Cisco Sdwan

---
name: cisco-sdwan
description: "Expert coverage of Cisco Catalyst SD-WAN (formerly Viptela) across all versions: SD-WAN Manager/Controller/Validator architecture, OMP, TLOC, BFD, application-aware routing, centralized/localized policy, templates, configuration groups, UTD security, and Cloud OnRamp. Use for \"Cisco SD-WAN\", \"Catalyst SD-WAN\", \"vManage\", \"vSmart\", \"vBond\", \"OMP\", \"TLOC\", \"SD-WAN Manager\", \"AAR\", \"Cloud OnRamp\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `sd-wan` skill."
license: MIT
---

# Cisco Catalyst SD-WAN

This skill covers Cisco Catalyst SD-WAN (formerly Cisco SD-WAN / Viptela) across all supported versions (20.12 through 20.18 controller releases, IOS-XE 17.12 through 17.18 WAN Edge releases). Areas of expertise include:

- SD-WAN Manager (vManage), SD-WAN Controller (vSmart), SD-WAN Validator (vBond) architecture
- OMP (Overlay Management Protocol) -- route types, TLOC, best-path selection, graceful restart
- IPsec tunnel formation, BFD path quality measurement
- Application-Aware Routing (AAR) and Enhanced AAR (EAAR)
- Centralized policy (control policy + data policy) and localized policy
- Feature templates, device templates, CLI add-on templates, configuration groups
- UTD (Unified Threat Defense) -- ZBFW, IPS/IDS, URL filtering, AMP, DNS security
- Cloud OnRamp for SaaS, IaaS (AWS/Azure/GCP), and colocation
- Catalyst Center integration for campus-to-WAN consistency
- SD-WAN Manager REST API for automation

When a question is version-specific, consult the matching `references/versions/` file. When the version is unknown, provide general guidance and note where behavior differs across releases.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for CLI commands, NWPI, BFD analysis, tunnel debugging
   - **Policy design** -- Load `references/best-practices.md` for template strategy, policy hierarchy, security integration
   - **Architecture** -- Load `references/architecture.md` for controller roles, OMP, TLOC, BFD, data plane
   - **Administration** -- Follow template/policy workflow guidance below
   - **Automation** -- Apply SD-WAN Manager REST API guidance

2. **Identify version** -- Determine controller release (20.x) and WAN Edge IOS-XE release (17.x). If unclear, ask. Version alignment matters: controller 20.18 pairs with IOS-XE 17.18.

3. **Load context** -- Read the relevant reference file for deep knowledge.

4. **Analyze** -- Apply Cisco SD-WAN-specific reasoning, not generic SD-WAN advice.

5. **Recommend** -- Provide actionable guidance with CLI examples, template configurations, or API calls.

6. **Verify** -- Suggest validation steps (`show sdwan` commands, SD-WAN Manager monitoring, NWPI traces).

## Core Architecture

Cisco Catalyst SD-WAN separates management, control, and data planes into dedicated components:

### SD-WAN Manager (vManage)
- Single-pane NMS: GUI, REST API, dashboard analytics
- Manages device onboarding, templates, policy distribution, software upgrades, certificate provisioning
- Cluster mode: minimum 3 nodes for HA; internal Elasticsearch + Cassandra data layer
- Communicates via DTLS/TLS on port 12446 (NETCONF) to controllers and edge routers

### SD-WAN Controller (vSmart)
- Runs OMP as route reflector for the overlay
- Distributes routes (vRoutes), TLOCs, service routes, and encryption keys
- Applies centralized control policy before advertising routes
- Failure does NOT break existing data-plane tunnels (BFD sessions stay up; OMP graceful restart caches routes for 12 hours default)
- Scale: 1 vSmart per ~2,000 WAN Edge devices; up to 6 instances

### SD-WAN Validator (vBond)
- First contact for new WAN Edge devices during ZTP
- Authenticates via serial number whitelist; facilitates NAT traversal (STUN-like)
- Advertises vSmart and vManage addresses to authenticating devices
- Must have a public IP (or 1:1 NAT); deployed in DMZ; port 12346/UDP (DTLS)

### WAN Edge Routers
- Catalyst 8000 series (C8200, C8300, C8500), ISR 1000/4000, ASR 1000, Catalyst 8000V (virtual)
- IOS-XE with SD-WAN persona; data-plane forwarding, IPsec tunnels, BFD probes, policy enforcement
- Connect to SD-WAN Manager (NETCONF), SD-WAN Controller (OMP/DTLS), SD-WAN Validator (initial auth)

## OMP (Overlay Management Protocol)

OMP is a TCP-based protocol (BGP-like in design) running inside DTLS/TLS sessions between WAN Edge devices and vSmart.

