Securing Access to vManage/vBond/VSmart access

[tjames2]

We are doing a large SD-WAN deployment and we have created a device access policy only allowing SSH access from certain devices to the vty lines for all SD-WAN routers, all good.

Question is how can this be achieved on vmanage/smart/bond. There looks like no facility to add a device template for acls or policy to these devices.

All v* servers on on-prem

Any help appreciated etc,

[damoloney]

tjames2,

I recently ran into this with our implementation of SDWAN.  Our setup is a little different in that our controllers are cloud-based.  That being said, we have a SD-WAN Self-Service portal.  The portal has our sdwan organization name and associated controllers.  Within this we can create inbound rules which determine the IP addresses or prefixes we allow inbound to the controllers for the overlay.  I'm guessing there is something similar for on-prem controllers.  Hopefully that gives you something to look into anyway.

[akoukis]

Hello,

usually for the on-prem deployments the required access between in controllers and between controllers and cEdge/vEdge  is controlled by a firewall.

https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-design-guide.html#FirewallPortConsiderations

As you mentioning there no way to create Device Access List and Local Policy for the controllers.

Best Regards

Anestis