SD-WAN from zero: why the classic WAN is being replaced and how the new one works

What you will learn in this module. This is the free starter module of the Cisco Catalyst SD-WAN track. By the end of nine short chapters you will be able to explain, in plain words, what a classic WAN is, why companies are replacing it, what an SD-WAN does differently, which boxes make up a Catalyst SD-WAN network and what each one is responsible for, how a new branch comes online by itself, and which words (TLOC, colour, VPN, OMP, BFD, template, policy) you will hear again and again. You will also see what the job market looks like and how the rest of the track is laid out.

Prerequisites. Almost none. You should know what an IP address is, what a router does (it forwards packets between networks) and roughly what a branch office is. If you have heard of MPLS or VPN, good; if not, we build both from nothing. You do not need Cisco certification knowledge, and you do not need to type any command in this module.

Start with an analogy: a courier company

Imagine a courier company with offices in 200 cities. In the old way every city office has a thick printed rule book. Parcels from Pune to Nashik first travel to the head office in Nagpur and only then come back, because "all routes go through head office". The company rents one dedicated truck per route, which is reliable but expensive, and a new route takes a month to arrange. When the rules change, someone must post a new rule book to 200 offices and hope all of them update it.

In the new way there is a central control room with a screen. The control room knows every office, writes the rules once and sends them out automatically. Offices may use any carrier: the dedicated truck, a cheap public bus, a train. Every few seconds each office measures how fast and how safe each carrier is today, and sends urgent parcels by the best one at that moment. A new office needs only a phone call: it is switched on, finds the control room, and downloads its rules.

That is the whole idea of SD-WAN: Software-Defined Wide Area Network. A WAN is the network that links offices that are far apart. "Software-defined" means the intelligence sits in central software, not in a hand-typed rule book on every router.

Why this matters to you

Almost every company with more than a few offices has a WAN, and almost every one of them is either already moving to SD-WAN or is planning to. Retailers with hundreds of stores, banks with thousands of branches and ATMs, hospital chains, schools and IT services companies all need the same thing: reliable, secure links between many small sites and a few big ones, at a cost they can afford. Cisco Catalyst SD-WAN (the product formerly called Viptela) is one of the most deployed solutions, and the skills transfer to other vendors because the ideas are the same.

Words you must be comfortable with

WAN

Wide Area Network: links between sites that are far apart (cities, countries).

Branch

A small site such as a store, bank branch or clinic with a router and some users.

Data centre (DC)

The big site where servers and applications live.

Transport

The service that carries your packets between sites: MPLS, broadband, 4G/5G.

Overlay

A virtual network built on top of the real one, made of tunnels. SD-WAN lives here.

To understand why SD-WAN was invented, you first need a clear picture of the WAN it replaces. This chapter builds that picture from the ground up, with no assumptions beyond "a router forwards packets".

A branch, a data centre and the gap between them

A company has a head office or data centre (DC) where its applications run: billing, ERP, email, databases. It also has dozens or thousands of branches: shops, bank branches, factories, clinics. Every user in a branch needs to reach the applications in the DC, and often needs to reach other branches too. The branches are in different cities, so the company cannot lay its own cable. It rents the connection from a service provider (an ISP or telecom carrier). That rented network between sites is the WAN.

What is MPLS, in plain words

MPLS (Multiprotocol Label Switching) is a private service sold by carriers. Think of it as a private motorway inside the carrier's own road network. Your branch router connects to the carrier's edge router; the carrier carries your traffic across its network separately from the public internet and from other customers, guarantees a certain bandwidth, and can honour traffic priority (QoS) markings. Because it is private and managed, MPLS is predictable and has a service-level agreement (SLA) with a promised availability and latency.

What you get for the money: reliability, a managed service and the carrier's support. What you pay for: a high price per megabit, a long installation time, and a contract that is hard to change.

