Shows traffic statistics for each interface.
• show support tracker interface monitors: Shows L7 health tracker information.
The following are examples of these commands:
WAN_EdgeB# show interface | tab | in ipsec
0 ipsec101 ipv4 - Up Up Up vlan service 1400 00:00:00:00:00:01 1000 full 1316
0:05:32:03 4002 2524
0 ipsec201 ipv4 - Up Up Up vlan service 1400 00:00:00:00:00:01 1000 full 1316
0:05:32:03 4009 2512
WAN_EdgeB# show secure-internet-gateway zscaler tunnels
zscaler tunnels ipsec101
tunnel-name site212sys10x255x255x212ifipsec101
tunnel-id 33685023
fqdn (REMOVED)
tunnel-fsm-state add-vpn-credential-info©2024 Zscaler, Inc. All rights reserved. 104

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

location-id 33685046
location-fsm-state location-init-state
last-http-req get-data centers
http-resp-code 200
zscaler tunnels ipsec201
tunnel-name site212sys10x255x255x212ifipsec201
tunnel-id 33685030
fqdn (REMOVED)
tunnel-fsm-state add-vpn-credential-info
location-id 33685046
location-fsm-state location-init-state
last-http-req get-data centers
http-resp-code 200
WAN_EdgeB# show ipsec ike sessions
ipsec ike sessions 0 ipsec101
version 2
source-ip 64.100.212.2
source-port 4500
dest-ip 104.129.206.161
dest-port 4500
initiator-spi 11e994148c8c114c
responder-spi ba604f6bfa667181
cipher-suite aes256-cbc-sha1
dh-group "2 (MODP-1024)"
state IKE_UP_IPSEC_UP
uptime 0:02:17:35
tunnel-uptime 1:01:16:19
ipsec ike sessions 0 ipsec201
version 2
source-ip 64.100.212.2
source-port 4500
dest-ip 165.225.34.44
dest-port 4500
initiator-spi 0a977da74a8ca235
responder-spi dc36839e3b9138e4
cipher-suite aes256-cbc-sha1
dh-group "2 (MODP-1024)"©2024 Zscaler, Inc. All rights reserved. 105

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

state IKE_UP_IPSEC_UP
uptime 0:02:15:45
tunnel-uptime 1:01:16:19
WAN_EdgeB# show tunnel statistics ipsec
IPSEC IPSEC RX IPSEC IPSEC TX
TUNNEL SOURCE DEST DECRYPT AUTH IPSEC RX ENCRYPT AUTH IPSEC TX
PROTOCOL SOURCE IP DEST IP PORT PORT IN FAIL FAIL OUT FAIL FAIL---------------------------------------------------------------------------ipsec 64.100.212.2 64.100.1.23 12346 10424 370572 1 0 370570 0 8
ipsec 64.100.212.2 64.100.1.24 12346 65008 370594 1 0 370593 0 7
ipsec 64.100.212.2 104.129.206.161 4500 4500 15168 0 0 18970 0 0
ipsec 64.100.212.2 165.225.34.44 4500 4500 15176 0 0 18977 0 0
WAN_EdgeB# show ip route vpn 1
PROTOCOL NEXTHOP NEXTHOP NEXTHOPVPN PREFIX PROTOCOL SUB TYPE IF NAME ADDR VPN TLOC IP COLOR ENCAP STATUS---------------------------------------------------------------------------1 0.0.0.0/0 std-ipsec - ipsec101 - 0 - - - F,S
1 0.0.0.0/0 omp - - - - 10.255.255.201 mpls ipsec WAN_EdgeB# show ip fib vpn 1
NEXTHOP NEXTHOP NEXTHOP NEXTHOP SA
VPN PREFIX IF NAME ADDR LABEL VPN INDEX TLOC IP COLOR---------------------------------------------------------------------------1 0.0.0.0/0 ipsec 165.225.48.10 - - 34 - 1 10.4.0.0/30 ipsec 10.4.1.2 1003 - 7 10.255.255.201 mpls
1 10.4.0.0/30 ipsec 64.100.1.23 1003 - 28 10.255.255.201 biz-internet
WAN_EdgeB# show ip nat filter (or show ip nat filter | tab)
ip nat filter nat-vpn 0 nat-ifname ge0/0 vpn 0 protocol udp 64.100.212.2 64.102.254.147
public-source-address 64.100.212.2
public-dest-address 64.102.254.147
public-source-port 12346
public-dest-port 12367
filter-state establishedidle-timeout 0:00:00:59
outbound-packets 3296
©2024 Zscaler, Inc. All rights reserved. 106

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

outbound-octets 519226
inbound-packets 3294
inbound-octets 593424
ip nat filter nat-vpn 0 nat-ifname ge0/2 vpn 0 protocol udp 10.10.10.1 104.129.206.161
public-source-address 192.168.212.2
public-dest-address 104.129.206.161
public-source-port 4500
public-dest-port 4500
filter-state establishedidle-timeout 0:00:00:52
outbound-packets 15105
outbound-octets 1851428
inbound-packets 15077
inbound-octets 1846978
WAN_EdgeB# show interface statistics
AF RX RX RX RX TX TX TX TX RX RX TX TX
VPN INTERFACE TYPE PACKETS OCTETS ERRORS DROPS PACKETS OCTETS ERRORS DROPS PPS Kbps PPS
Kbps
0 ge0/0 ipv4 423562 70604112 0 213 437205 74796702 0 0 17 22 17 23
0 ipsec101 ipv4 4333 536138 0 0 2731 340154 0 0 0 0 0 0
0 ipsec201 ipv4 4336 536532 0 0 2717 337982 0 0 0 0 0 0
WAN_EdgeB# show support tracker interface monitors
Interface: ipsec101/#SIGL7#AUTO#TRA#ZIA
Monitor: 65530/http://gateway.zscalerthree.net/vpntest/80 via ipsec101
Monitor state : UP (flapped 0 times)
Ref count : 1
Monitor type : httping
Probe / DNS SIP : 192.168.0.2 / ::Nameserver IP : 208.67.222.222
Src Port Base : 49172
Num of probes : 1
Max Re-transmit : 2
First Probe : 0 secs
Probe interval : 30 secs
Probe timeout : 1000 msecs
DNS TTL : 96 secs

