1.2 Explain the working principles of the Cisco Catalyst SD-WAN solution

What to learn

Catalyst SD-WAN is an overlay architecture. It lets WAN Edge routers build secure tunnels across transports such as MPLS, broadband, DIA, LTE, or private links. Central controllers handle onboarding, control-plane exchange, management, and policy.

Do not reduce SD-WAN to “uses the Internet.” The useful part is centralized policy plus transport-independent forwarding.

The planes

• Management plane: Cisco Catalyst SD-WAN Manager. It handles templates, monitoring, software, certificates, and operational visibility.
• Orchestration plane: Cisco Catalyst SD-WAN Validator. It helps devices authenticate and discover control connections.
• Control plane: Cisco Catalyst SD-WAN Controllers. They exchange routes, TLOCs, policy, and service information using OMP.
• Data plane: WAN Edge routers. They forward user traffic through encrypted tunnels and measure path quality with BFD.

Branch WAN Edge                         Controllers (cloud/on-prem)
+------------------+                  +---------------------------+
| Service VPN      |                  | Manager: templates/monitor|
| (user traffic)   |                  | Validator: onboarding     |
|        |         |   control (OMP)  | Controller: routes/policy|
| Transport VPN    |<---------------->|                           |
| MPLS + Internet  |   data tunnels   +---------------------------+
+------------------+                  BFD measures tunnel health

The terms that matter

A TLOC is a transport locator. Think of it as the information needed to reach a WAN Edge over a specific transport: system IP, color, and encapsulation. OMP carries routes and TLOCs. BFD measures whether tunnels are alive and how they perform.

A VPN in SD-WAN is a segmentation container. VPN 0 is the transport side. Service VPNs carry user or application networks.

Recognition commands

show sdwan control connections
show sdwan omp peers
show sdwan omp routes
show sdwan bfd sessions
show sdwan app-route stats
show sdwan tunnel statistics

Lab: explain the overlay

Draw two branches. Give each branch two transports: MPLS and Internet. Put one subnet behind each branch. Now answer these questions before typing commands.

• Which interface belongs to the transport VPN?
• Which routes are local service-side routes?
• Which controller distributes reachability?
• Which tunnels carry data traffic?
• What changes when the Internet circuit has high loss but MPLS is clean?

Then verify using control, route, and tunnel commands. The goal is to connect the show output to the architecture.

What the exam is likely to test

Expect “which plane does this?” questions, “what breaks if this controller is unreachable?” questions, and “why is SD-WAN useful or limited here?” questions. Keep the planes separate and most answers become obvious.