Hub-and-spoke through the data centre

In most classic WANs the topology is hub-and-spoke. The DC is the hub; every branch (a spoke) has one link to the carrier cloud. Branch-to-branch traffic often has to go to the hub first, because the routing is built around the DC. Internet traffic is also usually sent to the DC and out through the central firewall: this is called backhauling, and it exists because the company wants one controlled, secured place where internet access happens.

The branch router and its configuration

Each branch has a router that connects the local LAN to the MPLS service. It runs a routing protocol (usually BGP with the carrier, and OSPF or EIGRP inside the site) and holds access lists, QoS and sometimes a VPN. Every one of those settings is typed into that router's own command line, or pushed by a script or a management tool. The network is therefore a collection of hundreds of separate devices, each with its own copy of the configuration. That is what people mean by box-by-box or per-router CLI management.

! A tiny part of a classic branch router (IOS style)
interface GigabitEthernet0/0
 description MPLS-to-carrier
 ip address 203.0.113.2 255.255.255.252
!
router bgp 65010
 neighbor 203.0.113.1 remote-as 64512
 network 10.20.30.0 mask 255.255.255.0
!
ip access-list extended BRANCH-IN
 permit tcp any 10.20.30.0 0.0.0.255 eq 443
 deny ip any any log

Now multiply those few lines by 300 routers, by different hardware models and by years of small differences, and you can see why the network team spends so much time keeping everything consistent.

What classic WAN does well

Be fair to the old design. It is simple to understand, the carrier takes responsibility for the path, and MPLS gives stable latency and QoS. Many regulated companies still keep MPLS for critical systems. SD-WAN does not say MPLS is bad; it says MPLS should no longer be the only option.

The classic WAN worked well when almost every application lived in the company's own data centre. Three things changed over the last fifteen years: applications moved to the cloud, branches multiplied, and cheap fast internet became available almost everywhere. The old design strained under all three. This chapter lists the pain points, one by one, because each of them is a feature that SD-WAN was built to fix.

Pain 1: cost per megabit

MPLS is priced for guaranteed quality, not for volume. A commodity broadband line often gives ten times the bandwidth for a fraction of the price. A branch that needs more bandwidth has two choices: pay a lot more for MPLS, or add a second, cheaper line. In the classic design the second choice was hard, because routers could not safely and automatically use two very different lines together.

Pain 2: lead time and agility

Ordering an MPLS circuit means a survey, a contract, carrier build work and a cut-over date. Four to twelve weeks is common. A company that opens a pop-up store for a festival season cannot wait that long. Broadband or 4G/5G can be live in days, but the classic router had no easy way to join the corporate network over such a link.

Pain 3: cloud and SaaS backhaul

When email, office tools, video meetings and CRM live in the cloud, sending branch traffic to the DC first adds distance and delay and loads the expensive MPLS link with traffic that does not need it. The fix, local internet breakout at each branch, was hard to do safely in the old model because security (firewalls, filtering) lived centrally.

Pain 4: path selection is blind to quality

A routing protocol such as OSPF or BGP chooses the next hop using a metric: hop count, bandwidth, an administrative preference. It does not know that this particular path today has 4% packet loss or 300 ms delay. If both lines are up, it keeps using the preferred one, even when a video call over it is unusable. Routers detect failure (link down) well but not degradation (brownout). Brownouts are the kind of fault users notice first and tools notice last.

Pain 5: operations are box-by-box

Every change is a series of commands typed into many devices. Small differences accumulate (configuration drift), a typo in one router becomes a ticket, and there is no single place to see the state of the whole network. New branches need an engineer to pre-stage the router, or ship it to a site with someone who knows the CLI.

Pain 6: weak, uneven security and visibility

Traffic across a carrier's MPLS cloud is usually not encrypted (it is private, not secret). Segmentation between departments, guests and payment systems is done with VRFs and access lists that differ from site to site. And the NOC sees only interface counters, not what applications experience.