©2024 Zscaler, Inc. All rights reserved. 107

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

DNS query/ok/fail : 611/611/0
Peer: 165.225.48.11 (UP - flapped 0 times, nretries 0)
Total requests : 0 Total responses : 0
Total Tx errors : 0 Total Rx errors : 0
Total Tx skipped: 0 Total Rx ignored: 0
Total timeout : 0 Connect errors : 0
RTT min/avg/max : 0.00/0.00/0.00 ms
Conn min/avg/max: 0.00/0.00/0.00 ms
Interface: ipsec201/#SIGL7#AUTO#TRA#ZIA
Monitor: 65530/http://gateway.zscalerthree.net/vpntest/80 via ipsec201
Monitor state : UP (flapped 0 times)
Ref count : 1
Monitor type : httping
Probe / DNS SIP : 192.168.0.2 / ::Nameserver IP : 208.67.222.222
Src Port Base : 49173
Num of probes : 1
Max Re-transmit : 2
First Probe : 0 secs
Probe interval : 30 secs
Probe timeout : 1000 msecs
DNS TTL : 96 secs
DNS query/ok/fail : 611/611/0
Peer: 165.225.48.11 (UP - flapped 0 times, nretries 0)
Total requests : 0 Total responses : 0
Total Tx errors : 0 Total Rx errors : 0
Total Tx skipped: 0 Total Rx ignored: 0
Total timeout : 0 Connect errors : 0
RTT min/avg/max : 0.00/0.00/0.00 ms
Conn min/avg/max: 0.00/0.00/0.00 ms©2024 Zscaler, Inc. All rights reserved. 108

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Appendix A: Cisco Branch Base Feature Templates andConfiguration Values Used
This appendix shows the branch non-default base device and feature template configurations used and referenced inthis guide. Zscaler tunnel configurations in the main body of this guide are built on top of these configurations. For stepby-step instructions on configuring device and feature templates, refer to the Cisco SD-WAN End-to-End Deployment
Guide.

Feature Templates
You can apply these branch base configuration feature templates to Cisco vEdge or Cisco IOS XE SD-WAN routers.
However, you must define them for Cisco vEdge devices or Cisco IOS XE SD-WAN devices, but not both. From Cisco
SD-WAN Manager version 20.1 and later, feature templates cannot apply to both Cisco vEdge and Cisco IOS XE SD-WAN
devices–they must have separate feature templates. Each of the following template names are preceded by either v or
Cisco vEdge_ if the device type is a Cisco vEdge device, or an xe or xeEdge_ if the device type is a Cisco IOS XE SD-WAN
device.
When creating feature templates for Cisco vEdge routers, if you want to cover the most models possible when selecting
devices, select all ISR 1100 models with Cisco Viptela, and all Cisco vEdge devices (all Cisco vEdge 100 types, Cisco vEdge
1000, Cisco vEdge 2000, Cisco vEdge 5000, and Cisco vEdge Cloud).
When creating feature templates for Cisco IOS XE SD-WAN routers, if you want to cover the most models possible whenselecting devices, select all models except the ISR 1100 models with Cisco Viptela, all Cisco vEdge devices, CG (Cellular
Gateway) devices, Cisco SD-WAN Manager, and Cisco SD-WAN Controller devices. When creating SIG feature templates,
you must also exclude the IR104s and IR8340 from the device model list.

AAA feature template (Cisco IOS XE SD-WAN)
Template: Basic Information/Cisco AAA
Template Name: xeAAA
Description: AAA Template for WAN Edge Routers
SectionParameter

Type

Variable/Value

Local

Username

Globalnetadmin

Password

Global(hidden)Privilege Level

Global15

AAA feature template (Cisco vEdge)
Template: Basic Information/AAA
Template Name: vAAA
Description: AAA Template for WAN Edge Routers
SectionParameter

Type

Variable/Value

Local/New User

Name

Globalnetadmin

Password

Global(hidden)User Groups

Globalnetadmin©2024 Zscaler, Inc. All rights reserved. 109

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

NTP Feature Template
Template: Basic Information/Cisco NTP
Template Name: NTP
Description: NTP Template for WAN Edge Routers
SectionParameter

Type

Variable/Value

ServerHostname/IP address

Globaltime.google.com

Source Interface

Device Specificntp_server_source_int

Branch VPN0 Feature Template
Template: VPN/VPN
Template Name: BR_VPN0		
Description: VPN 0 Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

Basic Configuration

VPN

Global0

Name

GlobalTransport VPN

Enhance ECMP Keying

GlobalOn

Primary DNS Address

Global208.67.222.222

Secondary DNS Address

Global208.67.220.220

Hostname

Globalvbond.cisco.net

List of IP Addresses

Global64.100.100.113

PrefixGlobal

0.0.0.0/0

Gateway

Radio Button

Next Hop

Next Hop

Device Specificvpn0_next_hop_ip_addr_inet

Next Hop

Device Specificvpn0_next_hop_ip_addr_mpls

DNS

IPv4 RouteBranch Internet Interface Feature Template (Cisco IOS XE SD-WAN)
Template: VPN/VPN Interface Ethernet
Template Name: xeBR_VPN0_INET
Description: VPN 0 INET Interface Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

Basic Configuration

Shutdown

Device Specificvpn0_inet_shutdown

Interface Name

Device Specificvpn0_inet_int_name

Description

GlobalINET Interface

IPv4 AddressRadio Button

StaticIPv4 Address

Device Specificvpn0_inet_ipv4_addr

Tunnel Interface

GlobalOn

Color

Globalbiz-internet

Tunnel>Allow Service

NTP

Global

On

NAT

NAT

GlobalOn

NAT Type

GlobalInterface

IPv4 Configuration
Tunnel©2024 Zscaler, Inc. All rights reserved. 110

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Branch Internet Interface Feature Template (Cisco vEdge)
Template: VPN/VPN Interface Ethernet
Template Name: vBR_VPN0_INET
Description: VPN 0 INET Interface Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

Basic Configuration

Shutdown

Device Specificvpn0_inet_shutdown

Interface Name

Device SpecificDescription

GlobalINET Interface

IPv4 AddressRadio Button

StaticIPv4 Address

Device Specificvpn0_inet_ipv4_addr

Tunnel Interface

GlobalOn

Color

Globalbiz-internet

Tunnel>Allow Service

NTP

Global

On

NAT

NAT

GlobalOn

IPv4 Configuration
TunnelBranch MPLS Interface Feature Template
Template: VPN/VPN Interface Ethernet
Template Name: BR_VPN0_MPLS
Description: VPN 0 MPLS Interface Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

Basic Configuration

Shutdown

Device Specificvpn0_mpls_shutdown

Interface Name

Device Specificvpn0_mpls_int_name

Description

GlobalMPLS Interface

IPv4 AddressRadio Button

StaticIPv4 Address

Device Specificvpn0_mpls_ipv4_addr

Tunnel Interface

GlobalOn

Color

Globalmpls

Restrict

GlobalOn

NTP

GlobalOn

IPv4 Configuration
TunnelAllow Service

Branch VPN512 Interface Feature Template
Template: VPN/VPN Interface Ethernet
Template Name: VPN512_MGT_INT
Description: VPN 512 Management Interface Template for WAN Edge Routers
SectionParameter

Type

Variable/Value

Basic Configuration

Shutdown

GlobalNo

Interface Name

Device Specificvpn512_int_name

Description

GlobalMGT Interface

IPv4 AddressRadio Button

StaticIPv4 Address

Device Specificvpn512_int_ipv4_addr

IPv4 Configuration©2024 Zscaler, Inc. All rights reserved. 111

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Branch VPN 1 Feature Template
Template: VPN/VPN
Template Name: BR_VPN1
Description: VPN 1 Template for the WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

Basic Configuration

VPN

Global1

Name

GlobalLAN

Branch VPN1 Interface Feature Template
Template: VPN/VPN Interface Ethernet
Template Name: BR_VPN1_LAN_INT1
Description: VPN 1 LAN Interface Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

Basic Configuration

Shutdown

Device Specificvpn1_int1_shutdown

Interface Name

Device Specificvpn1_int1_name

Description

Device Specificvpn1_int1_description

IPv4 AddressRadio Button

StaticIPv4 Address

Device Specificvpn1_int1_ipv4_addr

IPv4 Configuration

Device Templates
The following device templates are used in this guide. The table indicates what non-default feature template is used.

