Configure Reusable Objects

Add an Address Group 

Complete the following workflow to create an address group. 

1. In step 1, Addresses, enter information for the following fields.
   
   
    

   Field	Description
   Group Types	Select the IP address type for the group: Static IP Address Address Feed
   Static Address	Select  a static address group type: Address File Address Object Dynamic Address FQDN IP Range IP Subnet IP Wildcard IPv6 Subnet Click the  Add icon to add a new IP address group. You can add multiple Address Group types.  Click the  Minus icon to delete an IP address group.
   IP Addresses	Enter valid IP addresses for the type: IP Subnet—One or more IPv4 subnets, for example, 10.1.1.0/24 IP Range—IP address range, for example, 10.2.1.1-10.2.2.2 IP Wildcard—IP wildcard, for example, 192.168.0.56/255.255.0.255 IPv6 Subnet—IPv6 subnet, for example, 2001:0db8:85a3:0000:0000:8a2e:0370:7334
   Address Files	When you select the Address Files type, select an address file. To add a new address file: Click Add new file. In the Upload File screen, click Browse and select an address file to upload. The file must be in CSV format. Click Submit.
   Address Feed	Enter one or more address feeds.

2. Click Next or select workflow step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next or select workflow step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. For all other sections, review the information. Click the  Edit icon to make changes, if needed. 
7. Click Submit.

Add an Address Object

Complete the following workflow to create an address object. 

1. In step 1, Information, enter information for the following fields.
   
   
    

   Field	Description
   Address Type	Select an address type and enter the value of the address in the Address Value field.
   IPv4 Subnet	Enter an IPv4 address  to evaluate the address match using an IPv4 address.
   IPv6 Subnet	Enter an IPv6 address  to evaluate the address match using an IPv6 address.
   IPv4 Range	Enter the IPv4 address range to evaluate the address match using an IPv4 address.
   IPv4 Wildcard	Enter a wildcard mask for an IPv4 address.
   IPv6 Wildcard	Enter a wildcard mask for an IPv6 address.
   Dynamic Address	Use a dynamic address object, which is a container for an IP address list that can change dynamically. Using dynamic addresses in a policy allows you to perform a configuration before the IP addresses are known, thus avoiding the need to update the configuration each time IP addresses are added or deleted.
   FQDN	Evaluate the address match using an IP address returned in a DNS query that resolves the FQDN into an IP address.

2. Click Next or select workflow step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next or select workflow step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. For all other sections, review the information. Click the  Edit icon to make changes, if needed. 
7. Click Submit.

Add a User-Defined Application

Complete the following workflow to create a user-defined application. 

1. In step 1, Application Identification, enter information for the following fields.
   
   
    

   Field	Description
   IP Prefix	Enter a valid IP prefix and subnet. Note that if you select IP Prefix, you cannot also select Host Pattern.
   Host Pattern	Enter a host pattern to detect. Note that if you select Host Pattern, you cannot also select IP Prefix.
   Protocol	Select a protocol. If you selected Host Pattern, TCP is the only protocol available.
   Source Port	If you select IP Prefix and either TCP or UDP, enter the source port number. You can enter a single port value or a range of values, for example, 500 and 1-100. Range: 0 through 65535 Default: None
   Destination Port	If you select IP Prefix and either TCP or UDP, enter the destination port number. You can enter a single port value or a range of values, for example, 500 and 1-100. Range: 0 through 65535 Default: None
   + Add Another	Click + Add Another to add another match criteria.
   Application Precedence	Enter a unique priority number to use when multiple applications match the traffic. The application with a higher precedence value is matched first. Range: 0 through 65535

2. Click Next or select workflow step 2, Application Attributes, and enter information for the following fields.
   
   
    

   Field	Description
   Risk	Select a risk level. Each application has been assessed and assigned a risk level by the Versa Networks security research team, as follows: Level 1—Lowest Risk Level 2—Low Risk Level 3—Medium Risk Level 4—High Risk Level 5—Highest Risk
   Productivity	Select a productivity level. Each application has been assessed and assigned a productivity level by the Versa Networks security research team, as follows: Level 1—Lowest Productivity Level 2—Low Productivity Level 3—Medium Productivity Level 4—High Productivity Level 5—Highest Productivity
   Application Tags—Security	Select one or more security tags to associate with the application.
   Application Tags—SD-WAN	Select one or more SD-WAN tags to associate with the application.
   Application Tags—General	Select one or more general tags to associate with the application.
   Family	Select a family to associate with the application.
   Subfamily	Select a subfamily to associate with the application.