Pain point	What the business feels	What SD-WAN will change (next chapters)
High cost per megabit	Cannot afford bandwidth at every site	Use cheap broadband beside or instead of MPLS
Long lead time	New sites wait weeks	Zero-touch provisioning over any link
Cloud backhaul	Slow SaaS, wasted WAN capacity	Direct internet access with central policy and security
Blind path choice	Poor video and voice quality	Application-aware routing based on measured loss, delay and jitter
Box-by-box operations	Slow, error-prone changes	Central templates and policies
Unencrypted, uneven security	Audit findings, risk	IPsec everywhere and consistent segmentation

The previous chapter listed six pains. SD-WAN answers them with a handful of simple ideas. Learn these ideas well; every later module in the track is a closer look at one of them.

An analogy: a ride-hailing app for your packets

Before ride-hailing apps, you phoned one taxi company, which sent whichever car it had. Now an app knows many drivers and many routes. It watches live traffic, picks the best car and route for this trip, and re-routes if a road jams. You do not care which company owns the car; you care that you arrive on time. SD-WAN does the same for application traffic: many carriers, many paths, one smart decision-maker, driven by what is happening now.

Idea 1: an overlay over any transport

Each branch router builds encrypted tunnels to the other sites. The tunnels ride on top of whatever lines exist: MPLS, broadband, a 4G/5G modem. Together the tunnels form the overlay. The lines underneath form the underlay. The underlay only has to deliver IP packets between the routers; it does not need to know anything about your company's networks or VPNs. That is why the transport becomes a replaceable commodity: you can change a carrier without touching the design.

Idea 2: central policy and a single point of management

Instead of typing rules into each router, the administrator writes them once in a central manager (a web screen and an API). Configuration templates describe what a branch router should look like; policies describe how traffic should behave. A central controller distributes routes and policy to every router. Change the rule in one place and every site follows.

Idea 3: zero-touch provisioning

A new branch router is registered in the system before it leaves the warehouse. At the branch, someone only plugs in power and an internet cable. The router calls home, proves who it is with a certificate, downloads its configuration and joins the overlay. No engineer travels. Chapter 6 walks through this in detail.

Idea 4: application-aware routing

Each router continuously measures every tunnel for loss (percentage of packets lost), latency (delay) and jitter (variation in delay). The administrator defines what each application needs, for example voice needs loss under 1%, latency under 150 ms, jitter under 30 ms. The router sends voice over a path that meets this and moves it when the path stops meeting it, without waiting for a failure.

Idea 5: direct access to the cloud

With central security policy and encryption in place, a branch can send trusted internet traffic straight out of its local breakout (Direct Internet Access, DIA) while corporate traffic continues across the overlay. The system can even test the quality of a SaaS application over each possible exit and pick the best one (Cloud OnRamp). Cloud workloads in public cloud join the overlay like another site.

Idea 6: security and segmentation built in

Tunnels are encrypted with IPsec. Inside the overlay, traffic is separated into segments (VPNs), for example corporate, guest Wi-Fi, payment terminals. A device in the guest segment has no route to the corporate segment at all. Optional security features (firewall, intrusion prevention, DNS filtering) can run on the same branch router.

Pain	SD-WAN idea that answers it
Cost per megabit	Overlay over any transport (use cheap broadband)
Lead time	Zero-touch provisioning
Cloud backhaul	Direct Internet Access and Cloud OnRamp
Blind path choice	Application-aware routing
Box-by-box work	Central manager, templates, policy
Weak security	IPsec everywhere and VPN segmentation

Catalyst SD-WAN splits the work of running a WAN into four planes. A plane is just a group of jobs. Each plane is carried out by one kind of component. If you remember the four planes and their components, you can already understand 80 percent of any SD-WAN diagram or conversation.

An analogy: an airport

Think of an airline's operation. The reception and security desk checks who you are and tells you where to go (orchestration). The airline head office plans the schedule, hires crews and keeps the records (management). The air traffic control tower tells every aircraft which route to take (control). The aircraft carry the passengers (data). Notice that air traffic control never carries a single passenger, and the head office never flies a plane. Each part has one clear job. The same is true in SD-WAN.