### Route Types
- **vRoutes**: Overlay prefixes (IPv4/IPv6) learned from connected/static/OSPF/BGP
- **TLOC routes**: Transport Locators describing how to reach a WAN Edge tunnel endpoint
- **Service routes**: Advertise network services (firewall, IDS) for service chaining

### TLOC (Transport Locator)
A TLOC uniquely identifies a tunnel endpoint as a 3-tuple:
```
TLOC = (System-IP, Color, Encapsulation)
```
- **System-IP**: Router identifier (loopback-like), never changes
- **Color**: Logical transport label (mpls, biz-internet, public-internet, private1-6, lte)
- **Encapsulation**: ipsec or gre

TLOCs advertised via OMP to vSmart, which distributes them to all peers. WAN Edge builds IPsec tunnels to remote TLOCs based on received TLOC routes.

### OMP Best Path Selection
vSmart selects best path considering (in order):
1. Originator preference (locally originated preferred)
2. Admin distance
3. OMP preference attribute
4. TLOC preference
5. System-IP (tie-break)

### OMP Graceful Restart
WAN Edge devices cache OMP routes locally. During vSmart unavailability, existing data-plane state preserved for the graceful-restart timer (default 12 hours). No new route/policy changes until vSmart recovers.

## Data Plane

### IPsec Tunnels
- Full-mesh IPsec tunnels between all TLOCs (per color pairing) by default
- IPsec ESP in tunnel mode; AES-256-GCM default cipher
- Keys distributed by SD-WAN Manager; zero-touch key rotation
- Each tunnel identified by (local-TLOC, remote-TLOC) pair

### BFD (Bidirectional Forwarding Detection)
BFD probes run inside every IPsec tunnel for two purposes:
1. **Tunnel liveness**: Detect failures (sub-second with tuned timers)
2. **Path quality**: Measure latency, jitter, packet loss per tunnel

```
Default BFD Timers:
  hello-interval: 1000 ms
  multiplier: 7 (7s before declaring down)
  app-route polling-interval: 600 seconds
  app-route multiplier: 6 (use last 6 polling intervals for SLA calc)
```

BFD statistics feed directly into the AAR decision engine.

## Application-Aware Routing (AAR)

### SLA Classes
Define acceptable performance thresholds:
```
sla-class VOICE
  loss    1      ! percent
  latency 150    ! milliseconds
  jitter  30     ! milliseconds
```

### App-Route Policies
Centralized policies matching traffic to SLA classes with transport preference:
```
app-route-policy ENTERPRISE-AAR
  sequence 10
    match
      app-list VOICE-APPS
    action
      sla-class VOICE
        preferred-color mpls
  sequence 20
    match
      app-list CRITICAL-DATA
    action
      sla-class DATA-SLA
        preferred-color mpls biz-internet
```

### AAR Decision Logic
1. Match application (DPI via NBAR2 on IOS-XE)
2. Look up assigned SLA class thresholds
3. Evaluate all tunnels' BFD metrics against thresholds
4. Select tunnel(s) satisfying SLA; prefer specified color
5. If no tunnel satisfies SLA: fallback (best available or drop, configurable)

### Enhanced AAR (EAAR) -- 17.12+
- Per-flow rerouting (not just per-session)
- SLA violation detection at 1-second granularity
- Sub-second path switching on MPLS/private transports
- Application-aware load balancing across multiple SLA-compliant paths

## Policy Framework

### Centralized Policy (vSmart)

**Control Policy** -- manipulates OMP route advertisements:
- Route filtering (accept/reject prefixes by site, TLOC, tag)
- Traffic engineering (preferred TLOC, TLOC lists)
- Hub-and-spoke topologies (restrict full-mesh to hub-spoke)
- Service insertion (route traffic through firewall/IDS service nodes)

**Data Policy** -- applied at WAN Edge ingress/egress:
- QoS marking, shaping, queuing
- NAT (DIA -- Direct Internet Access)
- ACL / packet filtering
- Mirror / sFlow

### Localized Policy (WAN Edge)
Applied locally on the WAN Edge:
- QoS scheduling queues
- ACLs (in/out on interfaces)
- Route policy (manipulate routing table)
- VPN membership

### Policy Hierarchy
```
Centralized Control Policy (vSmart distributes)
      |
Centralized Data Policy (pushed to WAN Edge)
      |
Localized Policy (per-device)
      |
App-Route Policy (per-device, driven by centralized AAR config)
```

## Templates and Configuration Groups

### Feature Templates
Modular building blocks for individual configuration features:
- System (system-ip, site-id, hostname, NTP, DNS)
- VPN (VPN 0 = transport, VPN 512 = management, VPN 1+ = service)
- Interface (WAN/LAN, IP addressing, tunnel params)
- Routing (BGP, OSPF, EIGRP), BFD, OMP
- Security (UTM chain), SNMP, Syslog, AAA

### Device Templates
Assemble multiple feature templates into a full device configuration. Assigned to one or more physical devices:
```
Device Template: BRANCH-C8300
  +-- Feature Template: SYSTEM-BASE
  +-- Feature Template: VPN0-MPLS
  +-- Feature Template: VPN0-INET
  +-- Feature Template: VPN1-LAN
  +-- Feature Template: BGP-PE
  +-- Feature Template: SECURITY-UTM
```

### CLI Add-On Templates
Inject raw IOS-XE CLI into the device config without overriding the template framework. Useful for edge cases and platform-specific commands not covered by feature templates.

