1.2.a SD-WAN control and data planes elements

What this objective means

You need to know which SD-WAN elements make decisions and which elements forward packets. Most wrong answers confuse management, control, and data plane functions.

Control-side elements

Catalyst SD-WAN Manager gives you templates, configuration, monitoring, image management, alarms, and troubleshooting views. It is important operationally, but it is not the normal data forwarding path.

Catalyst SD-WAN Validator helps WAN Edge devices authenticate and discover the control-plane topology. It is central to onboarding and NAT traversal.

Catalyst SD-WAN Controllers run the control plane. They use OMP to advertise service routes, TLOC routes, policies, and segmentation information.

Data-side elements

WAN Edge routers forward traffic. They build encrypted data-plane tunnels to other WAN Edge routers. They also run BFD over those tunnels so the fabric can measure liveliness, loss, latency, and jitter.

Service-side interfaces face LAN networks. Transport-side interfaces face MPLS, Internet, LTE, or other WAN transports.

User packet on Branch-A service VPN
      |
      v
WAN Edge picks transport (MPLS vs Internet) using policy + BFD quality
      |
      v
Encrypted data-plane tunnel -> Branch-B WAN Edge -> destination LAN
(OMP already taught both edges how to reach remote TLOCs/routes)

Read the output

Control connections should show the edge router connected to controllers and management/orchestration components.

Cisco's current names are SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator. Many command outputs, older screenshots, and lab images still show the legacy peer type strings vmanage, vsmart, and vbond. Teach both labels so the reader can map old output to current terminology.

Edge1# show sdwan control connections
PEER TYPE     SITE ID   DOMAIN ID   PEER PRIVATE IP   STATE
vsmart        100       1           10.0.0.11         up
vmanage       100       1           10.0.0.10         up
vbond         0         0           10.0.0.12         up

Read that output as: Controller up, Manager up, Validator up.

OMP peers prove the control plane is exchanging reachability.

Edge1# show sdwan omp peers
PEER        TYPE      DOMAIN  OVERLAY-ID  STATE
10.0.0.11   vsmart    1       1           up

BFD sessions prove data-plane tunnel health.

Edge1# show sdwan bfd sessions
SOURCE TLOC COLOR   REMOTE TLOC COLOR   STATE  LATENCY  LOSS
biz-internet        biz-internet         up     18 ms    0%
mpls                mpls                 up     7 ms     0%

Lab: separate control from data

Use any SD-WAN sandbox, emulator, or screenshots from your own lab. Make a table with three columns: management, control, data. Put each command output in the correct column.

Then simulate a bad transport by shutting one transport interface or reading a failure example. Predict what changes first: control connection, OMP route, BFD session, or user forwarding path.

Pass check

If a question says templates or monitoring, think Manager. If it says onboarding or discovery, think Validator. If it says OMP routes or centralized policy, think Controller. If it says encrypted tunnels, BFD, or application traffic, think WAN Edge data plane.