What type of traffic is described as requiring latency to be no more than 400 milliseconds (ms)?

For an organization using SD-WAN, a branch site typically routes SaaS application traffic by default over SD-WAN overlay links to a data center. From the data center, the SaaS traffic reaches the SaaS server.

For example, in a large organization with a central data center and branch sites, employees might use Office 365 at a branch site. By default, the Office 365 traffic at a branch site would be routed over SD-WAN overlay links to a centralized data center, and from there to the Office 365 cloud server.

Scenario 1: If the branch site has a direct internet access (DIA) connection, you may choose to improve performance by routing the SaaS traffic through that direct route, bypassing the data center.

Scenario 2: If the branch site connects to a gateway site that has DIA links, you may choose to enable SaaS traffic to use the DIA of the gateway site.

Scenario 3: Hybrid method.

When enabling Cloud onRamp for SaaS to manage Office 365 traffic, you can limit Cloud onRamp for SaaS path selection to apply to some or all Office 365 traffic, with the following options:

• Optimize traffic

• Optimize and Allow traffic

• All Office 365 traffic

These options correspond to the three categories of Office 365 traffic that Microsoft defines as follows:

• Optimize: Traffic most sensitive to network performance, latency, and availability.

• Allow: Traffic less sensitive to network performance, latency, and availability.

• Default: Traffic not sensitive to network performance.

Specifying traffic by Office 365 category requires enabling the Cisco SD-AVC Cloud Connector component in Administration > Settings.

Cloud onRamp for SaaS selects the best path for each application using an algorithm that takes input from the following sources.

For Office 365 traffic, you can view a log of the metrics that factor into the best-path determination. The metrics appear in a Cisco vAnalytics page specifically designed to display only this information, and available directly from Cisco vManage.

Cloud onRamp for SaaS can determine the best network path for each type of cloud traffic. However, if multiple direct internet access (DIA) interfaces on a WAN edge device at a branch site provide acceptable performance for a cloud application, Cloud onRamp for SaaS can employ load balancing across up to three interfaces to further improve performance.

When you enable load balancing across multiple interfaces of a WAN edge device, load balancing is enabled for all cloud applications that are managed by Cloud onRamp for SaaS. After determining the best path interface for a cloud application, Cloud onRamp compares the performance statistics for other interfaces. To use another interface for load balancing, the following must be true:

• The packet loss value of the interface cannot vary from the packet loss value of the best path interface by more than a configured value (%). You can configure a smaller value to restrict load balancing only to interfaces with a packet loss value very close to that of the best path interface, or you can configure a larger value to be more inclusive of interfaces that might have a higher packet loss than the best path interface.

• The latency value of the interface cannot vary from the latency value of the best path interface by more than a configured value (milliseconds). You can configure a smaller value to restrict load balancing only to interfaces with a latency value very close to that of the best path interface, or you can configure a larger value to be more inclusive of interfaces that might have a higher latency than the best path interface.

If required, you can select an option to ensure that all traffic from a single host uses a single interface – for example, to ensure that DNS and application traffic use the same path.

A branch site may connect to the internet through one or more direct internet access (DIA) interfaces at the branch site itself, or through a gateway site, which might use a service VPN or VPN 0 to connect to the internet.

In addition to probing the DIA interfaces at a branch site, Cloud OnRamp for SaaS can probe interfaces at a gateway site, whether they use service VPNs (VPN 1, VPN 2, …) or the transport VPN (VPN 0), when determining the best path to use for the traffic of specified cloud applications. This is helpful when the branch site connects to the internet through a gateway site.

When configuring Cloud OnRamp for SaaS to use the gateway site, specify whether the gateway site uses service VPNs or VPN 0 to connect to the internet, as shown in the following illustrations.

Minimum releases: Cisco IOS XE Release 17.7.1a and Cisco vManage Release 20.7.1

When you enable Cloud onRamp for SaaS best path determination for an application, Cisco vManage updates match conditions in the application-aware policy in the active centralized policy to support Cloud onRamp for SaaS functionality for the application. For most applications, the match conditions do not require any later update.

For Webex, Cloud onRamp for SaaS uses a more complex method than for most other applications. Cloud onRamp for SaaS maintains a list of worldwide Webex servers. When you enable Cloud onRamp for SaaS best path determination for Webex, Cloud onRamp for SaaS determines the best path for each Webex server worldwide. It adds match conditions in the application-aware policy to address each of the regional Webex servers. This provides the Webex application with the best path to any Webex server worldwide that it may need to connect to.