3. Click Next or select workflow step 3, Permissions.
4. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
5. Click Next or select workflow step 4, Review and Submit. In the General section, enter information for the following fields.
   
   
    

   Field	Description
   Name	Enter a name for the user-defined application.
   Description	Enter a description for the application.
   Tag	Enter one or more tags to to associate with the application. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects.
   Upload Application Image	Click the  Upload File icon. In the popup window, select an application image and upload it. Images must be in .png or .jpg format.

6. For all other sections, review the information. Click the  Edit icon to make changes, if needed. 
7. Click Submit.

Add a User-Defined Application Group

Complete the following workflow to create an application group. 

1. In step 1, Applications, enter information for the following fields.
   
   
    

   Field	Description
   User-Defined Applications	Select one or more user-defined applications to add them to the application group.
   Predefined Applications	Select one or more predefined applications to add them to the application group.
   + Add Application	Click to add a new user-defined application. See Add a User-Defined Application.

2. Click Next or select workflow step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next or select workflow step 3, Review and Submit. 
5. In the General section, enter information for the following fields. 
   
   
    

   Field	Description
   Name (Required)	Enter a name for the user-defined application group.
   Description	Enter a description for the application group.
   Tag	Enter one or more tags to to associate with the application group. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects.
   Upload Application Group Image	Click the  Upload File icon. In the popup window, select an application group image and upload it. Images must be in .png or .jpg format.

6. For all other sections, review the information. Click the  Edit icon to make changes, if needed. 
7. Click Submit.
8. To view predefined application groups, select the Predefined Application Groups tab.
   
   

Add Application Categories

Complete the following workflow to create an application category. 

1. In step 1, Settings, enter information for the following fields.
   
   
   As you select categories, the application list adjusts to only show the applications that match selected categories. For example, in the sample screen above, 4,270 predefined applications and 9 user-defined applications are selected. Because no filters have yet been configured, these numbers represent the total number of predefined and user-defined applications that are available. The numbers change as you configure the various application filters. If you select multiple filters, the list changes to display the applications that match all of the filters you selected. 
2. To customize the application risk filter, click the Risk tab in the Category Filters section, and then select one or more application risk filters. Each application has been assessed and assigned a risk level (Level 1 = lowest to Level 5 = highest) by the Versa Networks security research team. The number in each card indicates applications with the same risk.
   
   
   In this example screen, two risk levels are selected: Level 1 and Level 4. There are 117 Level 1 (lowest risk) applications and 134 Level 4 (high risk) applications, for a total of 251 applications. This total matches the sum of the numbers displayed in the Predefined Applications (251) and User Defined Applications (7) tabs.
3. To customize the application productivity filter, click the Productivity tab in the Category Filters section, and then select one or more application productivity filters. Each application has been assessed and assigned a productivity level (Level 1 = lowest to Level 5 = highest) by the Versa Networks security research team. The number in each card indicates applications with the same productivity.
   
   
   In this example screen, one productivity level is selected: Level 3. There are 3033 Level 3 (medium productivity) applications. Of these 3033 applications, 95 match the combined filter criteria of Level 1 and Level 4 application risk plus Level 3 application productivity. This total matches the sum of the numbers displayed in the Predefined Applications (94) and User Defined Applications (1) tabs.
4. To customize the application tags filter, click the Tags tab in the Category Filters section, and then select one or more application tags filters. 
   
   
   In this example screen, one application SD-WAN tag is selected. There are 22 predefined applications and 1 user-defined application, for a total of 23 applications that match all of the selected filters. This total matches the sum of the numbers displayed in the Predefined Applications (22) and User Defined Applications (1) tabs.
5. To customize the application family and sub-family filter, click the Family and Sub-Family tab in the Category Filters section, and then select one or more application filters.
   
   
   In this example screen, one application family tag is selected. There is 1 predefined application and 1 user-defined application, for a total of 2 applications that match all of the selected filters. This total matches the sum of the numbers displayed in the Predefined Applications (1) and User Defined Applications (1) tabs.
6. Click Next to or select workflow step 2, Permissions.
7. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
8. Click Next or select workflow step 3, Review and Submit. 
   
   
9. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
10. For all other sections, review the information. Click the  Edit icon to make changes, if needed. 
11. Click Submit.

