1.2.b Benefits and limitations of Catalyst SD-WAN solution

What this objective means

SD-WAN is useful because it turns the WAN into a centrally managed overlay. It is limited because the overlay still rides on real circuits, real routing, real encryption overhead, and real operational skill.

Benefits

• Transport independence: MPLS, broadband, DIA, and LTE can all participate.
• Centralized policy: you can define intent once and push it consistently.
• Application-aware routing: traffic can prefer a path based on loss, latency, jitter, or policy.
• Segmentation: service VPNs keep routing domains separate across the WAN.
• Faster branch rollout: templates and zero-touch provisioning reduce repetitive configuration.
• Better visibility: tunnel, application, and path statistics are easier to collect centrally.

Limitations

• The underlay still matters. If every circuit is bad, the overlay cannot invent clean bandwidth.
• Controllers matter. Designs must account for reachability, redundancy, certificates, and failure behavior.
• Brownfield migration can be messy. Existing routing, firewalls, NAT, QoS, and provider constraints do not disappear.
• Encryption and tunnel overhead affect MTU and throughput.
• Centralized policy can create centralized mistakes. One bad template can break many sites.
• Operations teams must learn a new troubleshooting order: underlay first, then control plane, then overlay policy, then application behavior.

Troubleshooting order

Use this order when a branch complains that “SD-WAN is down.”

1. Is the transport interface up?
   show ip interface brief
   show ip route vrf 0

2. Are control connections up?
   show sdwan control connections
   show sdwan control connections-history

3. Is OMP exchanging routes?
   show sdwan omp peers
   show sdwan omp routes

4. Are data tunnels healthy?
   show sdwan bfd sessions
   show sdwan tunnel statistics

5. Is policy steering traffic as expected?
   show sdwan app-route stats

Lab: benefit versus limit

Build a paper lab with two branches and two transports. Assign voice to MPLS when loss is low, bulk data to Internet, and guest traffic to a separate VPN. Now create three failure cases: MPLS down, Internet high loss, and controller unreachable after the edge has already learned routes.

For each failure, write what should happen and which command proves it. This forces you to treat SD-WAN as a system, not a buzzword.

Exam trap

SD-WAN does not automatically mean cheaper, faster, or more secure. It gives you tools. The design still decides whether those tools produce a better network.