vEdge Cloud reached its last date of support on May 31, 2026, and the last vEdge software train is 20.9.x. A Catalyst 8000v on IOS XE 17.18 still prints Personality: vEdge, but show version says Controller-Managed IOS XE.
One universalk9 image runs both modes. On a C8000v with IOS XE 17.18.02, show version reports Router operating mode: Controller-Managed, tclsh is refused, and controller-mode enable, disable, and reset all reload the router.
A C8000v in Controller mode refuses tclsh, so the old paste-a-PEM trick fails. Copy the public root to bootflash with SCP, install it with request platform software sdwan root-cert-chain install, and let Manager handle device certificates.
A C8000v joins the fabric after four steps: system identity, two transports, the enterprise root, and an activated software identity with a Manager-installed certificate. Proof: five control connections up, an OMP peer, and two BFD sessions.
Manager 20.18 rejected the C8000v rows with "Virtual Platform is not allowed in CSV Upload." Generating two PAYG identities locally, pushing the list before activation, and pushing again only after the certificate serial matched brought both edges up.
One self-signed OpenSSL root signs every control component and edge CSR. The private key never leaves the signer, installs go through Manager one device at a time, and the edge proves it with a leaf issued by PingLabz Lab Root CA.
The Validator differs from the Controller by one word: vbond 172.16.30.30 local. Bootstrap config for both, registration in Manager, and the Controller's OMP peer table showing both edges up after certificates were installed.
An open HTTPS port is not a ready Manager. In this build the GUI redirected to Diagnostic Center until about 28 minutes after deployment, one to four vCPUs gave 503s, and the CSR API needed the system IP, not the transport address.
A system IP is an identity, not a reachable address: the Validator is 1.1.1.3, but edges find it at 172.16.30.30. The full address, site, and organization plan for a two-edge 20.18 lab, plus the ports a 12346-only rule misses.
Five devices make a useful lab: Manager, Validator, Controller, and two C8000v edges. The Manager is the limit. One to four vCPUs returned 503s; eight vCPUs and 32 GB worked, still below Cisco's 16 vCPU small-instance spec.
Every SD-WAN tunnel gets a BFD session: 1000 ms hellos, multiplier 7. Shutting a far-end link took the tunnel down within 12 seconds, recovery took up to a minute, and the same hellos feed loss, latency, and jitter for app-aware routing.
Clearing control connections on a C8000v and capturing the rebuild showed the Validator handshake first, a DTLS cookie exchange, mutual certificates, then Controller and Manager, about 0.6 seconds per link. Plus the error codes that explain a failed join.