Add a BGP Peer Policy  

BGP peer and peer group policies consist of one or more terms for filtering BGP routes that are received from or advertised to remote BGP peers. The policy executes terms in the order in which they are listed in the term name table. Each term consists of match conditions and actions to apply to matching routes. If a route matches, an Accept or Reject action is performed by an accept term or a reject term.

Complete the following workflow to create a BGP peer policy. 

1. In workflow step 1, Terms, click Add Term.
   
   

2. Complete the following workflow to create a BGP peer policy term. 

   

   1. In workflow step 1, Match Criteria, enter information for the following fields.
      
      
       

      Field	Description
      Policy Term Name (Required)	Enter a name for the policy term.
      Community	Enter the BGP community string to match. A BGP community is a group of destinations with a common property. This path attribute in BGP update messages identifies community members and performs actions at a group level instead of at an individual level. BGP communities help identify and segregate BGP routes, enabling smooth traffic flow.
      Extended Community	Enter the extended BGP community string to match. In an extended community, you can group a larger number of destinations than in a community. Range: 0000000000000000 to FFFFFFFFFFFFFFFF Default: None
      AS Path	Enter the AS path number to match.
      Metric	Enter the metric value to assign to the route. Range: 0 through 4294967295
      IP Prefixes (NLRI) (Group of Fields)	Enter information about the IPv4/IPv6 prefix. Click the  Plus icon to add additional IPv4/IPv6 prefixes. Click the  Minus icon to remove IPv4/IPv6 prefixes.
      IPv4 Prefixes (Required)	Enter a valid IPv4 prefix, for example, 10.1.1.0/24.
      Minimum Length	Enter the minimum prefix length to match. The minimum prefix length must be less than the maximum prefix length. Range: 24 through 32 Default: None
      Maximum Length	Enter the maximum prefix length to match. The minimum prefix length must be less than the maximum prefix length. Range: 0 through 32 Default: None
      Action (Required)	Select the action to take on the routes: Accept—Accept routes with this prefix. Reject—Reject routes with this prefix.
      IPv6 Prefixes (Required)	Enter a valid IPv6 prefix. For example, 2001::/24.
      Minimum Length	Enter the minimum prefix length to match. The minimum prefix length must be less than the maximum prefix length. Range: 32 through 128 Default: None
      Maximum Length	Maximum Length—Enter the maximum prefix length to match. The minimum prefix length must be less than the maximum prefix length. Range: 0 through 128 Default: None
      Action (Required)	Select the action to take on the routes: Accept—Accept routes with this prefix. Reject—Reject routes with this prefix.

   2. Click Next or select workflow step 2, Action, and then enter information for the following fields.
      
      
       

      Field	Description
      Action (Group of Fields)
      Action	Select the action to take on the routes: Accept Reject
      Local Preference	Enter the local preference value to use to choose the outbound external BGP path. Range: 0 through 2147483647
      Enable ECMP for BGP Routes in RIB	Click the toggle to perform equal-cost multipath (ECMP) for BGP paths in the route table. BGP performs ECMP load balancing when two or more routes have the same administrative distance.
      Administrative Distance	Enter an administrative distance value for routes learned from EBGP. Range: 1 through 255 Default: None
      Metric Action	Select the metric action to take: Add IGP  (interior gateway protocol) Set Value Subtract
      Metric	Enter a metric value. For IGP metric action, metric value is not applicable. Range: 0 through 4294967295.
      Next Policy Term	Select the name of the next policy term to evaluate. You can use this field to create a sequence of terms, and then you use the Next Policy Term Action field to configure the sequence as an AND or OR series.
      Next Policy Term Action	When you use the Next Policy Term field, select whether to create an AND series and an OR series: AND Series—Add this term to an AND series. OR Series—Add this term to an OR series.
      Community (Group of Fields)
      Community Action	Select how to match the community list for a route: Community field is ignored. Remove all communities from the route. Replace all communities with the single community specified by set-community. Remove all communities that match community value. Append the value of community value into the communities list.
      Community Action Value	Enter the community action value. The value should be a set of communities separated by a space in the format 2-byte decimal:2-byte decimal. Note that not all extended community actions require a community value. Range: 0 through 65535 Default: None
      Extended Community Action	Select how to match the community list for a route: Community field is ignored. Remove all communities from the route. Replace all communities with the single community specified by set-community. Remove all communities that match community value. Append the value of community value into the communities list.
      Extended Community Action Value	Enter the BGP extended community action value. The extended community action value should be 16 characters. Range: 0000000000000000 to FFFFFFFFFFFFFFFF Default: None
      AS Path (Group of Fields)
      AS Path Action	Select a regular expression to match the AS path for the route: No AS path action. Prepend the local AS path the number of times specified by local AS prepend count. Remove all AS numbers matched by match as-path. Remove all AS numbers matched by match as-path and prepend the local AS the number of times specified by the local AS prepend count.
      AS Path Prepend	Select how to prepend the AS number to an AS path. Range: 1 through 4294967295 Default: None
      Local AS Path Prepend Count	Enter the number of times to prepend the local AS number to the AS path. Range: 1 through 255 Default: None

