VCF SD-WAN Insight: Deployment

Version: 2026.1.1.0

This page covers permissions, installation and every adapter field. The object model, content and alerting behaviour are described in the Overview; the complete attribute list is in the Metrics Reference.

User Permissions and Connection Requirements

Category	Description
User Permissions (Cisco)	The Management Pack requires a dedicated read-only user within your SD-WAN Manager environment. The Operator role, or a custom read-only role with access to the device inventory and the real time monitoring endpoints, is sufficient. No write operation is ever performed
User Permissions (Fortinet)	A dedicated read-only FortiManager account. For the Bearer token, create an API user with rpc-permit read scoped to the target ADOMs; for the session fallback, a read-only administrator account with access to the managed device inventory and the FortiGate monitor API. No write operation is ever performed
Cloud Proxy to SD-WAN Manager (Cisco)	Ensure a stable connection between the selected Cloud Proxy and the SD-WAN Manager (vManage) using the HTTPS protocol on port 443
Cloud Proxy to FortiManager (Fortinet)	Ensure a stable connection between the selected Cloud Proxy and FortiManager using the HTTPS protocol on port 443. FortiManager is the single point of integration: the adapter reaches the managed FortiGate devices through FortiManager's proxy, so no direct Cloud Proxy to FortiGate connectivity is required
Cloud Proxy to Registry	A reliable connection between the Cloud Proxy and https://registry.indevops.com is required, accessible via port 443. The adapter container image is pre-pulled from this registry before the PAK is installed
TLS	TLS 1.2 or newer to both SD-WAN Manager and FortiManager. FortiManager is HTTPS-only in this adapter - there is no plain-HTTP fallback
Aria Operations Suite API	Suite API credentials must be configured for the VMware Aria Operations instance so the addon can resolve the relationship between the SD-WAN devices and the virtual machines that host them. Without them the collection still succeeds, only the virtual machine relationships are skipped
Session / rate limit	SD-WAN Manager caps concurrent sessions per account, and FortiManager allows roughly 10 JSON-RPC requests per second per session. Use a dedicated account for the addon and keep the API concurrent request limit at its default unless advised otherwise

Installing the addon

Pre-pull adapter's container image

Adapter's container must be pre-pulled on cloud proxy instances.

1. SSH as root to cloud-proxies belonging to the collector group where adapter is to be run.
2. Login to docker registry using docker login registry.indevops.com.
   • Use Harbor robot account designated for that deployment - provided by INDEVOPS.
3. Pull container image using docker pull <IMAGE NAME>.
   • Image name can be found on release page for a given version of the management pack.

Install PAK file

1. Download PAK file for version matching the pre-pulled adapter container image.
   • PAK file can be found on release page for a given version of the management pack.
2. Login to VMware Aria Operations and go to 'Administration > Integrations > Repository > Add' and upload the PAK file, selecting both:
   • Install the PAK file even if it is already installed
   • Ignore the PAK file signature checking
3. Install the management pack.

Configure Adapter

1. Go to Administration > Integrations > Repository
   • Use filter on the right to put Indevops
   • Click on brick with VCFSdwanInsight
2. Use button ADD ACCOUNT
3. Fill the fields

Add one account per vendor. A Cisco account and a Fortinet account are separate adapter instances; each instance collects exactly the vendor selected in the SD-WAN Vendor field.