The four planes and the four components

Plane	Component (current name)	Older name you will still hear	Job in one sentence
Orchestration	SD-WAN Validator	vBond	The front door: authenticates every device first and tells it where the other controllers are.
Management	SD-WAN Manager	vManage	The single screen and API: configuration, templates, policies, monitoring, software upgrades.
Control	SD-WAN Controller	vSmart	The brain of the overlay: learns routes from every site and distributes them with the policy.
Data	WAN edge routers	cEdge, vEdge	The routers at branches and data centres that build tunnels and forward user traffic.

Together, the first three (Validator, Manager, Controller) are called the control components. You will often hear "the controllers" used loosely for all three. The product was renamed from Viptela to Cisco SD-WAN and then to Catalyst SD-WAN, which is why old names (vBond, vSmart, vManage) remain in command output, APIs and many interviews. You must know both sets.

What each component does, in plain words

SD-WAN Validator. When a router starts, it does not yet know any controller. It knows one address (or name): the Validator's. The Validator checks that the device is on the list of devices the company has authorised, tells it the addresses of the Manager and the Controllers, and helps it learn its own public address if it is behind a NAT device. After that the router ends its conversation with the Validator. This component must be reachable from every branch, so it sits somewhere with a public address.

SD-WAN Manager. This is what an administrator logs into. It stores the list of authorised devices, the device templates and configuration groups, the policies, the software images and the monitoring data (statistics). It pushes configuration to the routers. It has a web GUI and a REST API for automation.

SD-WAN Controller. It receives routing information from every WAN edge, applies the central control policy and sends the result to the other edges. It also distributes the encryption keys of the tunnels and the data policies. Think of it as a route reflector with a policy engine. It does not forward user traffic.

WAN edge. A router, physical or virtual, at a branch, data centre or in a public cloud. It connects the local LAN to one or more transports, builds the encrypted tunnels to other edges, measures the tunnels and forwards traffic. Cisco WAN edges today are mostly Catalyst 8000 Series and ISR routers running IOS XE in controller mode; the older Viptela vEdge routers are still found in networks.

How they talk

Every edge keeps secure control connections to the Controller and the Manager (these use DTLS or TLS and carry configuration and routing information). User data is different: it flows directly from edge to edge in IPsec tunnels and never passes through a controller. This separation is why the controllers can sit in a cloud or a remote data centre without becoming a bottleneck, and why branches keep forwarding for a while even if the controllers become unreachable.

The best way to see how the four components cooperate is to follow one new branch router from the box to carrying traffic. We will use a retail store in Nagpur as the example. Do not worry about the technical words; each is explained at its first use and collected in the next chapter.

Before the box ships: the paperwork in the system

The network team prepares four things in advance:

1. The device is known. The router's serial number is on the company's list of authorised WAN edges. The list normally comes from the company's Cisco Smart Account (the Plug and Play, or PnP, portal) and is synchronised into the SD-WAN Manager. A router that is not on the list will be refused.
2. The router is told where to call. In the PnP portal the device is linked to the company's Validator, so a brand-new router can find it.
3. The router has a configuration waiting. In the Manager the router is attached to a template (or configuration group): a prepared description of what a branch router should look like, with a few fill-in values such as the store's IP address and name.
4. The device is assigned to the right customer. Every device carries the company's organization name, a text label that all components must share. It is like the company's name on every ID badge.

On the shop floor: plug in power and a cable

A store employee unpacks the router, connects one port to the broadband modem, connects the LAN port to the store switch, and powers it on. That is the entire job at the site.

What the router does by itself

Step 1. The router asks the broadband line for an IP address, using DHCP, and learns a DNS server. Without any address it cannot talk to anyone. Branches with no DHCP service use a small bootstrap file prepared in advance with a fixed address.