   3. Click Next or select workflow step 3, Review and Submit, and then enter information for the following fields.
      
      
       

      Field	Description
      Name (Required)	Enter a name for the BGP peer policy term.
      Description	Enter a description for the policy term.
      Tags	Enter one or more tags. A tag is an alphanumeric text descriptor with no spaces or special characters. You can specify multiple tags added for the same object. The tags are used for searching the objects.
      Term Enabled	Click the toggle to enable the policy term.

   4. Review the settings you have selected. Click the  Edit icon to change a setting, if needed.
   5. Click Add Terms. 
3. Click Next or select workflow step 2, Permissions.
4. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
5. Click Next or select workflow step 3, Review and Submit. 
   
   
6. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
7. For all other sections, review the information. Click the  Edit icon to make changes, if needed. 
8. Click Submit.

Add a Certificate

1. To add a CA certificate, click CA Certificate, and then enter information for the following fields. 
   
   
    

   Field	Description
   Certificate Name (Required)	Enter a name for the certificate.
   CA Chain Name (Required)	Select the CA chain name.
   Passphrase	Enter a passphrase.
   Upload Certificate/Key Bundle File	Click the  icon to upload the CA certificate file. The file must be in .zip format.

2. Click Add.
3. To add a CA Chain certificate, click CA Chain, and then enter information for the following fields.
   
   
    

   Field	Description
   CA Chain Name (Required)	Enter a name for the CA chain.
   Upload CA Chain File	Click the  icon to upload the CA chain certificate file. The file must be in .cer, .crt, or .pem format.

4. Click Add.
5. To add a private key file, click Key, and then enter information for the following fields.
   
   
    

   Field	Description
   Key Name (Required)	Enter a name for the key file.
   Passphrase	Enter a passphrase.
   Upload Key File	Click the  icon to upload the private key file. The file must in be .pem or .key format.

6. Click Add.

Add a DHCPv4 or DHCPv6 Server Profile

Complete the following workflow to create a DHCPv4 or DHCPv6 server profile. 

1. In step 1, Rules, click + Add.
    
   
   • To create a DHCPv4 or DHCPv6 server rule, see Create a DHCPv4 or DHCPv6 Server Rule.
2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Manage Files and Folders

To upload an IP address file:

1. In Tenant view, select Configure > SD-WAN > Reusable Objects > Files and Folders. The Files and Folders screen displays the uploaded address files and URL match files.
2. Select the Address Files folder, and then click the  Upload icon.
   
   
3. In the Upload File screen, click the  Upload File icon to upload an address file from the local system. The file must be in CSV format.
   
   
4. Click Save. The uploaded address file displays in the Address Files folder.
5. To download an IP address file:
   1. Select the address file.
   2. Click the  Download icon.
   3. Save the CSV file to the local system.
6. To delete an IP address file:
   1. Select the address file.
   2. Click the  Delete icon.
   3. In the delete screen, select Permanently Delete [item type].
      
       
7. To display an address file reference, select the address file, and then click the  View References icon. The View References for Address Files screen displays the references for the selected address file.
   
   

To upload a URL match file:

1. Go to Configure > SD-WAN > Reusable Objects > Files and Folders. The Files and Folders screen displays the uploaded address files and URL match files.
2. Select the URL Match Files folder, and then click the  Upload icon.
   
   
3. In the Upload File screen, click the  Upload File icon to upload a URL match file from local system. The file must be in CSV format.
   
   
4. Click Save. The uploaded URL match file displays in the URL Match Files folder.
5. To download a URL match file:
   1. Select the URL file.
   2. Click the  Download icon.
   3. Save the CSV file to the local system.
6. To delete a URL match file:
   1. Select the URL file.
   2. Click the  Delete icon.
   3. In the delete screen, select Permanently Delete [item type].
7. To display a URL match file references, select the URL match file, and the nclick the  View References icon. The View References for URL match file screen displays the references for the selected URL match file.