Adapter fields

Field Name	Definition
Name	A unique identifier or label for the adapter.
Description	A brief description of the adapter's purpose or function.
SD-WAN Vendor	Selects which SD-WAN vendor this instance collects: Cisco Catalyst SD-WAN or Fortinet SD-WAN. Leave empty or choose Cisco Catalyst SD-WAN for the Cisco behaviour - an empty value keeps pre-existing Cisco instances working unchanged. One instance collects exactly one vendor.
API Host	Hostname or IP address of the management platform: the SD-WAN Manager (vManage) for a Cisco instance, or FortiManager for a Fortinet instance.
Credentials	Authentication details. For Cisco use the Basic credential kind. For Fortinet use the Fortinet API key kind (Bearer token) or Basic (username/password session). See the credential fields below.
Collector / Group	The collector or group managing data collection. Must be set to cloud proxy where the adapter's container image is pre-pulled.
API Port	HTTPS port of the management platform API. Defaults to 443.
API concurrent request limit	Maximum number of concurrent requests sent to the management platform. SD-WAN Manager caps concurrent sessions and requests per account, and FortiManager allows roughly 10 requests per second per session, so keep this value low. For a Fortinet instance the same limit bounds the FortiGate proxy fan-out and the per-device RTM calls. Defaults to 10.
Site ID filter	Comma separated list of site-id values to collect. Leave empty to collect all sites. The filter is applied to the device inventory before any per-device request is issued. Fortinet has no natural site identifier, so a Fortinet device passes the filter only once a customer-side site mapping is configured.
Fortinet ADOM	Fortinet only. Administrative Domain whose inventory and SD-WAN configuration are collected. Defaults to root.
Fortinet proxy shard size	Fortinet only. Maximum number of targets per /sys/proxy/json call. The synchronous FortiManager proxy times out after 60 seconds, so large fleets must be sharded. Defaults to 200.
Fortinet device group	Fortinet only. FortiManager group used as the target of the /sys/proxy/json fan-out. Defaults to All_FortiGate.
Skip TLS certificate verification (INSECURE)	Disables verification of the management platform TLS certificate. Accepts true or false. Use only in laboratory environments.
Link type overrides	Advanced. Comma separated list of <pattern>=<type> entries declaring the transport type of a WAN Link, for example WAN_A*=MPLS,WAN_B*=Internet,*LTE*=Internet. The type must be MPLS, Internet or Biz Internet. The pattern is a case-insensitive glob matched against the link identity name (the interface name) first and then against the device name; the first matching entry wins. Malformed entries are ignored. Leave empty to keep the automatic classification, which needs a transport token in the transport colour, member zone, interface name or alias.
SLA default level / SLA level overrides	Advanced. Default SLA level (1 or 2) and a comma separated list of <pattern>=<level> entries. The pattern is a case-insensitive glob matched against the node / device name first and then the site_id; a link inherits the level of its parent node.
Default link capacity (Mbit/s)	Advanced. Capacity used for a WAN Link when no override and no API interface speed resolves one. Utilization is throughput divided by capacity, so without a capacity no utilization point is emitted; throughput is unaffected. The FortiGate API cannot map an overlay member (WAN_A1) to the physical interface that transports it (wan1), so a Fortinet instance normally needs this value. Defaults to 100; 0 disables the default.
Link capacity overrides	Advanced. Comma separated list of <pattern>=<Mbit/s> entries, for example WAN_A*=100,WAN_B*=200,*LTE*=50. The pattern is a case-insensitive glob matched against the link identity name (the interface name) first and then the device name; the first matching entry wins. Resolved before the API interface speed and before the default capacity. Malformed entries are ignored.
SLA level 1 downtime budget (hours)	Advanced. Unavailability a level 1 object may accumulate inside the SLA window. The availability threshold is derived, never configured: (1 - hours / (window days * 24)) * 100. Defaults to 8 hours per 30 days, which yields 98.89 percent. The budget is written to sla_allowed_downtime_hours and the threshold to sla_availability_threshold, and both are shown in the reports. It is also the delay of the critical stage of the alerting ladder, whose symptom waitCycle (96) is fixed at the 8 hour default expressed in five minute cycles, so changing this value does not re-scale that waitCycle.
SLA level 2 downtime budget (hours)	Advanced. Unavailability a level 2 object may accumulate inside the SLA window. Defaults to 4 hours per 30 days, which yields 99.44 percent. The same derivation and the same fixed waitCycle (48) as level 1 apply.
SLA monitoring window (days)	Advanced. Length of the monitoring window the two downtime budgets refer to. Defaults to 30.
Adapter Memory Limit (MB)	Maximum memory (in MB) the adapter can use.
Log Level	Logging detail level: Debug for detailed logging, Normal for standard logs, Trace for extensive tracing.

Credential fields

For a Cisco instance the only credential type is Basic:

Field Name	Definition
Credential Kind	Basic - username and password of a read-only SD-WAN Manager account.
Username	Username of the read-only SD-WAN Manager account used by the adapter.
Password	Password of the read-only SD-WAN Manager account used by the adapter.

For a Fortinet instance there are two credential types:

Field Name	Definition
Credential Kind	Fortinet API key - the FortiManager Bearer token. Basic - the session fallback.
API key	FortiManager API key, sent as Authorization: Bearer <key>. Used with the Fortinet API key credential kind. No login or logout is performed in this mode.
Username	FortiManager account used with the Basic credential kind. The adapter logs in with exec sys/login/user and releases the session on teardown.
Password	FortiManager password for the Basic credential kind.

The adapter resolves a Fortinet credential as follows: an API key yields Bearer mode; a username and password yield session mode; anything else fails validation with a clear error. The API key and the session token are never written to the adapter log.

After filling in the fields, use VALIDATE CONNECTION to confirm that the Cloud Proxy can reach the management platform, that the credentials are accepted and that the device inventory can be read, then save the account. For a Fortinet instance the validation reads the FortiManager system status and the managed device inventory. The first collection starts on the next collection cycle.