Hi,
first of all you need to allow control traffic as well (router to controllers), secondly you don't need isakmp (udp500 or udp4500) - SD-WAN architecture is IKE-less.
You need one explicit access-list line to match and allow ping from respective device(s). Other traffic will be handled by implicit access-list which you see normally under tunnel-interface with "allow-service ..." command.
To create explicit ACL and attach to the device:
1) Go to vManage > Configuration > Policies > Localized Policy > Custom Options [ Access Control Lists ] > Add IPv4 ACL:
Leave default action as drop.
Add sequence: match with source/destination data prefix and select action "accept"
2) Go to back "Localized policy" section:
Create new device or template specific policy by clicking "Add policy". Do next two times, then in the Access List section click "Add Access Control List Policy" and import previously created ACL. Click next-next and give name/description to this new localized policy.
3) Go to device template section and under Additional Template section add Policy:
Push new config and wait.
4) And finally, you need to use this access-list from attached localized policy in the interface. For this, go to respective interface feature template and use access-list:
Plus, ensure that, none of protocol is allowed with allow-service command under this tunnel interface (explicitly select OFF, even if you have allow-service all <> OFF)
Push config and wait
Note: you don't need explicitly allow tunnel overlay traffic even if you have default action drop in explicit ACL.
