Skip to content
Log in Sign up My account

1.2 Cisco Catalyst SD-WAN

Blueprint 1.2: Explain the working principles of the Cisco Catalyst SD-WAN solution

  • 1.2.a SD-WAN control and data planes elements
  • 1.2.b Benefits and limitations of SD-WAN solutions

Names old and new

Cisco renamed the components in 2023. The v1.2 exam uses the new names, but documentation, CLI and older study material still use the old ones. Know both.

Current name Former name Plane Job
SD-WAN Manager vManage Management GUI, templates and configuration groups, monitoring, REST API
SD-WAN Validator vBond Orchestration First point of contact, authenticates devices, tells them where the controllers are, helps with NAT traversal
SD-WAN Controller vSmart Control Runs OMP, distributes routes, TLOCs, keys and policy to edges
WAN Edge cEdge (IOS XE) / vEdge (Viptela OS) Data Builds IPsec tunnels and forwards user traffic 
graph TB
  M[SD-WAN Manager<br/>management plane]
  V[SD-WAN Validator<br/>orchestration plane]
  C[SD-WAN Controller<br/>control plane]
  E1[WAN Edge site 1]
  E2[WAN Edge site 2]
  M -. NETCONF config .- E1
  M -. NETCONF config .- E2
  V -. initial auth .- E1
  V -. initial auth .- E2
  C -- OMP over DTLS/TLS --- E1
  C -- OMP over DTLS/TLS --- E2
  E1 == IPsec data plane + BFD ==> E2
  E1 ---|MPLS| T1((Transport))
  E1 ---|Internet| T2((Transport))

How it comes up

  1. A WAN Edge boots and, through Plug and Play or a bootstrap file, learns the Validator's address.
  2. The Edge opens a DTLS connection to the Validator. They authenticate each other with certificates, and the Edge's serial and chassis number must be on the authorised device list.
  3. The Validator tells the Edge where the Controllers and Manager are, and learns the Edge's public (post-NAT) address, which helps with NAT traversal. The Validator connection is then torn down; it is transient.
  4. The Edge builds permanent DTLS or TLS control connections to the Controllers and Manager.
  5. The Manager pushes the configuration. The Controllers send OMP routes, TLOCs and encryption keys.
  6. Edges build IPsec tunnels directly to each other's TLOCs and run BFD across each tunnel.

Control plane: OMP

The Overlay Management Protocol runs between Edges and Controllers only, never Edge to Edge. Controllers act like BGP route reflectors: they collect everything, apply policy and reflect the result.

OMP advertises three kinds of route:

OMP route type Contains
OMP routes (vRoutes) Prefixes learned from the site's service-side LAN (connected, static, OSPF, BGP, EIGRP)
TLOC routes Transport locators: how to reach an Edge on each transport
Service routes Services at a site, such as a firewall or IPS, for service chaining

A TLOC (Transport Location) is the tuple system IP + color + encapsulation. The color names the transport (mpls, biz-internet, public-internet, lte, private1 and so on). Colors are either private (tunnel to the private IP) or public (tunnel to the post-NAT IP).

Exam trap

If the Controllers go down, data-plane tunnels keep forwarding on the last known information. OMP graceful restart holds routes for a timer (12 hours by default) before Edges flush them. Losing the controllers stops changes, not traffic.

Data plane

  • IPsec tunnels between TLOCs, full mesh by default, or hub-and-spoke and partial mesh by centralised control policy.
  • BFD runs inside every tunnel to measure loss, latency and jitter and to detect failure.
  • Application-Aware Routing (AAR) uses those BFD measurements against SLA classes to choose, per application, which transport to send traffic on.
  • VPNs (VRFs) segment traffic. VPN 0 is the transport VPN (WAN side), VPN 512 is management (out of band), VPNs 1 to 511 and 513 to 65530 are service VPNs for user traffic.
Policy type Applied on Example
Centralised control policy Controller, affects OMP Build hub-and-spoke topology
Centralised data policy Pushed to Edges Send guest traffic directly out the local internet
Application-aware routing Pushed to Edges Voice uses MPLS unless loss exceeds 1%
Localised policy Edge config (Manager) QoS, ACLs, route policy on one device

Benefits and limitations

Benefits Limitations
Transport independence: MPLS, broadband, LTE/5G all treated the same Controller infrastructure to deploy and keep available (cloud-hosted or on-prem)
Centralised management and policy from one GUI and API Encryption overhead: IPsec reduces usable MTU and adds CPU load
Application-aware path selection with SLA monitoring Licensing cost and subscription model
Zero-touch provisioning at branches Learning curve: new constructs (OMP, TLOC, color, policies)
Built-in segmentation and encryption Internet transports have no end-to-end SLA; AAR can only choose the best of what's available
Direct internet and cloud access (Cloud OnRamp, SASE integration) Troubleshooting moves to overlay tools; underlay issues can be hidden

What you see on a cEdge

You won't configure SD-WAN on ENCOR, but recognising the output helps with "interpret" questions.

show sdwan control connections      ! DTLS/TLS sessions to Manager, Controllers, Validator
show sdwan omp peers                ! OMP sessions to Controllers
show sdwan omp routes               ! prefixes learned via OMP
show sdwan omp tlocs                ! known TLOCs
show sdwan bfd sessions             ! tunnel liveness per color pair
show sdwan app-route stats          ! loss/latency/jitter feeding AAR

Lab

Full SD-WAN labs need the controller images. Two free options:

  • Cisco DevNet Sandbox: the always-on Catalyst SD-WAN sandbox gives you read access to a Manager and its REST API. Log in, find the device list, open a WAN Edge and check its control connections, OMP routes and BFD sessions in the GUI. This also prepares you for 6.4.
  • CML with the SD-WAN images (Personal licence with reference platforms) if you want to build one.

Quick check

Which component must every WAN Edge reach first, and why is that connection short-lived?

The SD-WAN Validator (vBond). It authenticates the Edge and tells it where the Controllers and Manager are. Once the Edge has permanent control connections to them, it no longer needs the Validator.

What three things make up a TLOC?

System IP, color and encapsulation (IPsec or GRE).

References