Citrix SD-WAN Orchestrator for On-premises 12.3

Network configuration

This section offers enterprise network level configuration capabilities, and the starting point for configuring the SD-WAN network of an enterprise.

Network configuration: Home

This section act as an anchor for network configuration. The Home page provides the ability to initiate most of the commonly needed configuration actions, such as the ability to:

  • Add a site
  • Batch adds multiple sites at once
  • Deploy configuration or upgrade software, and track the progress
  • Back up/Review Checkpoints
  • Perform the following operations:
    • Browse and Upload Config
    • Download Config JSON
    • Download Config DB
    • Add Region
    • Add Group

All the configured sites are displayed here. You can edit, update, delete, reset, and update the password of any site. You can also reboot the devices associated with a site.

Network level configuration home

You can upgrade the SD-WAN software on all the appliances across the network, by simply selecting an appliance software version from the Software Version drop-down list.

Only the software versions that are published under Infrastructure > Orchestrator Administration > Software Images > Appliance get listed in the Software Version drop-down list. For more information, see Publish software.

Software version

A confirmation message appears. Click Proceed.

Network level software upgrade

Add site

Use the + Add Site option to add a new site. For more information on site configuration workflow, see Site Configuration.

Batch add sites

The Batch Add Sites option allows you to quickly add several sites as a batch. You can also select a site profile to be used for each site, leaving you only with unique parameters such as IP addresses that remain to be configured for each site.

Batch adds site

Deploy Config/Software

The Deploy Config/Software option allows you to deploy the current configuration and software across the network, once the sites are configured. For more information on the deployment process, see Deployment Tracker section.

Deployment tracker

The Deploy Config/Software option takes you to the Deployment Tracker section to help verify the configuration, stage, and activate the same across the network.

Deployment tracker

  • Stage: Once the verification of configuration is successful, click Stage to distribute the configuration files to all the appliances in your network.

    If the staging process fails at any site, use the Retry Staging option, under the Actions column, to re-initiate the staging process.

  • Active: Click Activate to activate the staged configuration on all the sites across the network.

  • Ignore Incomplete: When selected, the Activate check box is enabled only after all the online control nodes (MCN, RCN, Geo MCN, Geo RCN) get staged. You can choose to activate even if some of the online branch appliances are not staged. The online branch appliances that fail to get staged are ignored.

  • Partial Site Upgrade Setting: The Partial Site Upgrade option is added to upgrade or downgrade the selected sites with a different version. The Partial Site Upgrade feature provides the ability to test a new version before deploying to the entire network.

With the Partial Site Upgrade feature, upgrades can be staggered and thereby reducing the impact of software upgrades during business hours.

Any configuration changes for the Partial Site Upgrade need a change management for the changes to take effect. The Partial Site Upgrade picks the lower version and generates the configuration for the same. Any new features cannot be tested while the network is in the Partial Site Upgrade mode.

When you are downgrading from a newer to older version using the Partial Site Upgrade, if a feature which is supported only in the newer version (with the similar configuration present both in the new and older version), audit errors occur. For example, a new platform is selected which is only supported on the newer version then this will throw audit errors.

To perform the partial site upgrade:

  1. Click the Setting … icon and select the Partial Site Upgrade option.

    Partial site upgrade setting icon

  2. Select the Partial Site Upgrade check box, choose the software version, and click Select Sites to add new sites.

    Add and remove sites for partial upgrade

  3. Select the sites and click Save.

    Partial sites upgrade remove

    Partial sites upgrade done

In the case of a configuration-only update, only the sites that have configuration changes are staged and activated. For the remaining sites, the timestamp is updated and processed.

If the software version is being changed, both configuration and software package are staged and activated on all the sites in the network.

The Deployment History section helps to review the previous deployment operations and results.

Deployment history

HA near-hitless software upgrade

During software upgrade (11.0.x and earlier versions), the staging, and activation of all the appliances in the network are done at the same time. This includes the High Availability (HA) pair, leading to network downtime. With the HA near-hitless software upgrade feature, the Citrix SD-WAN Orchestrator for On-premises ensures that the downtime during the software upgrade (11.1.x and above) process is not more than the HA switch over time.


The HA near-hitless software upgrade is applicable for the following:

  • The sites that are deployed in High Availability (HA) mode. It is not applicable for Non-HA sites.
  • Citrix SD-WAN Orchestrator for On-premises based deployments only and not for the networks that are managed using the SD-WAN Center or MCN.
  • Software upgrade only and not configuration updates. If there is configuration change along with the software as part of the upgrade, the Citrix SD-WAN Orchestrator for On-premises does not perform HA near-hitless software upgrade and continues to upgrade in the earlier fashion (single-step upgrade).