Minimum supported release: Cisco vManage Release 20.8.1

Cisco SD-WAN uses a component called SD-AVC Cloud Connector to collect information from Microsoft Cloud about the Microsoft application servers that handle Office 365 traffic. The information includes the transport protocols for the traffic; and the domain names, IP addresses, and ports of the application servers that manage the traffic. This server information improves the process of identifying network traffic—for example, making it possible to identify traffic from the first packet. Improving traffic identification enhances the effectiveness of application-aware routing policies because policies can often match all traffic, from the first packet.

The SD-AVC Cloud Connector page provides visibility into the application servers that are used for Office 365 traffic. It provides a table of the server information that Cisco SD-WAN has collected for Office 365 traffic. For example, the table may indicate that the domains represented by *-admin.sharepoint.com correspond to Sharepoint traffic. In this case, any traffic flow with a destination domain included in those domains, such as connect-admin.sharepoint.com, can be identified as Sharepoint traffic from the first packet of the flow.

Minimum supported release: Cisco vManage Release 20.8.1

For Office 365 traffic, you can view charts showing the path scores (OK, NOT-OK, or INIT) provided by Microsoft telemetry for each Microsoft service area, including Exchange, Sharepoint, and Skype. The chart shows the path scores over time for each available interface.

Viewing the path score history can be useful when troubleshooting network performance issues for Office 365 traffic—for example, to determine whether Microsoft consistently rates a particular interface as NOT-OK for some types of traffic, such as Skype traffic. If that occurs, you can investigate why the interface is consistently receiving a low path score.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.5.1a

When you enable Microsoft 365 on the Applications and Policy page, and choose a traffic category, Cloud OnRamp for SaaS adds sequences to all application-aware routing (AAR) policies to enable Cloud OnRamp for SaaS operation on Microsoft 365 traffic, in accordance with the traffic category that you have chosen. Adding these sequences to the AAR policies enables Cloud OnRamp for SaaS operation on this traffic, with the selected traffic category.

Starting from Cisco vManage Release 20.9.1, you can edit the sequences in AAR policies individually to change the specified Microsoft 365 traffic category and service area for specific AAR policies.

Note	This feature is only available for the Microsoft 365 application.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.2.1

Starting from Cisco vManage Release 20.9.1, you can selectively enable Cloud OnRamp for SaaS to operate for a particular application at specific sites, while excluding other sites. When you enable an application on the Applications and Policy page, Cloud OnRamp for SaaS adds AAR policy sequences that match traffic for the selected application and direct the traffic in accordance with the Cloud OnRamp for SaaS best path calculation. This has the effect of enabling Cloud OnRamp for SaaS operation at all sites.

To exclude Cloud OnRamp for SaaS operation for applications at specific sites, you can edit an AAR policy and delete a specific application within the AAR policy. This disables Cloud OnRamp for SaaS activity for that application on sites that use the AAR policy.

In contrast to editing the traffic category or service area for specific policies (see Information About Configuring the Traffic Category and Service Area for Specific Policies), which works only with Microsoft 365 traffic, you can use this feature to enable or exclude any SaaS application.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.9.1a

Cisco vManage Release 20.9.1 introduces improved application visibility, enabling you to monitor Microsoft 365 traffic processed by Cloud OnRamp for SaaS in more detail. You can view, in graph or table formats, the volume of Microsoft 365 traffic over time, with details as to how much traffic used a direct internet access (DIA) link, and how much was routed through a gateway site. The monitoring page also shows the volume of traffic that Cloud OnRamp for SaaS does not affect.

Minimum releases: Cisco vManage Release 20.9.1

From Cisco vManage Release 20.9.1, you can control whether the Cloud OnRamp for SaaS best path decision includes Microsoft telemetry data as a factor for Microsoft 365 traffic. When enabling telemetry for Microsoft 365 (Office 365) traffic, the Application Feedback dialog box contains a Traffic Steering check box. Check this check box to enable the use of Microsoft telemetry data in best path decisions. For information, see Enable Application Feedback Metrics for Office 365 Traffic.

