Example VPN configuration 3: configure VPN settings for the Secure SD-WAN Engine

Configure certificates and sites for the mobile VPN.

1. Right-click the engine element, then select Edit Single Engine or Edit Engine Cluster.
2. In the navigation pane on the left, browse to SD-WAN > Certificates.
3. Make sure that Automated RSA Certificate Management is selected.
4. In the navigation pane on the left, browse to SD-WAN > Sites.
   The Sites represent the internal addresses that VPN clients can reach through the VPN. Sites do not grant any host access directly. The Access rules define the allowed connections.
5. (Optional) Leave Add and update addresses based on routing selected.
   This option automatically updates this information based on routing changes. You can exclude some interfaces while keeping the others automatically updated.
6. (Optional) Select the internal networks that you want to exclude from the VPN by disabling the interface they are under in the automatic site.
   Disabled interfaces are grayed-out.

   • If you want to include some individual network that is under an otherwise disabled interface, drag and drop it from under the disabled interface onto the Site element. The element is copied to the higher level. The copied definition is not updated automatically.
   • The Sites must include only internal networks. Do not add interfaces with the Any Network element in this type of VPN.
7. Click Save.