The upgrade sequence summary:

  1. Citrix SD-WAN Orchestrator for On-premises checks for the HA state of all the appliances in the network.
  2. Upgrades all the secondary appliances that are in Standby state.
  3. HA switch-over is triggered and the state of the Active and Standby appliances are switched.
  4. Upgrades the primary appliances that are now in Standby state.

The HA near-hitless software upgrade is a two-step upgrade process:

Step-1: During software upgrade, after the 11.1 release, the Citrix SD-WAN Orchestrator for On-premises first performs software upgrade on all the appliances that are in the Standby state across the network. The network is still up and running with the Active appliances in place.

After all the Standby appliances are upgraded to the latest software, the HA switch-over is triggered across the network. The Standby appliances (with the latest software) become Active.

Step-2: The current Standby appliances with an old software version are upgraded to the latest software and will continue to run in Standby mode.

During this software upgrade process, all other Non-HA sites will also be activated with the latest software.

For more information, see the FAQs.

You can view the upgrade status by navigating to Deployment Tracker > Current deployment.

Deployment history

  • Stage: Click Stage to distribute the configuration files to all the appliances in your network.
  • Active: Click Activate to activate the staged configuration on all the sites across the network.

Auto-correction for configuration and software upgrade

In the Citrix SD-WAN Orchestrator for On-premises, the auto-correction feature is implemented in the change management workflow.

When the staging failed for one site, and if the site that had failed staging is a control node, you need to restage after getting the staging failure message. The Activate button will not be enabled if the staging fails for the control nodes. In case, the site that had failed staging is a branch node, you are still allowed to move ahead with the activation. But to bring that branch in sync with the network, perform another round of change management.


  • The auto-correction check starts only after the Activate button has been clicked and stops once the next stage is issued from the Citrix SD-WAN Orchestrator for On-premises UI.

  • The maintenance mode functionality is only applicable for the auto-correction feature. If you initiate a Staging and Activation, the appliance with the maintenance mode enabled also gets updated with the software and configuration changes.

With the auto-correction feature enhancement, when a staging failure happens, the auto-correction mechanism pushes the expected software and configuration version to the failed branch and tries to bring it up in sync with the current network. The auto-correction feature is applicable for staging failure on the branch node and activation failure on any node.

The following are the two trigger points when the auto-correction starts:

  • In the Citrix SD-WAN Orchestrator for On-premises deployment tracker UI, once you get a Staging Failed or Activation Failed message, the auto-correction starts running in the background. The auto-correction check starts once the activation is completed.

  • In the case of a software and configuration mismatch, where the appliance didn’t come up with the expected software and configuration version, the Citrix SD-WAN Orchestrator for On-premises starts pushing the actual required software and configuration copy down to the appliance for activation.

To troubleshoot an appliance manually, enable the maintenance mode check box under the Change Management Settings. This check box is used to control if the device needs to be checked for auto-correction or not. Once the maintenance mode check box is cleared, auto-correction brings the appliance in sync with the network software and configuration version.

Maintenance mode

Back up/Review checkpoints

The Back Up/Review Checkpoints option has the ability to back-up and restores the configuration, or review the saved checkpoints.

Configuration checkpoint

Click Verify Config to validate any audit error.

Click Back Up Current Config option to back up the current configuration as a checkpoint for future use.

Backup current config

Click the cloud icon (under Action) to load a saved configuration. Click Proceed.

Load config

Click the book icon (under Action) to make a similar copy of an existing configuration. You can also download, edit, and delete the saved configuration checkpoints. These operations are available under Action.

More actions

Following are some of the additional actions available under More Actions:

  • Browse and Upload Config: Browse and upload one of the previously saved configurations, and have that serve as the active configuration for the network.
  • Download Config JSON: Allows you to download and export the current configuration in JSON format, for offline review.
  • Download Config DB: Allows you to download and export the current configuration in DB format.
  • Add Region: Create a Region.
  • Add Group: Create a Custom Group of sites.

Update password

You can change the password of the SD-WAN appliances at different sites, across the network, through the Citrix SD-WAN Orchestrator for On-premises.

To change the password, for an appliance that is online click the more icon and select Update Password.

Update password

Provide the values for the following fields:

  • User Name: Select a user name for which you want to change the password from the list of users configured at the site.

  • Current Password: Enter the current password. This field is optional for admin users.

  • New Password: Enter a new password of your choice.

  • Confirm Password: Reenter the password to confirm it.

Update password