Configure an Interface Scheduler

Complete the following workflow to add an interface scheduler. 

1. In step 1, Categories, select the tab for the forwarding class you want to configure. You can configure more than one tab before moving to next step.
   • Assured forwarding
   • Best effort
   • Expedited forwarding
   • Network control
2. Enter information for the following fields.
   
   
    

   Field	Description
   Forwarding Class	Select any tab for the forwarding class: Assured forwarding Best effort Expedited forwarding Network control
   Traffic Class Scheduler (Group of Fields)
   Unit	Select a unit to set the transmission and guaranteed rates for data packets: Kbps—Enter the rate of data packets. Percent (%)—Enter the rate of data packets as a percentage of the line bandwidth rate or of the parent interface’s shaping rate.
   Transmit Rate	Set the transmission rate of data packets: For Kbps unit, enter the transmission rate of data packets.  Range: 8 through 100000000 Kbps Default: None For % unit, enter the transmission rate of data packets as a percentage of the line bandwidth rate or of the parent interface’s shaping rate. Range: 1 through 100 percent Default: None
   Guaranteed Rate	Set the guaranteed transmission rate of data packets: For Kbps unit, enter the guaranteed transmission rate of data packets. Range: 8 through 100000000 Kbps Default: None For % unit, enter the guaranteed transmission rate of data packets as a percentage of the line bandwidth rate or of the parent interface’s shaping rate: Range: 1 through 100 percent Default: None
   Queue Priority	Select a priority to assign for each queue. Traffic can be assigned to the following different queues: Queue 0 Queue 1 Queue 2 Queue 3 Range: 1 through 16.

3. Click Next or select workflow step 2, Permissions.
4. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
5. Click Next or select workflow step 3, Review and Submit. 
   
   
6. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
7. Review the settings you have selected. Click the  Edit icon to change a setting, if needed.
8. Click Submit.

Add an IP SLA Monitor Object

Complete the following workflow to add an IP SLA monitor object. 

1. In step 1, Categories, enter information for the following fields.
   
   
    

   Field	Description
   Monitor Protocol	Select the type of packets to send to the IP address: DNS HTTP HTTPS ICMP TCP
   Domain Name (Required)	For DNS protocol, and if you configure an FQDN, enter the domain name for the IP SLA monitor.
   HTTP Response Code Low (Required)	For HTTP and HTTPS protocols, enter the lowest value of the status code range.
   HTTP Response Code High (Required)	For HTTP and HTTPS protocols, enter the highest value of the status code range.
   HTTP Raw Request	For HTTP raw monitors, enter the HTTP request string to send generic HTTP requests to the remote endpoint. The string must include the complete HTTP request and the host attribute. For example, if you issue the HTTP request GET /vpntest HTTP/1.0\r\nUser-Agent:Versa IP SLA\r\nHost:httpserver.com\r\n\r\n;, the monitor sends a GET request to the httpserver.com to retrieve information.
   Destination Port	For DNS, HTTP, HTTPS, and TCP protocols, enter the destination port for the IP SLA monitor.  For TCP, this is a mandatory field.
   Target Type	Click to configure one or more IP addresses or FQDNs to monitor: IP Address FQDN
   IP Address (Required)	Select IP Address, and then enter the IP address to monitor.  If you select more than one IP address, all the IP addresses must be reachable for the IP monitor to be applied (this is an AND condition).
   FQDN (Required)	Select FQDN, and then enter one or more FQDNs to monitor.
   Interval	Enter the frequency, in seconds, at which to send ICMP packets to the IP address. Range: 1 through 60 seconds Default: 3 seconds
   Threshold	Enter the maximum number of ICMP packets to send to the IP address. If the IP address does not respond after this number of packets, the monitor object and IP address are marked as down. Range: 1 through 60 Default: 5
   Forwarding Class	Select a forwarding class for the IP SLA monitor to override the default forwarding class.
   Next Hop Appliance	Select the device to use as the next hop.
   Source Type
   Source Network	Select the source interface on which to send the probe packets. This interface determines the routing instance through which to send the probe packets. This routing instance is the target routing instance for the probe packets.
   Source Routing Instance	Select the routing instance for the monitor object to use to reach the target IP addresses and FQDNs.

2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Add an IP SLA Monitor Group

Complete the following workflow to add an IP SLA monitor group. 

