Configure Business Intent Overlay Policies
Complete the following steps to configure BIO policies to associate with Netskope.
After creating the IPsec tunnels from the EdgeConnect appliance to the primary and failover POPs, create a business intent overlay (BIO) that points to those IPsec tunnels. Using access control lists (ACL), specify the applications that you want to forward to Netskope on the BIO screen.
Before creating a BIO, create ACLs on the Configuration > Template screen and apply them on the EdgeConnect appliance. Refer to the BIO and ACL online help for more information.
On the Orchestrator home screen, select Configuration > Business Intent Overlays.
The Business Intent Overlays tab opens.
In this example, the BIO references a CriticalApps ACL that already exists on the EdgeConnect appliance.
Click any cell in the SD-WAN Traffic to Internal Subnets column. This opens the BIO edit dialog.
Select the Link Bonding Policy you want to apply to your ACL.
Go to the, Breakout Traffic to Internet & Cloud Services tab.
Select the pencil icon next to Available Policies. The Services screen opens.
For Service Name, select the name assigned to the primary POP. This service references the traffic sent to the primary POP.
Click Add.
For Service Name, select the name assigned to the failover POP.
Click Add, and then click Save. The two services will be listed in the Available Policies section.
Drag the services to the Preferred Policy Order section.
In the Preferred Policy Order section, move the primary POP service above the failover POP service. By moving the primary POP to the top of the list, traffic is automatically forwarded to the primary POP.
Click OK.
Click Save and Apply changes to the Overlay. You have now configured a business intent overlay that points to the new IPsec VPN tunnels.
Your changes will be highlighted in the BIO table, but they have not yet been applied.