Even when you elect not to use Microsoft telemetry data in best path decisions, you can view the telemetry data. You can view the telemetry data related to the Microsoft 365 application, as well as detailed information about the best path decisions made on devices, using Cisco vAnalytics. For information about Cisco vAnalytics, see Cisco vAnalytics.

For information about enabling Microsoft to provide telemetry for Microsoft 365 traffic, see Enable Microsoft to Provide Telemetry for Office 365 Traffic.

The prerequisites for using Cloud onRamp for SaaS differ for Cisco vEdge devices and Cisco IOS XE SD-WAN devices. For information about using Cloud onRamp for SaaS with Cisco vEdge devices, see Cloud OnRamp Configuration Guide for vEdge Routers, Cisco SD-WAN Release 20.

For Cisco IOS XE SD-WAN devices, the requirements are:

• The devices must be running Cisco IOS XE Release 17.3.1a or later.

• The devices must be in vManage mode.

• All Cisco vSmart Controller instances must be in vManage mode.

• A centralized policy that includes an application-aware policy must be activated. You can configure more than one centralized policy in Cisco vManage, but only one can be active.

  Note	This is an important difference from using Cloud onRamp for SaaS with Cisco vEdge devices, which do not have this requirement.

• Cloud onRamp for SaaS is enabled (Administration > Settings).

To specify traffic by Office 365 traffic category, the following are also required:

• Cisco SD-AVC is enabled (Administration > Cluster Management).

• Cisco SD-AVC Cloud Connector is enabled (Administration > Settings). If Cloud Connector is not enabled, policies specifying Office 365 traffic cannot match the Office 365 traffic. The traffic uses the default path, rather than the best path selected by Cloud onRamp for SaaS.

Cloud onRamp for SaaS probing through VPN 0 interfaces at gateway sites presupposes that a branch site connects to the internet through a gateway site, and that the gateway site connects to the internet using a VPN 0 interface. The branch site may or may not also connect to the internet through one or more DIA connections.

Minimum releases: Cisco IOS XE Release 17.7.1a and Cisco vManage Release 20.7.1

To download the latest information about Webex servers, as described in Maintaining an Up-to-Date List of Webex Servers, Cisco vManage requires access to the internet.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.5.1a

• You must have multiple active AAR policies.

• To edit the service area and traffic category, you must enable Monitoring and Policy/Cloud SLA for the Microsoft 365 application. For information, see Configure Applications for Cloud onRamp for SaaS Using Cisco vManage.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.2.1

Availability of multiple AAR policies associated with different sets of sites.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.9.1a

• Configure app visibility and flow visibility. See < Configure App visibility and Flow Visibility >.

• To view the traffic graphs and log, you must first enable <On Demand Troubleshooting>.

Minimum releases: Cisco vManage Release 20.9.1

Enable Microsoft traffic metrics.

See Enable Microsoft to Provide Traffic Metrics for Office 365 Traffic.

Configuring Cloud onRamp for SaaS when a site is using a loopback as a transport locator (TLOC) interface is not supported.

Configuring Cloud OnRamp for SaaS on Cisco IOS XE SD-WAN devices is only through centralized app-aware policy using match condition "cloud-saas-app-list" and action "cloud-saas". For mixed deployments including Cisco SD-WAN and Cisco IOS XE SD-WAN devices, we recommend to have different app-aware policies for Cisco SD-WAN and Cisco IOS-XE SD-WAN devices.

Note	Beginning with Cisco IOS XE Release 17.8.1a and Cisco SD-WAN Release 20.8.1, Cloud onRamp for SaaS does not support ICMP traffic. This has a minor effect on Webex traffic counters, as compared with Cisco IOS XE Release 17.7.1a and Cisco SD-WAN Release 20.7.1.

Enable gateway probing through VPN 0 interfaces if the following conditions apply:

• A branch site connects to the internet through a gateway site. The branch site may or may not also connect to the internet through one or more DIA interfaces.

• The gateway site has internet exits that use the transport VPN (VPN 0) through one or more interfaces.

Minimum supported release: Cisco vManage Release 20.8.1

Visibility into server information is helpful when troubleshooting. For example, after creating a policy that applies Cloud onRamp for SaaS only to Office 365 traffic in the Sharepoint service area, you might find that Cisco SD-WAN is not routing the first few flows of Sharepoint traffic on the best path determined by Cloud onRamp for SaaS, and Sharepoint performance is below expectations.

