Architecture · Topic 3 of 5
Cisco Catalyst SD-WAN
Understand Cisco Catalyst SD-WAN: control and data planes, the Manager, Controller and Validator roles, OMP, TLOCs, plus benefits and limits.
- 5 min
- Includes a diagram
- SD-WAN Manager is the management plane. SD-WAN Controller is the control plane. SD-WAN Validator handles authentication and discovery.
- The older names are vManage, vSmart and vBond.
- WAN edge routers are the data plane and forward user traffic.
What it is
Cisco Catalyst SD-WAN is a software defined WAN that separates central control from the devices that forward traffic.
Branch sites and data centres connect over any mix of transports, such as MPLS, broadband internet or cellular. Cisco SD-WAN builds a secure overlay across them and manages it from a central point. The solution was formerly sold under the name Viptela SD-WAN, so older documents use older component names.
How it works
The design has a management plane, a control plane and a data plane.
The control plane elements
Three controller roles do the central work. The names changed in recent releases, so both forms appear in study material.
| Current name | Older name | Role |
|---|---|---|
| SD-WAN Manager | vManage | Management plane: GUI, templates, monitoring and APIs |
| SD-WAN Controller | vSmart | Control plane: builds the overlay routing and applies central policy |
| SD-WAN Validator | vBond | Authenticates devices and helps them find the other controllers |
Each WAN edge device first contacts the Validator. The Validator checks its identity and tells it where the Manager and Controller are. The edge then builds secure control connections to them.
The routing protocol of the overlay is the Overlay Management Protocol (OMP). Edge devices send their routes, their transport locators and their policy information to the Controller by OMP. The Controller then passes the right information on to the other edges.
The data plane elements
The WAN edge routers form the data plane. They forward user traffic and can run IOS XE software in SD-WAN mode.
Edges build IPsec tunnels directly to each other, so branch to branch traffic does not need to pass through a hub. A tunnel end is described by a TLOC (transport locator), which is made of the system IP address, the colour and the encapsulation. The colour is a label for the type of transport, such as mpls or biz-internet.
Bidirectional Forwarding Detection (BFD) runs inside the tunnels. It measures loss, latency and jitter on each path. Application aware routing uses those measurements to pick a path that meets an application's needs.
Segmentation and policy
SD-WAN uses VPNs, which work like VRFs, to keep traffic apart. VPN 0 carries the transport side, and VPN 512 is used for management on the device. Service side VPNs carry the user networks.
Policy comes in two broad kinds.
- Control policy changes the routing information that the Controller sends, for example to steer traffic through a hub.
- Data policy acts on the traffic itself, for example to send an application over a chosen transport.
Verifying on an edge
On an IOS XE SD-WAN edge, these commands check the overlay.
Edge# show sdwan control connections
Edge# show sdwan bfd sessions
Edge# show sdwan omp routesThe first confirms the connections to the controllers. The second shows the data plane tunnels and their state. The third lists routes learned through OMP.
Benefits and limitations
| Benefits | Limitations |
|---|---|
| Works over any transport, so you can add cheap internet links | Needs licences and controllers, which adds cost |
| Central policy and templates, so branches are quick to deploy | New skills and a new operating model for the team |
| Application aware path choice using live measurements | Existing tunnels depend on the controllers for policy changes and new sites |
| Encrypted overlay with segmentation | Troubleshooting spans overlay and underlay |
| Cloud access options for SaaS and IaaS | Not every feature is available on every device model |
If the controllers become unreachable, edges that already have their policy and routes can keep forwarding for a period. They cannot learn changes until the connection returns.
What to remember for the exam
Eight facts cover most questions on this topic.
- SD-WAN Manager is the management plane. SD-WAN Controller is the control plane. SD-WAN Validator handles authentication and discovery.
- The older names are vManage, vSmart and vBond.
- WAN edge routers are the data plane and forward user traffic.
- OMP is the routing protocol between edges and the Controller.
- A TLOC identifies a tunnel end by system IP, colour and encapsulation.
- Edges build IPsec tunnels to each other and run BFD inside them.
- VPN 0 is the transport VPN and VPN 512 is management.
show sdwan control connectionschecks controller connections.
Match the plane to the role. Manager is management, Controller is control, and edge routers are data.
Common mistakes
These four mistakes appear often.
Swapping vSmart and vBond. The Controller (vSmart) handles routes and policy. The Validator (vBond) handles authentication and discovery.
Saying user traffic flows through the Controller. The Controller only exchanges control information. User traffic goes between edges.
Treating OMP as an underlay protocol. OMP runs in the overlay between edges and the Controller.
Assuming SD-WAN replaces the underlay. The transports still exist and still need correct addressing and reachability.
Control connections and data tunnels are different things. A working data tunnel does not prove that the control connection is up.
Check yourself
Work through these three questions.
Which SD-WAN component is responsible for authenticating new edge devices?
The SD-WAN Validator, formerly vBond, authenticates devices and tells them where the other controllers are.
What does OMP carry between an edge and the Controller?
It carries routes, transport locators and policy information for the overlay.
Which command checks the state of the data plane tunnels on an IOS XE SD-WAN edge?
show sdwan bfd sessionsshows the tunnels and their state.
Topic 3 of 5 in Architecture
Test yourself on Architecture
The full Cisco CCNP 350-401 ENCOR question bank has 854 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.