Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


CSO SD-WAN Deployment Workflow


CSO makes use of advanced features of the devices used in SD-WAN deployments. In order to use features such as link-switching based on application identification, or remote access IPsec VPNs on vSRX Series devices, you must purchase the required licenses. However, the underlay and overlay networks, and thus SD-WAN connectivity can be established without special licensing.


Ensure that the pre-deployment tasks related to SD-WAN are carried out before you follow the procedure outlined in this topic. See Pre-Deployment Tasks for CSO SD-WAN and Next-Generation Firewall.

The following tasks for configuring SD-WAN must be performed in the tenant scope in Customer Portal.

  1. :If you are a Tenant Administrator, log in to Customer Portal. If you are an SP Administrator (CSO on-premises) or OpCo Administrator (with appropriate permissions), switch scope to the tenant. See Switch Scope or Log in as Tenant Administrator.
  2. Although the following optional tasks can are available in Customer Portal, these tasks are typically not performed in the tenant scope:
  3. For SD-WAN, you can add one or more provider hub sites, one or more enterprise hub sites, or a combination of provider hub sites and enterprise hub sites:Note

    You must add at least one hub site before you add an SD-WAN on-premise spoke site.

    1. Add one or more provider hub sites. See Add Provider Hub Sites for a Tenant.
    2. Add one or more enterprise hub sites. See Add Enterprise Hub Sites.
  4. If you added enterprise hub sites, perform post-processing tasks for the enterprise hub sites. See Post-Provisioning Tasks for Enterprise Hub and SD-WAN Spoke Sites.
  5. Add one or more SD-WAN on-premise spoke sites. See Add SD-WAN On-Premise Spoke Sites.
  6. Perform post-processing tasks for the SD-WAN on-premise spoke sites. See Post-Provisioning Tasks for Enterprise Hub and SD-WAN Spoke Sites.
  7. (Optional) Configure a cloud spoke site. See Adding Cloud Spoke Sites for SD-WAN Deployment and Provisioning a Cloud Spoke Site in AWS VPC in the CSO Administration Portal User Guide (available on the CSO Documentation page).
  8. Monitor SD-WAN sites and devices. See Monitor SD-WAN Sites and Devices.