To troubleshoot, you can do the following:

1. Determine which server the Sharepoint traffic is using.

2. Open the SD-AVC Cloud Connector page and filter for the term, “sharepoint”.

3. Look for the Sharepoint server you found in the first step. If that server does not appear in the list, it means that Cloud onRamp for SaaS is not classifying the traffic to that server as Sharepoint traffic. If it is not classified as Sharepoint traffic, it does not use the best path determined by Cloud onRamp for SaaS for the first few flows.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.5.1a

An organization relies heavily on Microsoft 365 for its office applications, and has configured Cloud OnRamp for SaaS to optimize Microsoft 365 traffic at its headquarters and at each branch office. In addition, it uses an on-premises Outlook server at a data center to handle its company email.

Microsoft distinguishes different types of Microsoft 365 traffic using the following service areas:

• Common: Microsoft 365 ProPlus, Office in a browser, Azure Active Directory (AD), and other common network endpoints

• Exchange: Exchange Online and Exchange Online Protection

• SharePoint: SharePoint Online and OneDrive for Business

• Skype: Skype for Business and Microsoft Teams

Because the organization uses an on-premises Outlook server, the network administrator chooses to exclude Outlook traffic from the Cloud OnRamp for SaaS optimization of Microsoft 365 traffic. By modifying the AAR policies, they exclude the Exchange service area (for Outlook) from the Microsoft 365 traffic that Cloud OnRamp for SaaS operates on, thereby ensuring the best performance for the email traffic using the on-premises Outlook server.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.2.1r

An organization’s network spans numerous sites. Most of the sites utilize the Box.com cloud storage application, but a subset of sites does not use Box.com.

First, the network administrator creates an AAR policy that serves the subset of sites that do not use Box.com. Next, the network administrator enables Cloud OnRamp for SaaS for Box.com traffic, which enables Cloud OnRamp for SaaS operation at all sites in the network.

To exclude the subset of sites that do not use Box.com, the network administrator edits the AAR policy for that subset of sites, to disable Cloud OnRamp for SaaS operation for Box.com traffic. This has the effect of disabling Cloud OnRamp for SaaS operation for Box.com traffic at that subset of sites only.

You can enable Cloud OnRamp for SaaS in your Cisco SD-WAN overlay network on sites with Direct Internet Access (DIA) and on DIA sites that access the internet. You can also enable Cloud OnRamp for SaaS on client sites that access the internet through another site in the overlay network, called a gateway site. Gateway sites can include regional data centers or carrier-neutral facilities. When you enable Cloud OnRamp for SaaS on a client site that accesses the internet through a gateway, you also enable Cloud OnRamp for SaaS on the gateway site.

Note

You can only enable Cloud OnRamp for SaaS features using the Cisco vManage procedures described in this document. We do not support configuring Cloud OnRamp for SaaS using CLI templates. Even when you configure other features on a device using a CLI template, you must nevertheless use Cisco vManage for configuring Cloud OnRamp for SaaS features.

1. Open Cloud onRamp for Saas.

   • From the Cisco vManage menu, choose Configuration > Cloud onRamp for SaaS.

     or

   • From the Cisco vManage menu, click the cloud icon near the top right and select Cloud onRamp for SaaS.

2. In the Manage Cloud OnRamp for SaaS drop-down list, choose Applications and Policy.

   The Applications and Policy window displays all SaaS applications.

3. Optionally, you can filter the list of applications by clicking an option in the App Type field.

   • Standard: Applications included by default for Cloud onRamp for SaaS.

   • Custom: User-defined SaaS application lists (see Information About SaaS Application Lists).