1. In step 1, IP SLA Monitor, select the operation that you want to assign to the new group:
   • OR—If any member of the group is reachable, the entire group is considered reachable.
   • AND—If any one member monitor becomes unreachable, the entire group is considered unreachable.
     
     
2. In the IP SLA Monitors list, select one or more IP SLA monitors to add to the group. To add a new IP SLA Monitor, click + Add IP SLA Monitor. For more information, see Add an IP SLA Monitor Object.  
3. Click Next to go to step 2, Permissions.
4. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
5. Click Next to go to step 3, Review and Submit. 
   
   
6. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
7. Click Submit.

Create a Logging Profile

Complete the following workflow to add a logging profile. 

1. In step 1, Collector Groups, click Add Collector Group.
   
   
2. In the Add Collector Groups screen, enter information for the following fields.
   
   
    

   Field	Description
   Collector Group Name (Required)	By default, the collector group name is prefilled. You can change the the collector group name.
   Collector Type	Select the collector type: Versa—Select to send logs to a Versa Analytics cluster. Third-party—Select to send logs to a 3rd-party system.
   Protocol	(For the third-party collector type only.) Select a protocol: TCP UDP Note: For the Versa collector type, the TCP protocol is preselected and cannot be changed.
   Port (Required)	Enter the port number of the destination.
   Log Format	(For the third-party collector type only.) Select a log format: IPFIX Syslog Note: For the Versa collector type, the IPFIX format is preselected and cannot be changed.
   Collectors (Group of Fields)	The first collector is given highest priority for the log connections.
   Destination Type	Select the destination type, and then enter a destination value for the collector:  IP Address—Enter the IP address of the destination. FQDN—Enter the FQDN of the destination.
   Reachability Via	Select the method used to reach the destination. For Controllers, the destination must be an ADC service configured on the controller.
   + Add Collector Group	Click to add a new collector group and collector.

3. Click Add. The Collector Groups list displays the log collector group added.
   • To view the log collector group details, click the  Eye icon.
   • To add a new log collector group, click + Add.
     
     
4. Click Next to go to step 2, Permissions.
5. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role. Permissions apply to the logging profile.
   
   
6. Click Next to go to step 3, Review and Submit. 
   
   
7. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
8. Click Submit.

Add a Rewrite Rule

Complete the following workflow to add a rewrite rule. 

1. In step 1, Settings, enter information for the following fields.
   
   
    

   Field	Description
   Type	Select the rewrite table type: DSCP DSCP IPv6 IEEE 802.1p
   Category (Required)	Select the category: Assured Best Effort Expedited Network Control
   Forwarding Class (Required)	Select the forwarding class to which to apply the rewrite rule. Certain forwarding classes are available for each category: Forwarding Class 0 through Forwarding Class 3 (for the Network Control category) Forwarding Class 4 through Forwarding Class 7 (for the Expedited category) Forwarding Class 8 through Forwarding Class 11 (for the Assured category) Forwarding Class 12 through Forwarding Class 15 (for the Best Effort category)
   Loss Priority (Required)	Select the drop loss priority at which the DSCP, DSCP IPv6, or IEEE 802.1p value should be rewritten: Low High
   Code Point (Required)	Select the standard code point to associate with the forwarding class and the drop loss priority.
   + Add Another Forwarding Class	Click to add another forwarding class, if needed.
   + Add Another Type	Click to add another type, if needed.

2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Create Routing Instance Names

1. In the Create Routing Instance Names screen, enter information for the following fields.
   
   
    

   Field	Description
   Routing Instance Name	Enter a name for the routing instance.
   Guest Disabled	Click the toggle to enable the interface for guests. When enabled, this VPN interface does not participate in the topology. Only direct internet access (DIA) is provisioned. Default: Disabled
   Description	Enter a description for the routing instance.

2. Click Add.

Add SaaS Application Monitors

Complete the following workflow to add a SaaS application monitor. 