Step 2. The router must learn where the Validator is. Cisco routers can ask the cloud PnP service, which replies with the Validator address for this company; or the router uses a bootstrap configuration prepared earlier.

Step 3. The router opens a secure connection to the Validator and presents its certificate, a digital passport signed by a trusted authority, together with its serial number. The Validator checks that the certificate is genuine, that the organization name matches and that the serial number is on the authorised list. Both sides authenticate each other, so the router also verifies the Validator. If the router is behind a NAT device, the Validator also tells it which public address and port it appears as. Then the Validator hands over the addresses of the Manager and the Controllers.

Step 4. The router connects to the Manager, which finds the template attached to this device, fills in the values and sends the finished configuration. The router applies it and may reboot or restart some processes if the software needs to be upgraded first.

Step 5. The router connects to the Controller and starts OMP (Overlay Management Protocol). It sends the networks it owns, for example the store LAN 10.40.10.0/24 and the way to reach them (its transport locators), and receives the networks of every other site together with their locators and encryption keys.

Steps 6 and 7. Knowing where every other router is, it builds IPsec tunnels and runs BFD inside each one to measure it. When tunnels are up, the central policies apply and user traffic flows.

If something goes wrong

Because the connection to the Validator happens first, most onboarding problems appear there or just after: the router has no address (cable or DHCP), cannot resolve the Validator's name (DNS), is blocked by a firewall, has an incorrect clock (certificates are time-sensitive), has a different organization name, or is missing from the authorised list. Later modules show how to read the error codes, but the pattern to remember now is: each step must succeed before the next one starts, so the first step that fails is where you look.

Every field has its own language. SD-WAN has about a dozen words that appear in almost every sentence of a design review. This chapter explains them in simple terms with small examples. You do not need to memorise them in one sitting: you will meet each word again with commands in later modules, and the glossary in the last chapter repeats them for revision.

Identity words: who is this device?

Organization name

A text label shared by every device of one company (for example BHARAT-RETAIL). It must be spelled exactly the same everywhere, including capital letters. It appears in the certificates, so a mismatch means a device is rejected.

System IP

A permanent, unique identifier for each device, written like an IPv4 address (for example 10.255.0.11). It behaves like a router ID. It does not have to be reachable on the network; it just names the device in the overlay.

Site ID

A number for a physical location. All routers in one branch share the same site ID. Different sites must have different site IDs. Routers with the same site ID do not build tunnels to each other.

Chassis number and serial number

The hardware identity of a WAN edge. The Manager keeps a list of the authorised ones. A device not on the list cannot join.

Certificate

A digital passport issued by a trusted authority. Devices show it to each other during connection set-up to prove who they are.

Transport words: how does this device reach the world?

Transport / WAN interface

The router port that connects to a carrier line (MPLS, broadband, LTE). In SD-WAN these ports belong to the transport VPN, called VPN 0.

TLOC (Transport Locator)

One attachment of a router to a transport. It is identified by three items: the router's system IP, a colour, and the encapsulation (IPsec). A router with MPLS and broadband has two TLOCs. Think of a TLOC as "a door of this router onto the outside world".

Colour

A label for the type of transport on a TLOC, such as mpls, biz-internet, public-internet, lte. Colours are either private (like mpls) or public (like biz-internet). The colour tells routers how to build tunnels and lets policies refer to "the MPLS path" or "the internet path".

Tunnel

An encrypted connection (IPsec) between two TLOCs. Tunnels form the overlay.

Segmentation words: how is traffic separated?

VPN (segment)

In Cisco SD-WAN, a VPN is a separate routing domain, like a private virtual network inside the router. On IOS XE routers each VPN is a VRF. Traffic in one VPN cannot reach another unless a policy allows it. Special numbers: VPN 0 carries the transport side and control connections; VPN 512 is for out-of-band management; the others (for example VPN 10 corporate, VPN 20 guest) are service VPNs for users.

Protocol words: how do devices talk?