4. Enable applications and configure.

   Column	Description
   Applications	Applications that can be used with Cloud onRamp for SaaS.
   Monitoring	Enabled: Enables Cloud OnRamp for SaaS to initiate the Quality of Experience probing to find the best path. Disabled: Cloud onRamp for SaaS stops the Quality of Experience probing for this application.
   VPN	(Cisco vEdge devices) Specify one or more VPNs.
   Policy/Cloud SLA	(Cisco IOS XE SD-WAN devices) Select Enable to enable Cloud onRamp for SaaS to use the best path for this application. Note  You can select Enable only if there is a centralized policy that includes an application-aware policy has been activated.
   (Cisco IOS XE SD-WAN devices) For Microsoft 365 (M365), select one of the following to specify which types of M365 traffic to include for best path determination: Optimize: Include only M365 traffic categorized by Microsoft as “optimize” – the traffic most sensitive to network performance, latency, and availability. Optimize and Allow: Include only M365 traffic categorized by Microsoft as “Optimize” or “Allow”. The “Allow” category of traffic is less sensitive to network performance and latency than the “Optimize” category. All: Include all M365 traffic.
   Starting from Cisco IOS XE Release 17.5.1a, you can choose the service area that your M365 application belongs to. This allows you to apply the policy to only those applications in the specified service area. Microsoft allows the following service area options: Common: M365 Pro Plus, Office in a browser, Azure AD, and other common network endpoints. Exchange: Exchange Online and Exchange Online Protection. SharePoint: SharePoint Online and OneDrive for Business. Skype: Skype for Business and Microsoft Teams. See the Microsoft documentation for information about updates to the service areas.

5. Click Save Applications and Next.

   The Application Aware Routing Policy window appears, showing the application-aware policy for the current active centralized policy.

   • You can select the application-aware policy and click Review and Edit to view the policy details. The match conditions of the policy show the SaaS applications for which monitoring has been enabled.

   • For an existing policy, you cannot edit the site list or VPN list.

   • You can create a new policy for sites that are not included in existing centralized policies. If you create a new policy, you must add a VPN list for the policy.

   • You can delete one or more new sequences that have been added for the SaaS applications, or change the order of the sequences.

6. Click Save Policy and Next. This saves the policy to the Cisco vSmart Controller.

Configure two types of sites:

• Client sites

• Direct internet access (DIA) sites

Beginning with Cisco IOS XE Release 17.4.1a, you can enable the following types of application feedback from additional sources. Cloud onRamp for SaaS can use these metrics to help determine the best path for Office 365 traffic. See Best Path Determination.

• Enable telemetry with Microsoft Exchange cloud servers, which can provide best path metrics for Office 365 traffic on specifically configured interfaces. This involves use of a Microsoft service called Microsoft 365 informed network routing. To understand this feature better, see the information available in the Microsoft 365 informed network routing document.

• Enable application response time (ART) metrics, which configures network devices to report ART metrics.

You can enable Microsoft Exchange cloud servers to calculate traffic metrics for Microsoft Exchange traffic coming from specific interfaces in the Cisco SD-WAN overlay. Using the Microsoft Azure portal, you specify which interfaces to include, indicating the interfaces by their public IP addresses. This is called opting in the interfaces.

For the specified interfaces, Microsoft identifies the Office 365 traffic by packet source ID and provides metrics that Cloud onRamp for SaaS can use to determine the best path for the Office 365 traffic.

Enable Microsoft to Provide Telemetry for Office 365 Traffic

Note

The functionality of the Microsoft Azure portal is subject to change and is therefore outside the scope of this documentation. These high-level instructions provide some guidance, but see Microsoft 365 documentation for details. For information about the following steps, see the "Microsoft 365 informed network routing" topic in the Microsoft 365 documentation.

1. Log in to the Microsoft Azure portal. (For information about how to create a Microsoft Azure tenant account, see the Microsoft Azure documentation.)

2. Using the Microsoft Azure portal, specify Cisco SD-WAN overlay network interfaces for which to track traffic metrics.

   1. In the Azure portal, access the Microsoft 365 admin center.

   2. On the Locations page, add a location entry for each location in the SD-WAN overlay network, as desired.

   3. Within a location entry, do one of the following:

      • For locations using an edge router operating with Cisco IOS XE Release 17.9.1a or later, on the "Add an office location" page (or the equivalent), enable the option to allow an SD-WAN solution to automatically set the LAN subnet and egress address range. Then enter the system IP address of the edge device for the location.

      • For locations using an edge router operating with Cisco IOS XE Release 17.8.x or earlier, add egress IP addresses, using the public IP address of the desired interfaces.

Minimum releases: Cisco IOS XE Release 17.7.1a and Cisco vManage Release 20.7.1

To enable Cloud onRamp for SaaS to determine the best path for Webex traffic, enable the Webex application in the same way as other applications. See Enable Cloud onRamp for SaaS, Cisco IOS XE SD-WAN Devices.

