2.1 Cisco Catalyst SD-WAN: Control, Management, and Data Planes

Cisco Catalyst SD-WAN: Control, Management, and Data Planes

Traditional enterprise WANs relied on distributed routing where branch routers independently maintained BGP or OSPF peering, calculated forwarding tables, and enforced security policies configured box by box via CLI. As enterprise workloads migrated to multi-cloud and SaaS environments, this model produced operational rigidity, complex full-mesh configurations, and unpredictable transport performance.

Cisco Catalyst SD-WAN addresses these limitations by decoupling network operations into four discrete planes: orchestration, management, control, and data. This separation establishes an automated, encrypted overlay network spanning heterogeneous underlay transports.

Architectural Planes and Core Components

Catalyst SD-WAN assigns specialized responsibilities across dedicated physical or virtual appliances. In recent releases Cisco renamed the controllers: vBond is now the SD-WAN Validator, vSmart is the SD-WAN Controller, and vManage is SD-WAN Manager. Exam items and older documentation use both sets of names.

Device Identity, Trust, and Zero-Touch Provisioning (ZTP)

Mutual trust and onboarding rely on strict Public Key Infrastructure (PKI) validation, hardware root-of-trust anchors, and administrative identifiers:

• Hardware Root of Trust: Cisco IOS-XE cEdge routers embed an x.509 certificate inside a tamper-proof Cisco Secure Unique Device Identifier (SUDI) chip. Legacy vEdge devices use an onboard Trusted Platform Module (TPM).
• Authorized Whitelist: Administrators upload a signed WAN Edge Authorized Serial Numbers file to vManage, which distributes approved chassis IDs and serial numbers to vBond and vSmart.
• Administrative Parameters: Every node requires a matching Organization Name (case-sensitive string embedded in certificates), a unique 32-bit System IP (non-routable overlay identifier), and a Site ID identifying its physical location.

Step-by-Step Onboarding Walkthrough

1. Bootstrap: An unconfigured WAN Edge boots, acquires an IP address, gateway, and DNS via DHCP on its WAN interface, and resolves the vBond FQDN.
2. Transient Tunnel: The edge initiates a transient DTLS tunnel (UDP port 12346) to vBond.
3. Authentication & NAT Discovery: Edge and vBond perform mutual certificate validation. vBond verifies the edge serial against its whitelist and uses STUN to identify the edge's translated public IP and port.
4. Controller Distribution: vBond sends the IP addresses of authorized vSmart controllers and vManage to the edge, while notifying vSmart and vManage of the new device.
5. Control Connections: The edge terminates the transient vBond tunnel and establishes permanent DTLS/TLS control connections to vManage and vSmart. vManage pushes configuration templates, and vSmart establishes OMP peering.

Overlay Management Protocol (OMP) Route Distribution

OMP is an extensible routing protocol operating exclusively within secure DTLS/TLS tunnels between WAN Edges and vSmart controllers. WAN Edge routers never establish OMP peering with each other.

OMP distributes three routing update types:

1. OMP Routes (vRoutes): Prefixes learned from the local branch LAN (connected subnets, static routes, OSPF, or BGP) within customer Service VPNs (VPNs 1–511 and 513–65530). Attributes include TLOC, Preference, Origin, and Site ID.
2. TLOC Routes: Advertisements of physical transport attachment points connecting the router to the underlay.
3. Service Routes: Advertisements declaring specialized branch network services (such as firewalls or intrusion prevention appliances) available at a designated site.

Transport Location (TLOC) Attributes

A TLOC uniquely identifies an egress interface connecting a WAN Edge to the transport underlay. It is defined by an immutable 3-tuple:

• System IP: 32-bit logical loopback address of the originating edge router.
• Color: Administrative keyword identifying transport type (e.g., mpls, public-internet, biz-internet, lte). Categorized into private colors (direct underlay routing without NAT) and public colors (which trigger STUN NAT traversal).
• Encapsulation: Tunnel protocol, either ipsec (standard secure tunnel) or gre.

OMP carries critical TLOC metadata: private and public IP/port combinations, preference (prioritizes outbound paths), weight (active/active load-balancing), Site ID (loop prevention), and dynamic Security Parameter Index (SPI) keys.

Packet Forwarding Walkthrough

[Branch 1 Host] ---> [Edge 1] ========= IPsec Tunnel =========> [Edge 2] ---> [Branch 2 Host]
                       |                                          |
                     (OMP)                                      (OMP)
                       v                                          v
                   +--------------------------------------------------+
                   |                 vSmart Controller                |
                   |          (Reflects Routes, TLOCs, and SA Keys)   |
                   +--------------------------------------------------+

1. Ingress: A host in Service VPN 10 sends a packet destined for 192.168.20.50 at Site 2.
2. FIB Lookup: Edge 1 checks its local VPN 10 forwarding table. The matching OMP route points to next-hop TLOC (10.255.0.2, biz-internet, ipsec).
3. Tunnel Verification: Edge 1 references its crypto table for Edge 2's TLOC. Because vSmart previously distributed Edge 2's public IP, port, and symmetric encryption keys, an IPsec tunnel is already active.
4. Encapsulation: Edge 1 wraps the packet in an IPsec ESP header with an outer IP header addressed to Edge 2's underlay IP, inserting a VPN 10 label.
5. BFD Telemetry: BFD probes running continuously over the tunnel measure latency, jitter, and loss. If circuit thresholds breach SLA parameters, Application-Aware Routing (AAR) immediately shifts matching traffic to an alternate compliant TLOC.
6. Decapsulation: Edge 2 strips the IPsec header, identifies VPN 10 from the label, and routes the packet to the destination host.

Benefits and Limitations of Catalyst SD-WAN

Topic 1.2.b asks for both sides of the trade-off: