Cisco SD-WAN
Course Description
This course covers Cisco Catalyst SD-WAN (formerly Cisco SD-WAN or Viptela) from scratch. We start with what SD-WAN is and why organizations replace or combine their private WAN connections with Internet connections. Then we build our own SD-WAN lab: we install the SD-WAN Manager, Validator, and Controller, set up certificates and device licenses, and onboard vEdge and cEdge routers. Once the lab is up and running, we manage everything with device and feature templates, send traffic between sites with service VPNs, run OSPF and BGP within a site, and configure a localized data policy.
Course Highlights
In this course you will learn:
- What SD-WAN is, and how it differs from a traditional private WAN.
- What the SD-WAN Manager, Controller, Validator, and edge routers do, and how OMP advertises routes in the overlay.
- Your options for a Cisco SD-WAN lab: DevNet sandboxes, CML, or EVE-NG.
- How to install and configure the SD-WAN Manager, Validator, and Controller, including certificates.
- How to create Plug and Play Connect device licenses.
- How to onboard vEdge and cEdge routers.
- How to manage devices with device, feature, and CLI templates.
- How to configure service VPNs and run OSPF and BGP within a site.
- How to configure policing with a localized data policy.
Presented to you by instructor Rene Molenaar, CCIE #41726
Course at a glance
- 17 lessons in 6 units.
- Format: self-paced lessons with SD-WAN Manager walkthroughs, CLI configurations, and video.
- Last updated: October 2026.
Requirements
- Knowledge of how routers and routing protocols work.
- A good understanding of OSPF, EIGRP, and BGP.
- A basic understanding of tunneling with GRE and IPsec.
Course Schedule
What is Cisco SD-WAN?
SD-WAN (Software Defined WAN) is an approach where part of the control plane is centralized and the WAN is built with automation in mind. Instead of configuring routers box-by-box with the CLI, you create configurations and policies on a central controller and push them to all your routers. Cisco Catalyst SD-WAN is Cisco’s enterprise SD-WAN solution, based on Viptela, which Cisco acquired in 2017. It has four main components: SD-WAN Manager (formerly vManage) for management, SD-WAN Controller (formerly vSmart) as the controller, SD-WAN Validator (formerly vBond) as the orchestrator, and the edge routers at your sites. You still see the original names in the CLI, in a lot of documentation, and in our lessons.
Private WAN connections like MPLS are reliable but expensive and slow to deploy. SD-WAN combines them with regular Internet connections and protects traffic over the Internet with IPsec. It monitors all WAN connections for metrics like delay and throughput, uses them active/active, and can select the best path per application. The SD-WAN Controller advertises routes and policies to the routers with the Overlay Management Protocol (OMP), similar to how a BGP route reflector works, but it never sits in the data plane.
Who uses Cisco SD-WAN? Organizations with many branch offices that want to lower their WAN costs, add Internet and 4G links next to MPLS, and connect sites directly to cloud applications instead of backhauling all traffic to a data center. If you work on enterprise WANs, you need to know how it works.
Cisco SD-WAN Learning Roadmap
This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.
Cisco SD-WAN Architecture
We start with the problems of traditional WANs and how SD-WAN solves them. You learn what the SD-WAN Manager, Controller, Validator, and edge routers do, why OMP is used in the overlay, and what Cloud onRamp does for SaaS and IaaS traffic. Before you configure anything, you need a lab. There are several lab options: DevNet sandboxes are great to test templates and policies, but building your own lab teaches you how everything fits together.
Build Your Cisco SD-WAN Lab
With CML and the SD-WAN Lab Deployment Tool, you can deploy a complete lab with controllers, cEdge routers, and certificates in about 20 minutes. If you want to do everything step-by-step, you build the lab in EVE-NG and install the controllers yourself. Each controller needs a system configuration, a VPN 0 interface, and a certificate signed by a root CA. Since version 20.x, you also need device licenses from Plug and Play Connect.