Single WAN Edge Router Sites (Cisco IOS XE SD-WAN)
Device Model: ISR4331 [E], C8300-1N1S-6T [G]Template Name: xeEdge_Remote_[E,G]
Description: WAN Edge router remote site [E,G]
Template TypeTemplate Subtype

Template Name

Basic Information

Cisco NTP

xeNTP

Cisco AAA

xeAAA

Cisco VPN

xeBR_VPN0

Cisco VPN Interface

xeBR_VPN0_INET

Cisco VPN Interface

xeBR_VPN0_MPLS

VPN 512

Cisco VPN Interface

xeVPN512_MGT_INT

VPN 1

Cisco VPN1

xeBR_VPN1

Cisco VPN Interface

xeBR_VPN1_LAN_INT1

VPN 0©2024 Zscaler, Inc. All rights reserved. 112

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Single WAN Edge Router Sites (Cisco vEdge)
Device Model: Cisco vEdge-100b [A], ISR1100-4G [B]Template Name: Cisco vEdge_Remote_[A,B]
Description: WAN Edge router remote site [A,B]
Template TypeTemplate Subtype

Template Name

Basic Information

Cisco NTP

vNTP

Cisco AAA

vAAA

VPN

vBR_VPN0VPN Interface

vBR_VPN0_INETVPN Interface

vBR_VPN0_MPLS

VPN 512

VPN Interface

vVPN512_MGT_INT

VPN 1

VPN1

vBR_VPN1VPN Interface

vBR_VPN1_LAN_INT1

VPN 0

Device Variable Values
Variable

Cisco vEdge_
RemoteA

Cisco vEdge_
RemoteB

Cisco vEdge_RemoteE

Cisco vEdge_
RemoteG

Hostname

WAN_EdgeA

WAN_EdgeB

WAN_EdgeE

WAN_EdgeG

System IP

10.255.255.211

10.255.255.212

10.255.255.215

10.255.255.217

Site ID

211

212

215

217

Interface Name (vpn1_
ge0/0
int1_name)ge0/3

GigabitEthernet0/0/0

GigabitEthernet0/0/0

Description (vpn1_
int1_description)

LAN Interface

LAN Interface

LAN Interface

LAN Interface

IPv4 Address (vpn1_
int1_ipv4_addr)

10.211.10.1/24

10.212.10.1/24

10.215.10.1/24

10.217.10.1/24

Shutdown (vpn1_int1_
shutdown)

False

False

False

False

InterfaceName(vpn512_int_
name)

ge0/1

ge0/1

GigabitEthernet0

GigabitEthernet0

IPv4 Address(vpn512_
int_ipv4_addr)

192.168.255.153/23

192.168.255.181/23

192.168.255.135/23

192.168.255.93/23

Address(vpn0_next_
hop_ip_addr_inet)

64.102.254.151

64.100.212.1

64.102.254.151

64.100.217.1

Address(vpn0_next_
hop_ip_addr_mpls)

192.168.211.1

192.168.212.1

192.168.215.1

192.168.217.1

InterfaceName(vpn0_mpls_
int_name)

ge0/2

ge0/2

GigabitEthernet0/0/2

GigabitEthernet0/0/2

IPv4 Address(vpn0_
mpls_ipv4_addr)

192.168.211.2/30

192.168.212.2/30

192.168.215.2/30

192.168.217.2/30©2024 Zscaler, Inc. All rights reserved. 113

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Variable

Cisco vEdge_
RemoteA

Cisco vEdge_
RemoteB

Cisco vEdge_RemoteE

Cisco vEdge_
RemoteG

Shutdown (vpn0_
mpls_shutdown)

False

False

False

False

InterfaceName(vpn0_inet_int_
name)

ge0/4

ge0/0

GigabitEthernet0/0/0

GigabitEthernet0/0/0

IPv4 Address(vpn0_
inet_ipv4_addr)

64.102.254.146/28

64.100.212.2/28

64.102.254.147/28

64.100.217.2/28

Shutdown (vpn0_
inet_shutdown)

False

False

False

False

Source Interface (ntp_
server_source_int)

ge0/4

ge0/0

GigabitEthernet0/0/0

GigabitEthernet0/0/0©2024 Zscaler, Inc. All rights reserved. 114

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Appendix B: Tunnel Configuration Summary (Feature and Device
Templates)
For Cisco tunnel configuration, observe the following prerequisites.

Prerequisites• Verify that NAT is enabled on the internet interface that is used to access Zscaler.
• Verify that a primary and secondary DNS server is defined in the VPN 0 feature template.
• Verify NTP is enabled, synced, and the clock is correct.

Cisco VPN Interface Ethernet Feature Template
Template: VPN/VPN Interface Ethernet
Template Name: xeBR_VPN0_INET
Description: VPN0 INET Interface Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

NAT

NAT

GlobalOn

NAT Type

GlobalInterface

Cisco VPN Feature Template
Template: VPN/Cisco VPN
Template Name: xeBR_VPN0
Description: VPN0 Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

DNS

Primary DNS Address (IPv4)

Global208.67.222.222

Secondary DNS Address(IPv4)

Global208.67.220.220

Cisco VPN Feature Template
Template: Basic Information/Cisco NTP
Template Name: xeNTP
Description: NTP Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

ServerHostname/IP address

Globaltime.google.com

Source Interface

Device Specificntp_server_source_int©2024 Zscaler, Inc. All rights reserved. 115

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

SIG Credential Information from ZIA
SectionParameter

Type

Variable/Value

Organization

Administration > Company
Profile > Organization

Domains

ciscotest.net (example)

Partner Base URI

Administration >Authentication > Cloud
Base URL for your API
Service API Security > Cloud
Service API Key

zsapi.zscalerbeta.net/api/v1(example)

Username

Administration >Administration Controls >Administrator Management> Administrators

Partner Admin Login ID

sd-wan@ciscotest.net(example)

Password

Administration >Administration Controls >Administrator Management> Administrators

Partner Admin Password(hidden)Partner API Key

Administration > Settings> Cloud Configuration >Partner Integrations > SDWAN

Partner Name (Cisco SDWAN or Cisco Viptela) Key

ABCdef123GHI (example)

Cisco SIG Credentials Feature Template
Template: Other Templates/Cisco SIG Credentials
Template Name: xeSig_Credentials
Description: Cisco IOS XE Sig Credentials Template
SectionParameter

Type

Variable/Value

Basic Details

SIG Provider

Radio Button

Zscaler

Organization

Globalciscotest.net (example)

Partner Base URI

Globalzsapi.zscalerbeta.net/api/v1(example)

Username

Globalsd-wan@ciscotest.net(example)

Password

Global(hidden)Partner API Key

GlobalABCdef123GHI (example)©2024 Zscaler, Inc. All rights reserved. 116

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Example 1: Active/Standby Tunnels• Create a Cisco SIG feature template (IPSec or GRE).
• Add Cisco SIG feature Template and SIG Credential feature template (if needed) to the Device Template.