DTLS / TLS

The secure protocols used for the control connections between devices and the controllers. DTLS runs over UDP (the default); TLS runs over TCP.

OMP (Overlay Management Protocol)

The routing protocol of the overlay. Edges tell the Controller about their networks, TLOCs and services; the Controller redistributes them, applying policy. It is similar to BGP with a route reflector, but designed for SD-WAN.

IPsec

The encryption standard that protects the tunnels between edges.

BFD (Bidirectional Forwarding Detection)

A very light "are you there?" exchange that runs inside every tunnel. It tells an edge whether a tunnel is alive and measures loss, latency and jitter. These measurements drive application-aware routing.

Management words: how is it controlled?

Template

A reusable description of device configuration stored in the Manager. A device template is built from feature templates (pieces such as an interface or a routing section). Newer designs use configuration groups, which serve the same goal with a simpler workflow.

Policy

A rule that controls the overlay. Control policy shapes routing (which sites can talk to which, hub-and-spoke or full mesh). Data policy acts on user traffic (steer, mark, drop). Application-aware routing policy chooses paths by measured quality. A centralized policy lives on the Controller; a localized policy applies on the device.

WAN edge list

The Manager's list of authorised routers, built from the serial file or the Smart Account.

Word	One-line meaning	Analogy
System IP	Device name in the overlay	Employee ID
Site ID	Location number	Office code
TLOC	Router + transport attachment	A door of the building
Colour	Type of transport	Road type: highway or lane
VPN	Separate routing domain	A separate floor with its own lift
OMP	Overlay routing protocol	The shared address book
BFD	Tunnel health check	A heartbeat monitor
Template	Reusable configuration	A form with blanks
Policy	Rule for routing or traffic	Traffic rules for the city

You now know what SD-WAN is. This chapter answers the practical question: why should I invest my time in it, and what will employers expect? It speaks in general terms because job markets, pay and titles change by city and year; treat it as a guide to the kinds of work and the questions you will meet, not as a promise.

Where SD-WAN work exists

Organisations that need to connect many sites buy SD-WAN, and many of them do not want to run it alone. Work therefore appears in four kinds of employer:

• Enterprises with many branches: banks, insurers, retailers, manufacturers, hospital groups, logistics and education chains. They run the network with an in-house team or share it with a partner.
• Managed-service providers and telecom carriers that sell "managed SD-WAN" to many customers. They hire large NOC and engineering teams.
• System integrators and consulting firms that design and roll out the network for a customer project.
• Global capability centres and IT-service companies that support overseas customers' networks from India, often around the clock.

Typical roles and what they do

Role	Day-to-day work	What you should be able to do
NOC / L1 engineer	Watches alarms and dashboards, raises tickets, does first checks	Read the Manager dashboard; know control, OMP and BFD states; basic CLI show commands
L2 / support engineer	Fixes branch outages and policy faults, coordinates with carriers	Troubleshoot control connections, tunnels and routing; read error codes; use templates safely
Implementation / deployment engineer	Onboards sites, builds templates, migrates from the old WAN	Edge bootstrap, TLOCs, templates or configuration groups, cut-over planning
Network architect / L3	Designs overlays, policies, security and high availability	Centralized policy, application-aware routing, scale, controller design, cloud integration
Pre-sales / solutions engineer	Explains and sizes SD-WAN for customers	Business case, architecture, licensing and comparisons with other vendors
Network automation engineer	Uses the Manager API and scripts for repeatable operations	REST API, Python, templates as code

What interviewers actually ask

Interview questions follow the same ladder as this track. Freshers are asked for definitions: what is SD-WAN, what are the four components, what is a TLOC, what is OMP. Mid-level candidates get "what would you check" questions: a branch shows no tunnels, a site cannot reach another, voice quality is bad. Senior candidates discuss design: how many Controllers, where to place Validators, how to migrate 500 sites with minimal outage, how to do local internet breakout securely. Each module in this track includes interview questions at all three levels so you can rehearse.