### Configuration Groups (20.12+)
Profile-based approach replacing device templates in newer deployments. Feature profiles group related settings; configuration groups bundle profiles and apply to device tags or specific devices. Aligned with Catalyst Center concepts.

## Security -- UTD (Unified Threat Defense)

UTD runs as a containerized security stack on IOS-XE WAN Edge routers (C8000 series):

| Feature | Description |
|---|---|
| Enterprise Firewall (ZBFW) | Zone-based stateful firewall, application-aware |
| IPS/IDS | Snort-based intrusion prevention/detection; Talos signature updates |
| URL Filtering | Category/reputation-based web filtering (Talos cloud lookup) |
| AMP | File reputation via SHA-256 hash lookup; retrospective detection |
| DNS Security | DNS sinkholing, malicious domain blocking (Umbrella integration) |
| TLS/SSL Decryption | Inline TLS inspection for UTD modules |

UTD policies configured via SD-WAN Manager security templates and pushed to WAN Edge devices. Centralized security dashboard shows IPS alerts, URL filtering hits, AMP verdicts.

## Cloud OnRamp

### Cloud OnRamp for SaaS
- Monitors SaaS app performance (O365, Salesforce, Webex) from each branch transport
- Automatically steers to best-performing gateway (DIA, regional hub, cloud gateway)
- Active probing to SaaS endpoints; per-transport SLA scoring

### Cloud OnRamp for IaaS (AWS / Azure / GCP)
- Automates Catalyst 8000V virtual router deployment in cloud VPCs/VNets
- Orchestrates tunnel establishment from branch WAN Edge to cloud instances
- AWS Transit Gateway integration; Azure Virtual WAN hub support

### Cloud OnRamp for Colocation
- Automates network services deployment in colo facilities (Equinix, CyrusOne)
- Integrates with SD-WAN Gateway (C8000V) deployments in colo

## SD-WAN Manager REST API

Base URL: `https://<vmanage>/dataservice/`

Key endpoints:
- `/device` -- Device inventory and status
- `/template/device` -- Device templates
- `/template/feature` -- Feature templates
- `/device/action/install` -- Software install
- `/statistics/approute` -- App-route statistics
- `/certificate` -- Certificate management

Authentication: Session-based (POST to `/j_security_check`), then use JSESSIONID cookie. Token-based auth also supported.

## Common Pitfalls

1. **Version mismatch between controller and edge** -- Controller major.minor must match IOS-XE release (20.18 pairs with 17.18). Controller can be one version ahead during upgrades.

2. **BFD timer tuning without understanding impact** -- Aggressive BFD timers (100ms hello) increase CPU and bandwidth on devices with many tunnels. Calculate: (number of tunnels) x (probe size) x (1/hello-interval).

3. **Full-mesh tunnel explosion** -- Default full-mesh creates n*(n-1)/2 tunnels. At 100 sites = ~5,000 tunnels. Use centralized control policy to enforce hub-spoke for large deployments.

4. **Forgetting site-list in centralized policy** -- Centralized policy requires a site-list specifying which sites the policy applies to. Without it, the policy has no effect.

5. **Template variable mismanagement** -- Variables in feature templates that are not populated in the device template attachment cause push failures. Use CSV import for bulk variable population.

6. **Upgrading vManage cluster without proper procedure** -- Must upgrade one node at a time; verify cluster health between nodes. Never upgrade all nodes simultaneously.

7. **OMP graceful restart expiration** -- If vSmart is down longer than the graceful-restart timer (default 12h), WAN Edge devices purge cached routes and lose overlay connectivity.

8. **Not enabling DIA for SaaS traffic** -- Backhauling SaaS traffic to the data center negates one of SD-WAN's key benefits. Use centralized data policy for DIA with appropriate security (UTD or Umbrella).

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 20.15 | `references/versions/20.15.md` | SD-WAN Manager 20.15 LTS, paired with IOS-XE 17.15, SLA threshold improvements, EAAR enhancements |

## Reference Files

Load these when you need deep knowledge:

- `references/architecture.md` -- Controller roles, OMP internals, TLOC mechanics, BFD, IPsec tunnel formation, data plane architecture. Read for "how does X work" questions.
- `references/diagnostics.md` -- CLI troubleshooting commands (show sdwan), NWPI, BFD session debugging, tunnel statistics, radioactive tracing. Read when troubleshooting.
- `references/best-practices.md` -- Template design strategy, policy design patterns, security integration, multi-cloud architecture, upgrade procedures. Read for design and operations questions.