Cisco SIG Feature Template (GRE)Template: VPN/Cisco SIG
Template Name: xeSig_Zscaler
Description: IOS XE Sig Zscaler Template
SectionTracker (Beta)

Parameter

Type

Variable/ValueSIG Provider

Radio Button

Zscaler

Source IP Address

Device Specificvpn_trackersrcip

Interface Name

Globalgre101

Description

GlobalPrimary DC Tunnel 1

Tunnel Source Interface

Device Specificpri_tunnel1_src_int

Data-Center

Radio Button

Primary

Source Public IP

Device Specificpri_tunnel1_src_public_ip

Interface Name

Globalipsec201

Description

GlobalSecondary DC Tunnel 1

Tunnel Source Interface

Device Specificsec_tunnel1_src_int

Data-Center

Radio Button

SecondarySource Public IP

Device Specificsec_tunnel1_src_public_ip

ActiveGlobalgre101

BackupGlobalgre201

Parameter

Type

Variable/ValueSIG Provider

Radio Button

Zscaler

Source IP Address

Device Specificvpn_trackersrcip

Interface Name

Globalipsec101

Description

GlobalPrimary DC Tunnel 1

Tunnel Source Interface

Device Specificpri_tunnel1_src_int

Data-Center

Radio Button

Primary

Interface Name

Globalipsec201

Description

GlobalSecondary DC Tunnel 1

Tunnel Source Interface

Device Specificsec_tunnel1_src_int

Data-Center

Radio Button

Secondary

ActiveGlobalipsec101

BackupGlobalipsec201

Configuration
Tunnel Name (gre101)

Tunnel Name (gre201)

High Availability/Pair-1

Cisco SIG Feature Template (IPSec)
Template: VPN/Cisco SIG
Template Name: xeSig_Zscaler
Description: Cisco IOS XE Sig Zscaler Template
SectionTracker (Beta)
Tunnel Name (ipsec101)

Tunnel Name (ipsec201)

High Availability/Pair-1©2024 Zscaler, Inc. All rights reserved. 117

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Device Template
Template TypeTemplate Subtype

Template Name

Basic Information

Cisco NTP

xeNTP

Cisco AAA

xeAAA

Cisco VPN

xeBR_VPN0

Cisco SIG

xeSig_Zscaler

Cisco VPN Interface

xeBR_VPN0_INET

Cisco VPN Interface

xeBR_VPN0_MPLS

VPN 512

Cisco VPN Interface

xeVPN512_MGT_INT

VPN 1

Cisco VPN1

xeBR_VPN1

Cisco VPN Interface

xeBR_VPN1_LAN_INT1

Additional Templates (20.9 and later)

Cisco SIG Credentials*

Cisco-Zscaler-Global-Credentials(automatic)

Additional Templates (prior to 20.9)

Cisco SIG Credentials*

xeSig_Credentials

VPN 0

Example 2: Active/Active Tunnels (Cisco IOS XE SD-WAN Only)• Create loopback interfaces to use as tunnel sources.
• Create a local policy-based routing policy via CLI add-on template.
• Create a Cisco SIG Feature Template (GRE or IPSec)• Add loopback interface feature templates, CLI add-on template, Cisco SIG feature Template, and SIG Credential
feature template (if needed) to the Device Template.

Cisco VPN Interface Ethernet Feature Template
Template: VPN/Cisco VPN Interface Ethernet
Template Name: xeLoopback1
Description: Loopback 1 Tunnel Source
Clipboard-list Note
For GRE, loopback interfaces need to be publicly addressed, or translated with One-to-One NAT on an external
device. Use a device-specific parameter for the loopback IP address and define the variable before applying the device
template.

SectionParameter

Type

Variable/Value

Basic Configuration

Shutdown

GlobalNo

Interface Name

GlobalLoopback1

IPv4

Radio Button

StaticIPv4 Address/prefix-length

Global10.10.10.1/32©2024 Zscaler, Inc. All rights reserved. 118

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Cisco VPN Interface Ethernet Feature Template
Template: VPN/Cisco VPN Interface Ethernet
Template Name: xeLoopback2
Description: Loopback 2 Tunnel Source
Clipboard-list Note
For GRE, loopback interfaces need to be publicly addressed, or translated with One-to-One NAT on an external
device. Use a device-specific parameter for the loopback IP address and define the variable before applying the device
template.

SectionParameter

Type

Variable/Value

Basic Configuration

Shutdown

GlobalNo

Interface Name

GlobalLoopback2

IPv4

Radio Button

StaticIPv4 Address/prefix-length

Global10.10.10.2/32

Cisco CLI Add-On Feature Template
Template: Other Templates/CLI Add-On Template
Template Name: CLI-Template
Description: CLI Add-On Template
ip cef load-sharing algorithm src-only
ip access-list extended SIG
10 permit ip host 10.10.10.1 any
20 permit ip host 10.10.10.2 any!
route-map Tunnel-Control permit 10
match ip address SIG
set ip next-hop {{Loopback-Tun-Src-Next-Hop-IP}}!
ip local policy route-map Tunnel-Control

Cisco SIG Feature Template (GRE)Template: VPN/Cisco SIG
Template Name: xeSig_Zscaler_2_Loopback_Source
Description: Cisco IOS XE Sig Zscaler with 2 Active Active Tunnels Template
SectionConfiguration (gre101)

Parameter

Type

Variable/ValueSIG Provider

Radio Button

ZscalerInterface Name

Globalgre101

Description

GlobalPrimary DC Tunnel 1

Tunnel Source Interface

Device Specificpri_tunnel1_src_int

Data-Center

Radio Button

Primary

Source Public IP

Device Specificpri_tunnel1_src_public_ip©2024 Zscaler, Inc. All rights reserved. 119

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Configuration (gre102)

High Availability/Pair-1
High Availability/Pair-2

Interface Name

Globalgre102

Description

GlobalPrimary DC Tunnel 2

Tunnel Source Interface

Device Specificpri_tunnel2_src_int

Data-Center

Radio Button

Primary

Source Public IP

Device Specificpri_tunnel2_src_public_ip

ActiveGlobalgre101

BackupGlobalNone

ActiveGlobalGre102

BackupGlobalNone

Cisco SIG Feature Template (IPSec)
Template: VPN/Cisco SIG
Template Name: xeSig_Zscaler_2_Loopback_Source
Description: Cisco IOS XE Sig Zscaler with 2 Active Active Tunnels Template
SectionConfiguration (ipsec101)

Configuration (ipsec102)