Certifications and where this track fits

The exam this track prepares you for is Cisco 300-415 ENSDWI, Implementing Cisco SD-WAN Solutions, version 1.2. It is one of the concentration exams for the CCNP Enterprise certification: you pass the core exam (350-401 ENCOR) and one concentration of your choice. SD-WAN is also part of the CCIE Enterprise Infrastructure lab. The official blueprint groups the topics into architecture, controller deployment, router deployment, policies, security and QoS, and management and operations; the track follows those groupings, which is why modules are named after them.

Because the concepts (overlay, central controller, application-aware routing, zero-touch) are shared by Fortinet, Palo Alto, Versa, HPE Aruba and others, the learning also helps you with other vendors' products. The vocabulary changes; the architecture does not.

How to talk about your skills

• Use the product names and the older names: "SD-WAN Manager, formerly vManage."
• Describe what you checked and why, in order: control connections, OMP, BFD, then policy.
• Be honest about hands-on level. Employers prefer "I built this in a lab and fixed these three faults" to a long list of buzzwords.

This last chapter does two jobs. First it shows how the rest of the Cisco Catalyst SD-WAN track is laid out, so you know where each idea you met here gets its full treatment. Then it gives you a revision sheet: a can-do checklist, a mini glossary and the facts that examiners and interviewers repeat most.

The map of the track

The track follows the official blueprint of exam 300-415 ENSDWI v1.2. Each blueprint domain has one or more modules. Later modules include hands-on labs in the simulator, where you will type real commands against a working SD-WAN fabric; this starter module does not.

Blueprint domain	Module	What you will master
Start here	SD-WAN from zero (this module)	Why, what, the four planes, the vocabulary
Architecture	Planes, components and the overlay	Components in depth, TLOCs, colours, OMP, BFD, VPNs, reading a live fabric
Controller deployment	Manager, Controller and Validator, certificates and control connections	Deployment models, bootstrap, certificates, onboarding order, high availability, backup, control-connection troubleshooting
Router deployment	WAN edge onboarding; templates and configuration groups	Bootstrap, tunnel interfaces, device and feature templates, CLI templates
Policies	Centralized control policy; data policy and application-aware routing; DIA and Cloud OnRamp	Topology control, VPN membership, service chaining, SLA classes, path steering, local breakout
Security and QoS	SD-WAN security; QoS	IPsec keys, firewall, IPS, DNS security, classification, queuing, shaping
Management and operations	Operations; troubleshooting	Monitoring, upgrades, alarms, control, data-plane and policy fault finding

Can-do checklist

You have finished this module when you can honestly tick every line.

• I can describe a classic MPLS hub-and-spoke WAN and list four or more of its problems.
• I can explain what SD-WAN changes: overlay on any transport, central policy, zero-touch, application-aware routing, cloud access and segmentation.
• I can name the four planes and the component for each, using both new and old names.
• I can say which components forward user traffic (only WAN edges) and which do not.
• I can narrate how a new branch router joins the network, in order.
• I can define TLOC, colour, system IP, site ID, VPN, OMP, BFD, template and policy.
• I can describe the main roles, the exam, and my plan for the next module.

Mini glossary

Overlay / underlay

Overlay: the tunnels and policy the business controls. Underlay: the carrier lines beneath them.

Validator (vBond)

Authenticates devices and introduces them to the other controllers.

Manager (vManage)

Configuration, templates, policy, monitoring and the authorised device list.

Controller (vSmart)

Reflects OMP routes and applies control policy. Never forwards user data.

WAN edge (cEdge, vEdge)

Router that builds tunnels and forwards traffic.

TLOC

System IP + colour + encapsulation. A transport attachment.

OMP

Overlay routing protocol between edges and Controllers.

BFD

Tunnel liveness and quality measurement.

ZTP / PnP

Zero-touch provisioning with the Plug and Play service.

DIA

Direct Internet Access: local internet breakout at the branch.

Most-tested facts