1. In step 1, Monitor Destination, enter information for the following fields.
   
   
    

   Field	Description
   Predefined SaaS Group	Click to use the SaaS application monitor to monitor a predefined set of SaaS applications, and then select the group.
   FQDN/Host Address	Click to use the SaaS application monitor to monitor applications using a specific domain or host address as the monitor destination, and then enter the FQDN or host address.
   WAN Connections (Required)	Select one or more WAN connections to monitor SaaS applications.
   Routing Instance Names	Select one or more routing instances to monitor SaaS applications.
   Monitoring Threshold	Enter a value for the monitoring threshold. This value indicates the number of consecutive monitor probes that can be lost or unresponsive before declaring the application monitor down. Range: 1 through 60 Default: 5
   Monitoring Interval	Enter how often, in seconds, to send monitoring probes. Range: 1 through 60 seconds Default: 3 seconds

2. Click Next to go to step 2, Monitor Protocol, and enter information for the following fields.
   
   
    

   Field	Description
   Monitor Protocol Type (Required)	Select a protocol type to use to monitor SaaS applications: ICMP HTTP TCP
   Destination Port	For the HTTP and TCP monitor types, enter the port number on which the application monitor is located. Range: 0 through 65535 Default: None
   Response Code Range (Group of Fields)	For the HTTP monitor type, enter the high and low values for the range of response codes to use instead of using a list of specific response codes.
   Low	Enter the low value of the response code range. The low value should be less than or equal to the high value. Range: 1 through 600 Default: None
   High	Enter the high value of the response code range. The high value should be greater than or equal to the low value. Range: 1 through 600 Default: None
   Response Codes	For the HTTP monitor type, enter one or more response codes, which are the expected response codes from an HTTP header request. If the received response code does not match one in the list, the monitor is declared to be down.

3. Click Next to go to step 3, Consuming Tenants, and enter information for the following fields.
   
   
    

   Field	Description
   Tenants on Local Device	Select one or more tenant organizations on a local device that you want to use the metrics collected by the application monitor. The list shows the current tenant and all its subtenants and descendant tenants.
   Tenants on Remote Device	Select one or more tenant organizations on a remote device that you want to use the metrics collected by the application monitor.
   Traceroute (Group of Fields)	Enter the frequency at which traceroute requests are sent.
   Up Interval	Enter the traceroute repeat interval for when the monitor state is up, in minutes. To disable traceroute when the monitor is up, configure an interval value of 0. Range: 0 through 10080 minutes Default: None Recommended Value: 60 minutes (1 hour)
   Down Interval	Enter the traceroute repeat interval for when the monitor state is down, in minutes. To disable traceroute when the monitor is down, configure an interval value of 0. Range: 0 through 10080 minutes Default: None Recommended Value: 15 minutes
   Export Threshold (Group of Fields)
   Export Threshold Latency	Enter a latency change time, in milliseconds, to reach before the application monitor exports a new latency metric. For example, if the application monitor measures the latency as 10 milliseconds, with the default export threshold of 5 milliseconds, the metric is updated and exported when the latency reaches 15 milliseconds (10 + 5). Range: 1 through 60 milliseconds Default: 5 milliseconds
   Export Threshold Loss	Enter the amount of loss, as a percentage, to reach before the application monitor exports a new latency metric. Range: 1 through 100 percent Default: 2 percent

4. Click Next to go to step 4, Permissions.
5. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
6. Click Next to go to step 5, Review and Submit. 
   
   
7. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
8. Click Submit.

Add a Schedule

Complete the following workflow to add a schedule. 

1. In step 1, Recurrence and Time Interval, enter information for the following fields.
   
   
    

   Field	Description
   Recurrence	Select the type of schedule: None—Specify the start and end date and time. Daily—Select all day, or specify a start and end time in 24-hour format (HH:MM). Weekly—Select a day of the week, and then select all day or specify the start and end time in 24-hour format (HH:MM).

2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Add a Security Action

Complete the following workflow to create a security action. 

1. In step 1, Configure Security Actions, enter information for the following fields.
    
   
    