Minimum releases: Cisco IOS XE Release 17.7.1a and Cisco vManage Release 20.7.1

1. From the Cisco vManage menu, choose to display the Cloud onRamp for SaaS Dashboard.

2. If the dashboard shows a dialog box prompting you to synchronize Webex server information, click Yes in the dialog box.

   Cisco vManage displays the Application Aware Routing Policy page, enabling you to review the policy. The policy includes updated match conditions that use the latest Webex server information.

3. Click Save Policy.

   Cloud onRamp for SaaS updates the following, as needed, to reflect the updated information for Webex servers worldwide:

   • Match conditions in the application-aware policy

   • Configuration for probing the cloud application

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.5.1a

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.2.1

1. Open Cloud onRamp for SaaS.

   • From the Cisco vManage menu, choose .

     Or

   • From the Cisco vManage menu, click the cloud icon near the top right and select Cloud onRamp for SaaS.

2. In the Manage Cloud OnRamp for SaaS drop-down list, choose Applications and Policy.

   The Applications and Policy page displays all the Cloud OnRamp for SaaS applications.

3. Click Save Applications and Next.

   The Application Aware Routing Policy page opens, showing the application-aware policies in the current active centralized policy.

4. Select the policy you wish to edit and click Review and Edit to view the policy details.

5. You can now delete one or more sequences that have been added by Cloud OnRamp for SaaS for specific applications or change the order of the sequences.

6. Click Save Policy and Next. This pushes the updated policy to the Cisco vSmart Controller.

Note	Note: When you enable an application on the Applications and Policy page, by default, Cloud OnRamp for SaaS is enabled for all AAR policies that are part of the current active centralized policy.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.9.1a

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.9.1a

1. From the Cisco vManage menu, choose .

2. Click Manage Cloud OnRamp for SaaS and choose Applications and Policy.

   The Applications and Policy window displays all SaaS applications.

3. In the row of the application that you are verifying, check that the Monitoring column and the Policy/Cloud SLA column both show Enabled.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.5.1a

1. From the Cisco vManage menu, choose .

2. Click Controllers.

   A list of devices is displayed.

3. For the device you wish to verify, click … and click Running Configuration. The Running Configuration window opens, displaying the running configuration.

4. Verify that the running configuration reflects any changes that you have made to AAR policies.

Or

1. From the Cisco vManage menu, choose .

   The Policies page displays the policies.

2. For the policy, you wish to verify, click … and click Preview.

   The Policy Configuration Preview pop-up window appears, providing a preview of the running configuration.

3. Verify that the policy preview reflects any changes that you have made to AAR policies.

Minimum releases: Cisco vManage Release 20.9.1, Cisco IOS XE Release 17.2.1

1. From the Cisco vManage menu, choose .

2. Click Controllers.

   A list of devices is displayed.

3. For the device you wish to verify, click … and click Running Configuration. The Running Configuration window opens, displaying the running configuration.

4. Verify that the running configuration reflects any changes that you have made to AAR policies.

1. From the Cisco vManage menu, choose .

   The Policies window displays the policies.

2. For the policy, you wish to verify, click … and click Preview.

   The Policy Configuration Preview page appears, providing a preview of the running configuration.

3. Verify that the policy reflects any changes that you have made to AAR policies.

1. Open Cloud onRamp for SaaS.

   • From the Cisco vManage menu, choose Configuration > Cloud onRamp for SaaS.

     or

   • In Cisco vManage, click the cloud icon at the top right and click Cloud onRamp for SaaS.

   The page includes a tile for each monitored application, with the following information:

   • How many sites are operating with Cloud onRamp for SaaS.

   • A color-coded rating of the Quality of Experience (vQoE) score for the application (green=good score, yellow=moderate score, red=poor score) on the devices operating at each site.