High Availability/Pair-1
High Availability/Pair-2

Parameter

Type

Variable/ValueSIG Provider

Radio Button

ZscalerInterface Name

Globalipsec101

Description

GlobalTunnel 1 to Primary DC

Tunnel Source Interface

GlobalLoopback1

Data-Center

Radio Button

Primary

Tunnel Route-via Interface

Device Specificpri_tunnel1_route_via

Interface Name

GlobalIpsec102

Description

GlobalTunnel 2 to Primary DC

Tunnel Source Interface

GlobalLoopback2

Data-Center

Radio Button

Primary

Tunnel Route-via Interface

Device Specificpri_tunnel2_route_via

ActiveGlobalipsec101

BackupGlobalNone

ActiveGlobalIpsec102

BackupGlobalNone©2024 Zscaler, Inc. All rights reserved. 120

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Device Template
Template TypeTemplate Subtype

Template Name

Basic Information

Cisco NTP

xeNTP

Cisco AAA

xeAAA

Cisco VPN

xeBR_VPN0

Cisco SIG

xeSig_Zscaler_2_Loopback_Source

Cisco VPN Interface

xeBR_VPN0_INET

Cisco VPN Interface

xeBR_VPN0_MPLS

Cisco VPN Interface

xeLoopback1

Cisco VPN Interface

xeLoopback2

VPN 512

Cisco VPN Interface

xeVPN512_MGT_INT

VPN 1

Cisco VPN1

xeBR_VPN1

Cisco VPN Interface

xeBR_VPN1_LAN_INT1

CLI Add-On Template

CLI-Template-Sig-Local-Policy

VPN 0Additional Templates

Additional Templates (20.9 and above) Cisco SIG Credentials*

Cisco-Zscaler-Global-Credentials(automatic)

Additional Templates (prior to 20.9)

xeSig_Credentials

Cisco SIG Credentials*

Traffic Redirection
Service RouteBranch VPN1 Feature Template
Template: VPN/VPN Interface Ethernet
Template Name: xeBR_VPN1
Description: VPN 1 Template for WAN Edge Branch Routers
SectionParameter

Type

Variable/Value

Service RoutePrefixGlobal

0.0.0.0/0

Service

Default

SIG

Centralized Policy
Configuration > Policies > Custom Options > Centralized Policy > Lists
List Type

Name

Entries

Data Prefix

Overlay

10.0.0.0/8

Application

Box

Application/Box

Site

Zscaler-DataPolicy-Sites

212,214,215, 217

VPN

VPN1

1

©2024 Zscaler, Inc. All rights reserved. 121

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Configuration > Policies > Custom Options > Centralized Policy > Traffic Policy > Traffic Data
Sequence Type (Custom)
Sequence Rule

Match Parameter

Match Value

Action/s

1

Destination Data Prefix

Overlay

Accept2

DNS

RequestAccept/NAT VPN with
Fallback

3

Application/Application
Family List

Box

Accept/NAT VPN with
Fallback

4<empty>Accept/Secure Internet
Gateway with Fallback

Go to Configuration > Policies > Centralized Policy and Edit the master policy that is currently activated on the Cisco SDWAN Controllers.
Under Traffic Rules > Traffic Data, import the newly-created data policy.
Under Policy Application > Traffic Data, choose radio button From Service, and add Site List Zscaler-DataPolicy-Sites
and VPN List VPN1.

Miscellaneous
In the following section, the Cisco SIG feature template is modified.

Customize Health Tracker
SectionParameter

Type

Variable/Value

SectionParameter

Type

Variable/value

Service RoutePrefixGlobal

0.0.0.0/0

Service

Default

SIG

Enable Advanced Zscaler Features
SectionParameter

Type

Variable/Value

Advanced Settings

Enable Caution

GlobalOn

Customize Zscaler Tunnel Destinations (Primary and Secondary DCs)
SectionParameter

Type

Variable/Value

Advanced Settings

Primary Data-Center

Device Specificvpn_zlsprimarydc

Secondary Data-Center

Device Specificvpn_zlssecondarydc©2024 Zscaler, Inc. All rights reserved. 122

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Assign Tunnel Weights (Use with Active/Active Tunnels)
SectionParameter

Type

Variable/ValueHigh Availability/Pair-1

ActiveGlobalipsec101

Active Weight

Global80

BackupGlobalNone

ActiveGlobalIpsec102

Active Weight

Global20

BackupGlobalNone

High Availability/Pair-2©2024 Zscaler, Inc. All rights reserved. 123

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Appendix C: Cisco IOS XE SD-WAN CLI Configuration
This section demonstrates the CLI configuration to interoperate with Zscaler. These are equivalent to the feature anddevice templates shown earlier. Note that the recommended way to configure Cisco Catalyst SD-WAN devices is throughfeature and device templates from Cisco SD-WAN Manager.
To complete the CLI configuration, configure:• Base connectivity• Prerequisites• Common tunnel components• Use case example 1 or 2 (active/standby or active/active tunnel definitions)• Traffic redirection (service SIG route, service DIG data policy, or both)• Miscellaneous (optional features)

Base Connectivity
The following is a basic connectivity configuration for the Cisco IOS XE SD-WAN router. It includes one other transport(MPLS), which is not essential to the connectivity to Zscaler (except for internet access across the SD-WAN overlay tothe data center in case the local internet fails). Some default configurations have been removed. These configurations
correspond to feature and device templates shown in Appendix B: Tunnel Configuration Summary (Feature and Device
Templates).
systemsystem-ip 10.255.255.215
site-id 215
organization-name “ENB-Solutions - 216151”
vbond vbond.cisco.net port 12346!
hostname WAN_EdgeEvrf definition 1
description LAN
rd 1:1address-family ipv4
route-target export 1:1
route-target import 1:1
exit-address-family!
address-family ipv6
exit-address-family!
!
ip host vbond.cisco.net 64.100.100.113©2024 Zscaler, Inc. All rights reserved. 124

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

ip name-server 208.67.220.220 208.67.222.222
ip route 0.0.0.0 0.0.0.0 64.102.254.151
ip route 0.0.0.0 0.0.0.0 192.168.215.1
ip nat inside source list nat-dia-vpn-hop-access-list interface GigabitEthernet0/0/0
overload!
interface GigabitEthernet0
description MGT Interface
no shutdown
vrf forwarding Mgmt-intf
ip address 192.168.255.135 255.255.254.0
exit
interface GigabitEthernet0/0/0
description INET Interface
no shutdown
ip address 64.102.254.147 255.255.255.240
exitinterface GigabitEthernet0/0/1
description LAN Interface
no shutdown
vrf forwarding 1
ip address 10.215.10.1 255.255.255.0
exit
interface GigabitEthernet0/0/2
description MPLS Interface
no shutdown
ip address 192.168.215.2 255.255.255.252
exit
interface Tunnel0
no shutdown
ip unnumbered GigabitEthernet0/0/0
no ip redirects
ipv6 unnumbered GigabitEthernet0/0/0
no ipv6 redirects
tunnel source GigabitEthernet0/0/0
tunnel mode sdwan
exitinterface Tunnel2©2024 Zscaler, Inc. All rights reserved. 125