   Field	Description
   Security Action Type	Select a security action type: All CASB Decryption DNS Intrusion Prevention System (IPS) IP Filtering URL Filtering (URLF)
   Action	Select an action: Allow—Forward the current packet without generating an entry in the log. Drop Packet—Browser waits for a response from the server and then drops the packets. Drop Sessions—Browser waits for a response from the server and then drops the session. Reset Client—TCP Reset packet is sent to the client and the browser displays an error message indicating that the connection has been reset. Reset Client and Server—TCP Reset packet is sent to the server. The browser waits for a response from the server and then drops the session. Block—Present an alert page to the user and block the user from continuing, in case of HTTP/HTTPS. Inform—Browser presents an information page that allows the user to continue with the operation by clicking OK. Ask—Browser presents an information page that allows the user to either cancel the operation by clicking Cancel, or continue with the operation by clicking OK. Justify—Browser presents an information page that allows the user to either cancel the operation by clicking Cancel, or continue with the operation after entering a justification message and clicking OK. Override—Browser prompts the user to enter a PIN (4 to 6 digits). Custom Redirection—Browser redirects the user to the URL configured in the Redirection URL field. Sinkhole—A DNS sinkhole spoofs DNS servers to prevent the resolution of the host names associated with URLs. And returns a false IP address to the URL, blocking a DNS sinkhole.
   Decrypt Bypass	(For all security types except CASB.) Click the toggle to disable SSL encryption for matching traffic, to allow you to define web sites that are not subject to decryption. Default: Enabled
   Log Captive Portal Actions	(For all security types except CASB.) Click the toggle to enable the logging of captive portal actions. Default: Disabled
   Expiration Time	(For security types IP Reputation and URL Filtering.) Enter how often to redirect a user to the URL, in minutes.
   Message	(For security types IP Reputation and URL Filtering.) Enter a message to display on the captive portal page.

2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Add a Service Object

Complete the following workflow to create a custom service object. 

1. In step 1, Protocol & Port, enter information for the following fields.
    
   
    

   Field	Description
   Protocol (Required)	Select a protocol. The options are: AH (Authentication Header) ESP (Encapsulating Security Payload) ICMP (Internet Control Message Protocol) TCP TCP_OR_UDP 0 to 255
   Source OR Destination	Click to enter the source or destination ports.
   Source OR Destination (Required)	Enter the source or destination port for the protocol. For multiple entries, use comma-separated single port values or a range of port values separated by a hyphen, for example, 1-100, 2-200, 3. Range: 0 through 65535 Default: None
   Source AND Destination	Click to enter the source and destination ports.
   Source	(For TCP, UDP, or TCP_OR_UDP protocols only.) Enter the source port for the protocol. For multiple entries, use comma-separated single port values or a range of port values separated by a hyphen, for example, 1-100, 2-200, 3. Range: 0 through 65535 Default: None
   Destination	(For TCP, UDP, or TCP_OR_UDP protocols only.) Enter the destination port for the protocol. For multiple entries, use comma-separated single port values or a range of port values separated by a hyphen, for example, 1-100,2-200,3. Range: 0 through 65535 Default: None

2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Add a Service Group

Complete the following workflow to create a custom service group. 

1. In step 1, Services, select one or more user-defined and predefined services to add to the group. 
   • To filter the services in the services list, select any of the following from the All Types drop-down list:
     • All Types— Displays user-defined and predefined services in the list. This is the default.
     • User-Defined—Select to display user-defined services in the list. 
     • Predefined—Select to display predefined services in the list.
   • To add a service object, click the + Add icon. See Add a Service Object section above.
      
     
2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Add a URL Category

Complete the following workflow to create a custom service object. 

1. In step 1, Settings, enter information for the following fields.
    
   
    

   Field	Description
   URL Patterns (Group of Fields)
   Patterns	Enter a URL pattern to match and group the URLs. You can include regex patterns. For example, you can use the pattern www.versa-networks.com, or you can use a wildcard such as *.versa-networks. To include a backslash character (\) in the regex pattern, you must escape it by preceding it with a backslash.
   Reputation	Select a predefined reputation, and then assign it to the URL match pattern.
   URL Strings  (Group of Fields)
   String	Enter a URL string to match the URL, for example, www.versa-networks.com.
   Reputation	Select a predefined reputation, and then assign it to the URL string.
   URL Files	Select a URL file. To add a new URL file, click + Create New.  In the Upload File popup window, click Browse, select a URL file to upload, and then click Submit. The file must be in CSV format.
   URL Feeds	Enter one or more URL feeds to receive URLs and their reputations dynamically.
   Set confidence level for URL category	Enter a confidence level number for the URL category.  Range: 1 through 100

2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.

Configure Zones

Complete the following workflow to configure a zone. 

1. In step 1, Zones, select one or more interfaces to add to the zone that share the same security requirements.
    
   
2. Click Next to go to step 2, Permissions.
3. The permission for each role is selected by default, and you can update it. To change permissions for a role, select or deselect the Create, Read, Update, and Delete fields for the role.
   
   
4. Click Next to go to step 3, Review and Submit. 
   
   
5. In the General section, enter a name for the reusable object. You can also enter a description and tags. A tag is an alphanumeric descriptor, with no white spaces or special characters, that you can use to search the objects. 
6. Click Submit.