Cisco
Login
Search

Onboard Devices to Cloud-Delivered Firewall Management Center Device Management Using Device Templates Configure Site-to-Site VPN Connections in a Device Template Configure a Policy-Based Site-to-Site VPN Connection

Last updated: Aug 18, 2025

Configure a Policy-Based Site-to-Site VPN Connection

You can configure a policy-based site-to-site VPN connection to add spokes to policy-based site-to-site VPN topologies using the device template.

Before you begin

Procedure

1

Choose Devices > Template Management.

2

Click the edit icon adjacent to the device template that you want to edit.
3

Click the VPN tab.
4

Click Add VPN Connection.

5

Choose a policy-based site-to-site VPN topology from the VPN Topology drop-down list.

The Add VPN Connection dialog box expands and you can configure the following parameters:

  1. From the VPN Interface drop-down list, choose a WAN-facing or internet-facing physical interface to establish a VPN connection with the hub.

    This list contains all the interfaces configured on the device template.

    Do one of the following to configure the IP address of the VPN interface:

    • Click the Use IP Address from the VPN Interface radio button to use the IP address of the VPN interface.

      This IP address is auto populated. For IPv6 addresses, choose an IPv6 address from the drop-down list.

    • Click the Use Public IP Address radio button to configure a public IP address for the VPN interface.

      Choose an IP address variable from the drop-down list or click (add icon) to add an IP address variable.

  2. Check the Local Tunnel (IKE) Identity check box to enable a unique and configurable identity for the VPN tunnel from the spoke to a remote peer.

  3. Identity Type: Key ID is the only supported identity type. Choose a key ID variable from the drop-down list or click (add icon) to add a new key ID variable.

  4. Protected Networks: Click (add icon) to configure a protected network for the VPN connection.

    Do one of the following:

    • Choose a protected network and click OK.

    • Click Add to configure a network object and click Save.

      When you create a protected network object, note the following:

      • Click either the Host or the Network radio button.

      • Check the Allow Overrides check box.

  5. Click OK.

    You can view the VPN connection in the Site-to-Site VPN Connections table.
6

Click Save.

What to do next

  1. Note that before you apply a template to a device, to configure device-specific values for the protected networks, add these objects in Template Settings > Template Parameters > Add Network Objects Overrides.

  2. Map the device interfaces to the template interfaces (Model Mapping).

  3. Apply the template to a device.

Previous topic Configure a Route-Based Site-to-Site VPN Connection Next topic Add a Device to an SD-WAN Topology in a Dual ISP Deployment