2. Optionally, you can click a tile to show details of Cloud onRamp for SaaS activity for the application, including the following:

   Field	Description
   vQoE Status	A green checkmark indicates that the vQoE score for the best path meets the criteria of an acceptable connection. The vQoE is calculated based on average loss and average latency. For Office 365 traffic, other connection metrics are also factored in to the vQoE score.
   vQoE Score	For each site, this is the vQoE score of the best available path for the cloud application traffic. The vQoE score is determined by the Cloud onRamp for SaaS probe. Depending on the type of routers at the site, you can view details of the vQoE Score as follows: Cisco IOS XE SD-WAN devices: To show a chart of the vQoE score history for each available interface, click the chart icon. In the chart, each interface vQoE score history is presented as a colored line. A solid line indicates that Cloud onRamp for SaaS has designated the interface as the best path for the cloud application at the given time on the chart. You can place the cursor over a line, at a particular time on the chart, to view details of the vQoE score of an interface at that time. From Cisco vManage Release 20.8.1, for the Office 365 application, the chart includes an option to show the vQoE score history for a specific service area, such as Exchange, Sharepoint, or Skype. For each service area, a solid line in the chart indicates the interface chosen as the best path at a given time. If you have enabled Cloud onRamp for SaaS to use Microsoft traffic metrics for Office 365 traffic, the choice of best path takes into account the Microsoft traffic metrics. Cisco vEdge devices: To show a chart of the vQoE score history, click the chart icon. The chart shows the vQoE score for the best path chosen by Cloud onRamp for SaaS.
   DIA Status	The type of connection to the internet, such as local (from the site), or through a gateway site.
   Selected Interface	The interface providing the best path for the cloud application. Note  If the DIA status is Gateway, this field displays N/A.
   Activated Gateway	For a site that connects to the internet through a gateway site, this indicates the IP address of the gateway site. Note  If the DIA status is Local, this field displays N/A.
   Local Color	For a site that connects to the internet through a gateway site, this is the local color identifier of the tunnel used to connect to the gateway site. Note  If the DIA status is Local, this field displays N/A.
   Remote Color	For a site that connects to the internet through a gateway site, this is the remote (gateway site) color identifier of the tunnel used to connect to the gateway site. Note  If the DIA status is Local, this field displays N/A.
   SDWAN Computed Score	This field is applicable only if the site uses Cisco IOS XE SD-WAN devices. It does not apply for Cisco vEdge devices. From Cisco vManage Release 20.8.1, for the Microsoft Office 365 application, an SDWAN Computed Score column provides links to view charts of the path scores (OK, NOT-OK, or INIT) provided by Microsoft telemetry for each Microsoft service area, including Exchange, Sharepoint, and Skype. The chart shows the scores over time for each available interface. The scores are defined as follows: OK: Acceptable path NOT-OK: Unacceptable path INIT: Insufficient data These charts provide visibility into how Cloud onRamp for SaaS chooses a best path for each type of Microsoft Office 365 traffic. A use case for viewing the path score history is for determining whether Microsoft consistently rates a particular interface as NOT-OK for some types of traffic, such as Skype traffic.

Minimum releases: Cisco IOS XE Release 17.7.1a and Cisco vManage Release 20.7.1

1. From the Cisco vManage menu, choose

   The page displays each monitored application, the relevant sites, with information about each.

2. Optionally, you can click a site to display a chart of the scores for various available paths for the application traffic, and the best path (solid line).

• The SIG tunnels created using the Secure Internet Gateway (SIG) template must have a valid Tracker Source IP address. Cloud onRamp for SaaS uses the Tracker Source IP address in the SIG template for probing purposes.

• Configure the device to use an internet-based DNS server with an IP address that can be reached through the SIG tunnel.

• An application must be identified by Cloud onRamp for SaaS from the very first packet in a flow going through the edge routers, between a branch and Cloud onRamp for SaaS. If an application cannot be identified in the first packet of a flow, the best path that is selected by Cloud onRamp cannot be implemented for the subsequent packets in that given flow. After an application is classified, the subsequent traffic flow goes through the best path selected by Cloud onramp for SaaS.

• Cloud onRamp for SaaS comparison logic between a gateway exit and a Direct Internet Access (DIA) exit cannot determine if the Cloud onRamp for SaaS in the remote gateway is executing a computation with an underlay interface or a SIG interface.

• IPv6 is not supported with Cloud onRamp for SaaS.

Using Cloud OnRamp for SaaS, a site can connect to SaaS applications through the following:

• Through the best performing SIG tunnel

• Through a gateway site in which the traffic is sent through the best-performing overlay tunnel from the branch to the gateway, and then from the gateway site through the best-performing SIG tunnel.

When you configure Cloud onRamp for SaaS for a site to connect over SIG tunnels, you have secure access to the SaaS applications over the internet.

