Requirements and guidelines for SD-WAN integration

Onboard the Catalyst SD-WAN Manager to the Security Cloud Control organization where you want to view the security events.

Onboard the SD-WAN Analytics services to your Catalyst SD-WAN Manager and enable data collection.

Ensure you have a Security Cloud Control Firewall Management organization with a valid Security Analytics and Logging subscription plan.

Note that this integration supports only viewing the connection events from your Catalyst SD-WAN devices in Security Cloud Control.

Ensure that you have a Security Analytics and Logging subscription plan that reflects the number of events the Cisco cloud receives from your on-boarded Catalyst SD-WAN devices on a daily basis. This is called your daily ingest rate. You can use the Logging Volume Estimator tool to estimate your daily ingest rate and as that rate changes you can update your data plan.

If you do not have a Security Analytics and Logging plan subscribed, you can request a 90-day trial by logging in to Security Cloud Control and navigating to Events & Logs > Events > Event Logging tab. You can accurately estimate your daily ingest rate and purchase the desired subscription plan by following the instructions in the Security Cloud Control Firewall Management Ordering Guide.