Onboarding vEdge and cEdge Routers
Once the controllers are up and running, we onboard routers. Each router needs a system configuration, a VPN 0 interface with a color for its TLOC, the root CA certificate, and its own signed certificate. The first device a router talks to is the SD-WAN Validator (vBond), which tells it how to reach SD-WAN Manager and the SD-WAN Controllers. Onboarding a cEdge router running IOS XE SD-WAN works the same way as a vEdge router, but the configuration syntax is slightly different.
Cisco SD-WAN Templates
The CLI is fine for a few devices, but it doesn’t scale. With device and feature templates, you create your configuration once in SD-WAN Manager and attach it to as many devices as you like. A device template is built from feature templates, and you can use device-specific variables for values like IP addresses. Once SD-WAN Manager manages a device (vManage mode), you can’t configure it from the CLI anymore. For a single SD-WAN Controller (vSmart) in a lab, a CLI template is the quickest way to get it into vManage mode.
Service VPNs, Routing and Policies
Service VPNs carry the traffic of your users between sites; you can use any VPN number except 0 and 512, and OMP advertises the routes to the other sites. Within a site, you might still need OSPF or BGP to exchange routes with routers and switches that don’t run SD-WAN. Policies come in two scopes: centralized policies for the entire network, and localized policies for a single device. A localized data policy lets you police, shape, queue, and mark traffic on an interface.
Frequently Asked Questions
In many networks, partly. A lot of organizations have moved branch offices from MPLS VPNs to Internet connections with SD-WAN because it’s cheaper and easier to manage, but many keep MPLS for sites or applications that need a guaranteed SLA. SD-WAN runs over any transport, so a mix of MPLS and Internet links is very common. Learn more about WAN technologies.
Yes. Cisco SD-WAN is based on Viptela, which Cisco acquired in 2017, and it’s now called Cisco Catalyst SD-WAN. The components were renamed too, for example SD-WAN Manager (formerly vManage), but they work the same way, so everything in this course still applies. You’ll still see the old names in many commands and documents. Read our introduction to SD-WAN.
Yes. The 300-415 ENSDWI exam (Implementing Cisco SD-WAN Solutions) earns you the Cisco Certified Specialist – Enterprise SD-WAN Implementation certification, and it also counts as a concentration exam for CCNP Enterprise. SD-WAN architecture is also part of the CCNP ENCOR exam topics.
Both are Cisco products. Meraki SD-WAN runs on Meraki MX appliances and is managed from the Meraki cloud dashboard, so it’s simple to set up and works well for small and mid-sized networks. Cisco Catalyst SD-WAN (formerly Viptela), which this course covers, gives you more control over routing, policies, and topologies, and is more common in larger enterprise WANs.
Cisco SD-WAN, now called Cisco Catalyst SD-WAN, is Cisco’s enterprise SD-WAN solution, based on Viptela. It uses central controllers to manage the configuration and policies of all WAN routers, combines private WAN and Internet connections, and protects traffic over the Internet with IPsec. Read our introduction to SD-WAN.
SD-WAN Manager (formerly vManage) is the management system where you create device configurations and policies, with a GUI or REST API. SD-WAN Controller (formerly vSmart) advertises routes and policies to the routers with OMP and is never in the data plane. SD-WAN Validator (formerly vBond) is the orchestrator that authenticates devices and tells routers how to reach SD-WAN Manager and the controllers. Learn how to install the controllers.
vEdge routers are the original Viptela routers that run Viptela OS, as hardware or as vEdge Cloud VMs. Cisco no longer sells them, and support for vEdge Cloud ended in May 2026, so new deployments use cEdge routers: Cisco routers like the Catalyst 8000 series, ISR, and ASR, or the virtual Catalyst 8000V (formerly CSR 1000v), that run the IOS XE SD-WAN software. You onboard both the same way, but the configuration syntax is slightly different. Learn how to onboard a cEdge router.