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

no shutdown
ip unnumbered GigabitEthernet0/0/2
no ip redirects
ipv6 unnumbered GigabitEthernet0/0/2
no ipv6 redirects
tunnel source GigabitEthernet0/0/2
tunnel mode sdwan
exit!
ntp server time.google.com source GigabitEthernet0/0/0 version 4
ntp source GigabitEthernet0/0/0!
sdwan
interface GigabitEthernet0/0/0
tunnel-interface
encapsulation ipsec weight 1color biz-internet
no allow-service all
no allow-service bgp
allow-service dhcp
allow-service dns
allow-service icmp
no allow-service sshd
no allow-service netconf
allow-service ntp
no allow-service ospf
no allow-service stunallow-service httpsno allow-service snmp
no allow-service bfd
exit
exit
interface GigabitEthernet0/0/2
tunnel-interface
encapsulation ipsec weight 1color mpls restrict
no allow-service all
no allow-service bgp©2024 Zscaler, Inc. All rights reserved. 126

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

allow-service dhcp
allow-service dns
allow-service icmp
no allow-service sshd
no allow-service netconf
allow-service ntp
no allow-service ospf
no allow-service stunallow-service httpsno allow-service snmp
no allow-service bfd
exit
exit

Prerequisites
The base configuration enables NTP to ensure an accurate clock and DNS. Enable NAT under the internet transport.
interface GigabitEthernet0/0/0
ip nat outside

Common Tunnel Components
The following are common tunnel components between the two use cases.

SIG Credentials
secure-internet-gateway
zscaler organization ciscotest.net
zscaler partner-base-uri zsapi.zscalerthree.net/api/v1
zscaler partner-key ABCdef123GHI
zscaler username sd-wan@ciscotest.net
zscaler password (REMOVED)

IKEv2 and IPSec Configuration
crypto ikev2 policy policy1-global
proposal p1-global!
crypto ikev2 profile if-ipsec101-ikev2-profile
no config-exchange request
dpd 10 3 on-demand
dynamic
lifetime 86400©2024 Zscaler, Inc. All rights reserved. 127

Zscaler and CISCO Catalyst SD-WAN Deployment Guide!
crypto ikev2 profile if-ipsec201-ikev2-profile
no config-exchange request
dpd 10 3 on-demand
dynamic
lifetime 86400!
crypto ikev2 proposal p1-global
encryption aes-cbc-128 aes-cbc-256
group 14 15 16
integrity sha1 sha256 sha384 sha512!
crypto ipsec transform-set if-ipsec101-ikev2-transform esp-null esp-sha-hmac
mode tunnel!
crypto ipsec transform-set if-ipsec201-ikev2-transform esp-null esp-sha-hmac
mode tunnel!
crypto ipsec profile if-ipsec101-ipsec-profile
set ikev2-profile if-ipsec101-ikev2-profile
set transform-set if-ipsec101-ikev2-transform
set security-association lifetime kilobytes disable
set security-association lifetime seconds 3600
set security-association replay window-size 512!
crypto ipsec profile if-ipsec201-ipsec-profile
set ikev2-profile if-ipsec201-ikev2-profile
set transform-set if-ipsec201-ikev2-transform
set security-association lifetime kilobytes disable
set security-association lifetime seconds 3600
set security-association replay window-size 512©2024 Zscaler, Inc. All rights reserved. 128

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Zscaler Location Settings
sdwan
service sig vrf global
zscaler-location-settingsauth-required false
xff-forward-enabled false
surrogate ip false
surrogate idle-time 0
surrogate display-time-unit MINUTE
surrogate ip-enforced-for-known-browsers false
surrogate refresh-time 0
surrogate refresh-time-unit MINUTE
ofw-enabled false
ips-control false
aup disabled
aup block-internet-until-accepted true
aup force-ssl-inspection false
aup timeout 0
caution-enabled false

L7 Health Check Configuration
vrf definition 65530
address-family ipv4
exit-address-family!
interface Loopback65530
no shutdown
vrf forwarding 65530
ip address 10.11.11.1 255.255.255.255
exit
ip sdwan route vrf 65528 10.0.0.1/32 service sig©2024 Zscaler, Inc. All rights reserved. 129

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Use Case Example 1: Active/Standby Tunnels
IPSec Tunnels Definedinterface Tunnel100101
description Primary DC Tunnel 1
no shutdown
ip unnumbered GigabitEthernet0/0/0
no ip clear-dont-fragment
ip mtu 1400
tunnel source GigabitEthernet0/0/0
tunnel destination dynamic
tunnel mode ipsec ipv4
tunnel protection ipsec profile if-ipsec101-ipsec-profile
tunnel vrf multiplexing
exit
interface Tunnel100201
description Secondary DC Tunnel 1
no shutdown
ip unnumbered GigabitEthernet0/0/0
no ip clear-dont-fragment
ip mtu 1400
tunnel source GigabitEthernet0/0/0
tunnel destination dynamic
tunnel mode ipsec ipv4
tunnel protection ipsec profile if-ipsec201-ipsec-profile
tunnel vrf multiplexing
exit

GRE Tunnels Definedinterface Tunnel100612
ip unnumbered GigabitEthernet0/0/0
ip mtu 1400
tunnel source GigabitEthernet0/0/0
tunnel destination dynamic
tunnel route-via GigabitEthernet0/0/0 mandatory
tunnel vrf multiplexing!
interface Tunnel100712
ip unnumbered GigabitEthernet0/0/0©2024 Zscaler, Inc. All rights reserved. 130

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

ip mtu 1400
tunnel source GigabitEthernet0/0/0
tunnel destination dynamic
tunnel route-via GigabitEthernet0/0/0 mandatory
tunnel vrf multiplexing

Zscaler Tunnel Options
sdwan
interface Tunnel100101
tunnel-options tunnel-set secure-internet-gateway-zscaler tunnel-dc-preference
primary-dc source-interface GigabitEthernet0/0/0
exitinterface Tunnel100201
tunnel-options tunnel-set secure-internet-gateway-zscaler tunnel-dc-preference
secondary-dc source-interface GigabitEthernet0/0/0

Service SIG Interface Pairs HA Pair Configuration
sdwan
service sig vrf global
ha-pairs
interface-pair Tunnel100101 active-interface-weight 1 Tunnel100201
backup-interface-weight 1

Use Case Example 2: Active/Active Tunnels
Tunnel Source Loopbacks Definedinterface Loopback1
ip address 10.10.10.1 255.255.255.255!
interface Loopback2
ip address 10.10.10.2 255.255.255.255

Local Policy Route (for ISAKMP control traffic)
ip cef load-sharing algorithm src-only
ip access-list extended SIG
10 permit ip host 10.10.10.1 any
20 permit ip host 10.10.10.2 anyroute-map Tunnel-Control permit 10
set ip next-hop 64.102.254.151
match ip address SIG
ip local policy route-map Tunnel-Control©2024 Zscaler, Inc. All rights reserved. 131

