Cisco CCNP Enterprise (ENCOR 350-401) · lesson 11 of 12 · 30 min
What is SD-WAN?
SD-WAN (Software-Defined Wide Area Network) separates the WAN control plane from the data plane, allowing centralized management of WAN connectivity across multiple transport links (MPLS, internet, LTE). Instead of configuring each router individually, you define policies centrally and push them to all devices. Traditional WAN is like each branch office calling their own travel agent to book flights — every office makes independent decisions. SD-WAN is like a corporate travel desk that sets policy for everyone: “always use the cheapest flight for email, always use direct flights for video calls.” The policy is centralized; the execution is distributed.
Cisco SD-WAN Components (Viptela Architecture)
Control plane separation In traditional routing, every router runs its own control plane (OSPF, BGP). In SD-WAN, vSmart is the centralized control plane — it runs OMP (Overlay Management Protocol) and distributes routes and policies to all vEdge routers. vEdges only need to maintain a session with vSmart, not with every other vEdge.
OMP: Overlay Management Protocol
OMP is the SD-WAN control plane protocol — it runs between vEdge routers and vSmart controllers. It carries routes, policies, and crypto keys.
SD-WAN Transport and Tunnels
SD-WAN Policies
Flashcard Drill
vManage SD-WAN management plane — centralized dashboard for configuration, monitoring, and troubleshooting. vSmart SD-WAN control plane — distributes routes and policies to vEdge routers via OMP. vBond SD-WAN orchestration plane — authenticates devices and helps them discover vSmart and vManage. vEdge/cEdge SD-WAN data plane device — the physical or virtual router at each site. OMP Overlay Management Protocol — SD-WAN control plane protocol between vEdge and vSmart. Carries routes, TLOCs, and policies. TLOC Transport Locator — identifies a vEdge’s WAN attachment point. Combination of IP address, color, and encapsulation type. Application-aware routing Measures real-time latency/jitter/loss per tunnel and routes applications to the best-performing transport. Transport color Label for a WAN transport type (mpls, internet, lte) — used in policy to prefer certain transports for certain applications.
Knowledge Check — 10 Questions
SD-WAN Architecture
Which SD-WAN component is the centralized control plane that distributes routes to vEdges?
- vManage
- vBond
- vSmart
- vEdge
Answer: vSmart
vSmart is the centralized control plane — it runs OMP and distributes routes, TLOCs, and policies to all vEdge routers.
What is the purpose of vBond?
- Manage configuration
- Distribute routing policies
- Authenticate devices and help them discover vSmart/vManage
- Forward data plane traffic
Answer: Authenticate devices and help them discover vSmart/vManage
vBond is the orchestration plane — it authenticates new devices and provides them with the addresses of vSmart and vManage.
What protocol does SD-WAN use between vEdge routers and vSmart?
- BGP
- OSPF
- OMP
- EIGRP
Answer: OMP
OMP (Overlay Management Protocol) is the SD-WAN control plane protocol — it runs between vEdge routers and vSmart controllers.
A TLOC identifies a vEdge’s WAN attachment point using IP address, color, and _____.
Answer: encapsulation
A TLOC (Transport Locator) is a combination of IP address, transport color (mpls, internet, lte), and encapsulation type (IPsec or GRE).
What is application-aware routing in SD-WAN?
- Routing based on application layer inspection
- Selecting WAN transport based on real-time SLA measurements (latency, jitter, loss)
- Applying QoS to application traffic
- Blocking specific applications
Answer: Selecting WAN transport based on real-time SLA measurements (latency, jitter, loss)
Application-aware routing measures real-time performance (latency, jitter, loss) on each tunnel and routes applications to the transport that meets their SLA requirements.
Which SD-WAN policy type is applied on vSmart and affects routing across the overlay?
- Localized policy
- Centralized policy
- Interface policy
- QoS policy
Answer: Centralized policy
Centralized policies are applied on vSmart and affect routing decisions across the entire SD-WAN overlay (control policy and data policy).
In SD-WAN, vEdge routers need to maintain OMP sessions with every other vEdge router.
- True
- False
Answer: False
vEdge routers only maintain OMP sessions with vSmart controllers. vSmart distributes route information to all vEdges — no direct vEdge-to-vEdge control plane sessions needed.
What is Direct Internet Access (DIA) in SD-WAN?
- A dedicated internet circuit for management traffic
- Branch traffic going directly to the internet without hairpinning through HQ
- Internet access through the MPLS provider
- A backup internet link
Answer: Branch traffic going directly to the internet without hairpinning through HQ
DIA allows branch offices to send internet-bound traffic directly to the internet from the branch — reducing latency and WAN bandwidth usage.
What type of tunnels does SD-WAN use for the data plane between vEdges?
- GRE only
- MPLS LSPs
- IPsec tunnels
- VXLAN
Answer: IPsec tunnels
SD-WAN builds IPsec tunnels between vEdge routers for the data plane — these are built automatically based on TLOC information distributed by vSmart.
Which SD-WAN component is the physical or virtual router at each branch site?
- vManage
- vSmart
- vBond
- vEdge/cEdge
Answer: vEdge/cEdge
vEdge (Viptela hardware) and cEdge (Cisco IOS XE hardware) are the data plane devices deployed at each site.
Previous lesson: Network security: AAA (RADIUS/TACACS+), 802.1X, MACsec, CoPP, control plane protection
Back to Cisco CCNP Enterprise (ENCOR 350-401)
Next lesson: Network automation: Python, REST APIs, NETCONF/YANG, RESTCONF, Ansible, Terraform, DNA Center APIs