Cisco SD-WAN
Course Description
This course covers Cisco SD-WAN (Viptela) from scratch. We start with what SD-WAN is and why organizations replace or combine their private WAN connections with Internet connections. Then we build our own SD-WAN lab: we install the vManage, vBond, and vSmart controllers, set up certificates and device licenses, and onboard vEdge and cEdge routers. Once the lab is up and running, we manage everything with device and feature templates, send traffic between sites with service VPNs, run OSPF and BGP within a site, and configure a localized data policy.
Course Highlights
In this course you will learn:
- What SD-WAN is, and how it differs from a traditional private WAN.
- What the vManage, vSmart, vBond, and vEdge components do, and how OMP advertises routes in the overlay.
- Your options for a Cisco SD-WAN lab: DevNet sandboxes, CML, or EVE-NG.
- How to install and configure the vManage, vBond, and vSmart controllers, including certificates.
- How to create Plug and Play Connect device licenses.
- How to onboard vEdge and cEdge routers.
- How to manage devices with device, feature, and CLI templates.
- How to configure service VPNs and run OSPF and BGP within a site.
- How to configure policing with a localized data policy.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 14 lessons in 6 units.
- Format: self-paced lessons with vManage walkthroughs, CLI configurations, and video.
- Last updated: October 2026.
Requirements
- Knowledge of how routers and routing protocols work.
- A good understanding of OSPF, EIGRP, and BGP.
- A basic understanding of tunneling with GRE and IPsec.
Course Schedule
What is Cisco SD-WAN?
SD-WAN (Software Defined WAN) is an approach where part of the control plane is centralized and the WAN is built with automation in mind. Instead of configuring routers box-by-box with the CLI, you create configurations and policies on a central controller and push them to all your routers. Cisco SD-WAN is Cisco’s enterprise SD-WAN solution, based on Viptela, which Cisco acquired in 2017. It has four main components: vManage for management, vSmart as the controller, vBond as the orchestrator, and the vEdge routers at your sites.
Private WAN connections like MPLS are reliable but expensive and slow to deploy. SD-WAN combines them with regular Internet connections and protects traffic over the Internet with IPsec. It monitors all WAN connections for metrics like delay and throughput, uses them active/active, and can select the best path per application. vSmart advertises routes and policies to the routers with the Overlay Management Protocol (OMP), similar to how a BGP route reflector works, but it never sits in the data plane.
Who uses Cisco SD-WAN? Organizations with many branch offices that want to lower their WAN costs, add Internet and 4G links next to MPLS, and connect sites directly to cloud applications instead of backhauling all traffic to a data center. If you work on enterprise WANs, you need to know how it works.
Cisco SD-WAN Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
Cisco SD-WAN Architecture
We start with the problems of traditional WANs and how SD-WAN solves them. You learn what the vManage, vSmart, vBond, and vEdge components do, why OMP is used in the overlay, and what Cloud onRamp does for SaaS and IaaS traffic. Before you configure anything, you need a lab. There are several lab options: DevNet sandboxes are great to test templates and policies, but building your own lab teaches you how everything fits together.
Build Your Cisco SD-WAN Lab
With CML and the SD-WAN Lab Deployment Tool, you can deploy a complete lab with controllers, cEdge routers, and certificates in about 20 minutes. If you want to do everything step-by-step, you build the lab in EVE-NG and install the controllers yourself. Each controller needs a system configuration, a VPN 0 interface, and a certificate signed by a root CA. Since version 20.x, you also need device licenses from Plug and Play Connect.
Onboarding vEdge and cEdge Routers
Once the controllers are up and running, we onboard routers. Each router needs a system configuration, a VPN 0 interface with a color for its TLOC, the root CA certificate, and its own signed certificate. The first device a router talks to is vBond, which tells it how to reach vManage and vSmart. Onboarding a cEdge router running IOS XE SD-WAN works the same way as a vEdge router, but the configuration syntax is slightly different.
Cisco SD-WAN Templates
The CLI is fine for a few devices, but it doesn’t scale. With device and feature templates, you create your configuration once in vManage and attach it to as many devices as you like. A device template is built from feature templates, and you can use device-specific variables for values like IP addresses. Once a device is in vManage mode, you can’t configure it from the CLI anymore. For a single vSmart controller in a lab, a CLI template is the quickest way to get it into vManage mode.
Service VPNs, Routing and Policies
Service VPNs carry the traffic of your users between sites; you can use any VPN number except 0 and 512, and OMP advertises the routes to the other sites. Within a site, you might still need OSPF or BGP to exchange routes with routers and switches that don’t run SD-WAN. Policies come in two scopes: centralized policies for the entire network, and localized policies for a single device. A localized data policy lets you police, shape, queue, and mark traffic on an interface.
Frequently Asked Questions
Cisco SD-WAN is Cisco’s enterprise SD-WAN solution, based on Viptela. It uses central controllers to manage the configuration and policies of all WAN routers, combines private WAN and Internet connections, and protects traffic over the Internet with IPsec. Read our introduction to SD-WAN.
vManage is the management system where you create device configurations and policies, with a GUI or REST API. vSmart is the controller: it advertises routes and policies to the routers with OMP and is never in the data plane. vBond is the orchestrator that authenticates devices and tells routers how to reach vManage and vSmart. Learn how to install the controllers.
OMP (Overlay Management Protocol) is the Cisco SD-WAN protocol that advertises routes, security, and policy information in the overlay. All routers peer with a vSmart controller, in a hub and spoke topology similar to a BGP route reflector. Routes in a service VPN are advertised to other sites with OMP. See OMP in action with a service VPN.
vEdge routers are the original Viptela routers, available as hardware or as vEdge Cloud VMs. cEdge routers are Cisco routers like the ISR, ASR, or CSR that run the IOS XE SD-WAN software. You onboard both the same way, but the configuration syntax is slightly different. Learn how to onboard a cEdge router.
A service VPN carries user traffic between sites, similar to a VRF. VPN 0 is used for the transport (WAN) connections and VPN 512 for management, so you can pick any other VPN number for a service VPN. You configure it from the CLI or with templates. Configure a service VPN.
You can use the free Cisco DevNet sandboxes, or build your own lab. CML includes the SD-WAN images, and the SD-WAN Lab Deployment Tool builds the controllers, routers, and certificates for you. In EVE-NG, you install everything yourself, which takes longer but teaches you how it all works. Compare the Cisco SD-WAN lab options.
Feature templates contain the configuration of one feature, like a VPN, an interface, or OSPF. A device template combines feature templates into the complete configuration of a device. You attach the device template to as many devices as you like, and use variables for device-specific values. Learn how to use templates.
MPLS is a private WAN service from a provider with an SLA and end-to-end QoS, but it’s expensive and takes time to deploy. SD-WAN is an overlay that can run over MPLS, Internet, and 4G connections at the same time and picks the best path per application. Many organizations use SD-WAN to combine MPLS with cheaper Internet connections. Learn more about WAN technologies.
Ready to master Cisco SD-WAN?
Get access to all 14 Cisco SD-WAN lessons and every other course on NetworkLessons.com.