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

IPSec Tunnels Definedinterface Tunnel100101
description Tunnel 1 to Primary DC
no shutdown
ip unnumbered Loopback1
no ip clear-dont-fragment
ip mtu 1400
tunnel source Loopback1
tunnel destination dynamic
tunnel mode ipsec ipv4
tunnel protection ipsec profile if-ipsec101-ipsec-profile
tunnel vrf multiplexing
tunnel route-via GigabitEthernet0/0/0 mandatory
exit
interface Tunnel100201
description Tunnel 2 to Primary DC
no shutdown
ip unnumbered Loopback2
no ip clear-dont-fragment
ip mtu 1400
tunnel source Loopback2
tunnel destination dynamic
tunnel mode ipsec ipv4
tunnel protection ipsec profile if-ipsec201-ipsec-profile
tunnel vrf multiplexing
tunnel route-via GigabitEthernet0/0/0 mandatory©2024 Zscaler, Inc. All rights reserved. 132

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Zscaler Tunnel Options
sdwan
interface Tunnel100101
tunnel-options tunnel-set secure-internet-gateway-zscaler tunnel-dc-preference
primary-dc source-interface Loopback1
exit
interface Tunnel100201
tunnel-options tunnel-set secure-internet-gateway-zscaler tunnel-dc-preference
primary-dc source-interface Loopback2
exit

Service SIG Interface Pairs HA Pair Configuration
sdwan
service sig vrf global
ha-pairs
interface-pair Tunnel100101 active-interface-weight 1 None backup-interface-weight 1
interface-pair Tunnel100201 active-interface-weight 1 None backup-interface-weight 1

Traffic Redirection
Service SIG Routeip sdwan route vrf 1 0.0.0.0/0 service sig

Service SIG Data Policy (apply to Cisco SD-WAN Controller)
viptela-policy:policy
data-policy _VPN1_Sig_Data
vpn-list VPN1
sequence 1
match
destination-data-prefix-list Overlay!
action accept!
!
sequence 11
match
dns request
source-ip 0.0.0.0/0!
action accept
nat use-vpn 0©2024 Zscaler, Inc. All rights reserved. 133

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

nat fallback!
!
sequence 21
match
app-list Box
source-ip 0.0.0.0/0!
action accept
nat use-vpn 0
nat fallback!
!
sequence 31
match
destination-data-prefix-list Default!
action accept
sig
sig-action fallback-to-routing
default-action drop!
!
default-action drop!
lists
app-list Box
app boxapp box_net!
data-prefix-list Default
ip-prefix 0.0.0.0/0!
data-prefix-list Overlay
ip-prefix 10.0.0.0/8!
site-list Zscaler-DataPolicy-Sites
site-id 214©2024 Zscaler, Inc. All rights reserved. 134

Zscaler and CISCO Catalyst SD-WAN Deployment Guidesite-id 215!
vpn-list VPN1
vpn 1
!
!
!
apply-policy
site-list Zscaler-DataPolicy-Sites
data-policy _VPN1_Sig_Data from-service!
!

Miscellaneous
Customize Health Tracker
endpoint-tracker zscaler_l7_health_check
endpoint-api-url http://gateway.zscalerthree.net/vpntest
tracker-type interface
interval 20
interface Tunnel100101
endpoint-tracker zscaler_l7_health_check
exit
interface Tunnel100201
endpoint-tracker zscaler_l7_health_check
exit

Enable Advanced Zscaler Features
sdwan
service sig vrf global
zscaler-location-settingscaution-enabled true

Customize Zscaler Tunnel Destinations (Primary and Secondary DCs)
sdwan
service sig vrf global
zscaler-location-settings
data centers primary-data-center atl2-vpn.zscalerthree.net
data centers secondary-data-center dfw1-vpn.zscalerthree.net©2024 Zscaler, Inc. All rights reserved. 135

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Customize Zscaler GRE Tunnel Destinations (Primary and Secondary DCs)
sdwan
service sig vrf global
zscaler-location-settings
datacenters primary-data-center 165.225.72.38
datacenters secondary-data-center 104.129.194.38

Assign Tunnel Weights (Use with Active/Active Tunnels)
sdwan
service sig vrf global
ha-pairs
interface-pair Tunnel100101 active-interface-weight 80 None backup-interface-weight 1
interface-pair Tunnel100201 active-interface-weight 20 None backup-interface-weight 1©2024 Zscaler, Inc. All rights reserved. 136

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Appendix D: Cisco vEdge CLI Configuration
This section demonstrates the CLI configuration to interoperate with Zscaler. These are equivalent to the feature anddevice templates shown earlier. Note that the recommended way to configure Cisco Catalyst SD-WAN devices is throughfeature and device templates from Cisco SD-WAN Manager.
To complete the CLI configuration, configure:• Base connectivity• Prerequisites• Use case example 1 (active/standby tunnel definitions)• Traffic redirection (service SIG route, service SIG data policy, or both)• Miscellaneous (optional features)

Base Connectivity
The following is a basic connectivity configuration for the Cisco vEdge router. It includes one other transport (MPLS), which
is not essential to the connectivity to Zscaler (except for internet access across the SD-WAN overlay to the data center incase the local internet fails). Some default configurations have been removed. These configurations correspond to featureand device templates shown in Appendix B: Tunnel Configuration Summary (Feature and Device Templates).
systemhost-name WAN_EdgeB
system-ip 10.255.255.212
site-id 212
organization-name “ENB-Solutions - 216151”
vbond vbond.cisco.net!
ntp
server time.google.com
source-interface ge0/0
exit
!
!
vpn 0
name “Transport VPN”
dns 208.67.220.220 secondary
dns 208.67.222.222 primaryecmp-hash-key layer4
host vbond.cisco.net ip 64.100.100.113
interface ge0/0
ip address 64.100.212.2/28
nat©2024 Zscaler, Inc. All rights reserved. 137

Zscaler and CISCO Catalyst SD-WAN Deployment Guide!
tunnel-interface
encapsulation ipsec
color biz-internet
no allow-service bgp
allow-service dhcp
allow-service dns
allow-service icmp
no allow-service sshd
no allow-service netconf
allow-service ntp
no allow-service ospf
no allow-service stunallow-service https!
no shutdown!
interface ge0/2
ip address 192.168.212.2/30
tunnel-interface
encapsulation ipsec
color mpls restrict
no allow-service bgp
allow-service dhcp
allow-service dns
allow-service icmp
no allow-service sshd
no allow-service netconf
allow-service ntp
no allow-service ospf
no allow-service stunallow-service https!
no shutdown!
ip route 0.0.0.0/0 64.100.212.1
ip route 0.0.0.0/0 192.168.212.1!
©2024 Zscaler, Inc. All rights reserved. 138

Zscaler and CISCO Catalyst SD-WAN Deployment Guidevpn 1
name LAN
interface ge0/3
ip address 10.212.10.1/24
no shutdown!
!
vpn 512
name “Transport VPN”
interface ge0/1
ip address 192.168.255.181/23
no shutdown!
!