Connecting to Cloud OnRamp for SaaS over SIG tunnels has the following benefits:

• You have secure access to the SaaS applications over SIG tunnels.

• Cloud onRamp for SaaS over SIG tunnels provides best path performance where access to the SaaS applications is enabled through the best-performing tunnel.

There are different ways through which you can access the SaaS applications over SIG tunnels:

Direct Access to SaaS Applications with Multiple SIG Tunnels from Branch Using DIA

In this scenario:

• Multiple VPN0 tunnels over GRE or IPSec are set up from a branch to Zscaler and Cisco Umbrella.

• Traffic from the branch is forwarded through the best-performing tunnel for a given SaaS application, and is terminated at Zscaler and Cisco Umbrella for security inspection.

• Traffic is forwarded to the internet from SIG.

Access to SaaS Applications with Multiple SIG Tunnels from Branch Using a Gateway

In this scenario:

• Multiple VPN0 tunnels over GRE or IPSec are set up from one or more regional hubs to Zscaler and Cisco Umbrella.

• Traffic from branch is forwarded to the best-performing regional hub for a given SaaS application, and is terminated at Zscaler and Cisco Umbrella for security inspection.

• Traffic is forwarded to the internet from SIG.

Access to SaaS Applications with Multiple SIG Tunnels from Branch Using DIA and Gateway

In this scenario:

• Multiple VPN0 tunnels over GRE or IPsec are set up from a branch, regional hub, or both to Zscaler and Cisco Umbrella.

• Traffic from branch, regional hub, or both is forwarded through the best-performing tunnel for a given SaaS application, and is terminated at Zscaler and Cisco Umbrella for security inspection.

• Traffic is forwarded to the internet from SIG.

This section provides sample CLI configurations for Cloud onRamp for SaaS over SIG tunnels.

Device# config-transaction 
Device(config)# probe-path {branch|gateway} {all-auto-sig-tunnels|sig-tunnel-list} list of SIG tunnels 
Device(config)# ip sdwan route vrf vrf ip address service sig 

Device# config-transaction 
Device(config)# probe-path gateway {all-auto-sig-tunnels|sig-tunnel-list} list of SIG tunnels 
Device(config)# ip sdwan route vrf vrf ip address service sig 
Device(config)# interface tunnel-id 
Device(config-if)# ip nbar protocol-discovery 

Device# config-transaction
Device(config)# probe-path gateway all-auto-sig-tunnels
Device(config)# ip sdwan route vrf 1 192.168.0.1 service sig
Device(config)# interface Tunnel101
Device(config-if)# ip nbar protocol-discovery
Device(config-if)# interface Tunnel102
Device(config-if)# ip nbar protocol-discovery

Device# config-transaction 
Device(config)# vrf definition vrf 
Device(config-vrf)# address-family ipv4 
Device(config-vrf)# exit-address-family 

Device(config)# interface  Loopback interface_number  
Device(config-if)# no shutdown 
Device(config-vrf)# vrf forwarding vrf_number 
Device(config-vrf)# ip address ip address mask 
Device(config-vrf)# exit 

To monitor Cloud onRamp for SaaS over SIG tunnels, perform the following steps:

1. From the Cisco vManage menu, choose .

   Cisco vManage Release 20.6.x and earlier: From the Cisco vManage menu, choose .

2. From the list of devices that is displayed, select a device.

3. Click Real Time in the left pane.

4. Click Device Options drop-drop list, and choose one of the following commands:

   Device Option	Description
   CloudExpress Applications	Displays the best path for applications that are configured with Cloud OnRamp for SaaS. The best path could be a local interface with DIA, or the path to a remote gateway.
   CloudExpress Gateway Exits	Displays the loss and latency on each gateway exit for applications that are configured with Cloud OnRamp for SaaS.
   CloudExpress Local Exits	Displays the application loss and latency on each DIA interface that is enabled for Cloud OnRamp for SaaS.

5. From the Cisco vManage menu, choose to access the dashboard where you can view the applications available on Cloud onRamp for SaaS.

The following example shows the configuration of Cloud on Ramp for SaaS over SIG tunnels:

Device(config)# probe-path branch sig-tunnel-list Tunnel100015 Tunnel100016
Device(config)# probe-path branch all-auto-sig-tunnels