1.2.a SD-WAN control and data planes elements

What this objective tests

You must know which SD-WAN elements make decisions and which elements forward packets. Most wrong answers confuse management, control, and data plane functions.

Control-side elements

• SD-WAN Manager: templates, configuration, monitoring, images, alarms, and troubleshooting views. It is not in the forwarding path.
• SD-WAN Validator: authenticates WAN Edge devices and helps them discover the controllers. It handles onboarding and NAT traversal.
• SD-WAN Controller: runs the control plane. It uses Overlay Management Protocol (OMP) to advertise service routes, TLOC routes, policy, and segmentation.

Data-side elements

WAN Edge routers forward traffic. They build IPsec tunnels to other WAN Edge routers. They run Bidirectional Forwarding Detection (BFD) over the tunnels to measure liveliness, loss, latency, and jitter.

Service-side interfaces face the LAN. Transport-side interfaces face MPLS, Internet, LTE, or other WAN transports.

User packet on Branch-A service VPN
      |
      v
WAN Edge picks a transport using policy + BFD quality
      |
      v
IPsec data tunnel -> Branch-B WAN Edge -> destination LAN
(OMP already taught both edges the remote TLOCs and routes)

Read the output

The current names are SD-WAN Manager, SD-WAN Controller, and SD-WAN Validator. Many outputs and lab images still show the legacy strings vmanage, vsmart, and vbond. Learn both labels.

Control connections show the edge router sessions to the controllers:

Edge1# show sdwan control connections
PEER TYPE     SITE ID   DOMAIN ID   PEER PRIVATE IP   STATE
vsmart        100       1           10.0.0.11         up
vmanage       100       1           10.0.0.10         up
vbond         0         0           10.0.0.12         up

Read this output as: Controller up, Manager up, Validator up.

OMP peers prove the control plane exchanges reachability:

Edge1# show sdwan omp peers
PEER        TYPE      DOMAIN  OVERLAY-ID  STATE
10.0.0.11   vsmart    1       1           up

BFD sessions prove data tunnel health:

Edge1# show sdwan bfd sessions
SOURCE TLOC COLOR   REMOTE TLOC COLOR   STATE  LATENCY  LOSS
biz-internet        biz-internet        up     18 ms    0%
mpls                mpls                up     7 ms     0%

Lab: separate control from data

Use an SD-WAN sandbox, an emulator, or saved lab output.

Do these steps:

1. Make a table with three columns: management, control, data.
2. Put each command output above in the correct column.
3. Shut down one transport interface, or read a failure example.
4. Predict what changes first: control connection, OMP route, BFD session, or forwarding path.
5. Verify the prediction with show sdwan bfd sessions and show sdwan omp routes.

The lab passes when your prediction matches the output. BFD detects the transport failure first.

Pass check

• Templates or monitoring: Manager. Onboarding or discovery: Validator.
• OMP routes or centralized policy: Controller.
• Encrypted tunnels, BFD, or user traffic: WAN Edge data plane.