Prerequisites
The base configuration enables NTP to ensure an accurate clock and DNS. Enable NAT under the internet transport.
vpn 0
interface ge0/0
nat

Use Case Example 1: Active/Standby Tunnels
IPSec Tunnels Defined
vpn 0
interface ipsec101
description “Primary DC Tunnel 1”
ip unnumberedtunnel-source-interface ge0/0
tunnel-destination dynamic
tunnel-set secure-internet-gateway-zscaler
tunnel-dc-preference primary-dc
ike
version 2
rekey 14400
cipher-suite aes256-cbc-sha1
group 2authentication-typepre-shared-key-dynamic©2024 Zscaler, Inc. All rights reserved. 139

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

!
!
ipsec
rekey 3600
replay-window 512
cipher-suite null-sha1
perfect-forward-secrecy none!
mtu 1400
no shutdown!
interface ipsec201
description “Secondary DC Tunnel 1”
ip unnumberedtunnel-source-interface ge0/0
tunnel-destination dynamic
tunnel-set secure-internet-gateway-zscaler
tunnel-dc-preference secondary-dc
ike
version 2
rekey 14400
cipher-suite aes256-cbc-sha1
group 2authentication-typepre-shared-key-dynamic
!
!
ipsec
rekey 3600
replay-window 512
cipher-suite null-sha1
perfect-forward-secrecy none!
mtu 1400
no shutdown!

©2024 Zscaler, Inc. All rights reserved. 140

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Service SIG Interface Pairs HA Pair Configuration
vpn 0
name “Transport VPN”
dns 208.67.220.220 secondary
dns 208.67.222.222 primaryecmp-hash-key layer4
host vbond.cisco.net ip 64.100.100.113
service sig
ha-pairs interface-pair ipsec101 active-interface-weight 1 ipsec201
backup-interface-weight 1
exit
exit

SIG Credentials
secure-internet-gateway
zscaler organization ciscotest.net
zscaler partner-base-uri zsapi.zscalerthree.net/api/v1
zscaler partner-key ABCdef123GHI
zscaler username sd-wan@ciscotest.net
zscaler password <hidden>

Traffic Redirection
Service SIG Routevpn 1
ip service-route 0.0.0.0/0 vpn 0 service sig

Service SIG Data Policy (apply to Cisco SD-WAN Controller)
viptela-policy:policy
data-policy _VPN1_Sig_Data
vpn-list VPN1
sequence 1
match
destination-data-prefix-list Overlay!
action accept!
!
sequence 11
match©2024 Zscaler, Inc. All rights reserved. 141

Zscaler and CISCO Catalyst SD-WAN Deployment Guidedns request
source-ip 0.0.0.0/0!
action accept
nat use-vpn 0
nat fallback!
!
sequence 31
match
source-ip 0.0.0.0/0
action accept!
action accept
nat use-vpn 0
nat fallback!
!
sequence 31
match
source-ip 0.0.0.0/0!
action accept
sig!
!
default-action drop!
lists
app-list Box
app boxapp box_net!
data-prefix-list Overlay
ip-prefix 10.0.0.0/8!
site-list Zscaler-DataPolicy-Sites
site-id 212©2024 Zscaler, Inc. All rights reserved. 142

Zscaler and CISCO Catalyst SD-WAN Deployment Guidesite-id 214
site-id 215!
vpn-list VPN1
vpn 1
!
!
!
apply-policy
site-list Zscaler-DataPolicy-Sites
data-policy _VPN1_Sig_Data from-service!
!

Miscellaneous
Customize Health Tracker
vpn0
tracker SIG zscaler_l7_health_check
endpoint-api-url http://gateway.zscalerthree.net/vpntest
interval 20
interface ipsec101
tracker zscaler_l7_health_checkinterface ipsec201
tracker Zscaler_l7_health_check

Enable Advanced Zscaler Features
vpn 0
service sig
zscaler-location-settings caution-enabled true

Customize Zscaler IPSec Tunnel Destinations (Primary and Secondary DCs)
vpn 0
service sig
zscaler-location-settings data centers primary-data-center atl2-vpn.zscalerthree.net
zscaler-location-settings data centers secondary-data-center dfw1-vpn.zscalerthree.net©2024 Zscaler, Inc. All rights reserved. 143

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Appendix E: Requesting Zscaler Support
You might need Zscaler Support for provisioning certain services, or to help troubleshoot configuration and service issues.
Zscaler Support is available 24/7/365.
To contact Zscaler Support:
1. Go to Administration > Settings > Company Profile.

Figure 105. Collecting details to open support case with Zscaler TAC

2. Copy the Company ID.

Figure 106. Company ID©2024 Zscaler, Inc. All rights reserved. 144

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

3. Now that you have your company ID, you can open a support ticket. Go to Dashboard > Support > Submit a Ticket.

Figure 107. Submit a ticket©2024 Zscaler, Inc. All rights reserved. 145

Zscaler and CISCO Catalyst SD-WAN Deployment Guide

Appendix F: Document Revision Control
Revision

Date

Change Log

1.0

August 2017

Initial document by Zscaler and Cisco Viptela.

1.1

August 2017

Updated Viptela references to Cisco SD-WAN.

1.2

September 2017

Minor edits.

1.3

September 2018

Updated ZIA screen captures to ZIA 5.6 and added IPSec section and othersupporting edits.

2.0

March 2019

Added GRE and IPSec template creation.

3.0

January 2020

Cisco SD-WAN: Updated for 19.2.099 and 19.3.0 Cisco SD-WAN Manager
code, added Cisco IOS XE SD-WAN router information, added design
information, added L7 health checking, and tested the ISR1100-4G running
Cisco vEdge code.

3.1

February 2020

Incorporated review feedback.

September 2020

Cisco SD-WAN: Updated for 20.3.4 Cisco SD-WAN Manager and Cisco
vEdge code and 17.3.4a Cisco IOS XE SD-WAN Edge code (manual GRE
and IPSec tunnels). Updated ZIA screen captures for ZIA 6.1 and added
instructions for GRE tunnel provisioning through ZIA.

5.0

November 2021

Cisco SD-WAN: Updated for 20.6 vManage and vEdge code and 17.6 IOS XE
SD-WAN Edge code, added new information on vManage SIG templates,
IPSec auto tunnels (active/standby and active/active tunnels), SIG service
routes, and data policy.

5.1

December 2021

Updated formatting and edited for style.

5.2

May 2023

Cisco SD-WAN: Updated for 20.9 vManage and vEdge code and 17.9 IOS XE
SD-WAN Edge code, added new information on GRE auto tunnels, Cisco
SD-WAN and Zscaler design, and other features supported since 20.6
vManage/17.6 IOS XE SD-WAN code versions. Due to product rebranding,
updated Cisco SD-WAN references to Cisco Catalyst SD-WAN, and updated
vManage, vSmart, and vBond references to SD-WAN Manager, Controller,
and Validator.

5.3

July 2024

Various updates from Cisco and Zscaler.

4.0©2024 Zscaler, Inc. All rights reserved. 146