With mpls restrict, two dual-transport edges build two tunnels. Removing restrict on one edge gave three, on both gave four, and putting it back returned two. Restrict must be off at both ends for a cross-color tunnel.
An SD-WAN VPN is a VRF: VPN 0 for transport, VPN 512 for local management, and service VPNs for users. A management port left in VPN 513 showed what goes wrong: OMP advertised its default route and subnet to the other site with label 1003.
A TLOC is the next hop for every OMP route: system IP, color, and encapsulation. The TLOC route carries the real address and port, and one word, restrict, cut four possible tunnels between two dual-transport edges down to two.
OMP is how Cisco SD-WAN edges learn each other's routes, and it maps closely onto BGP with a route reflector. The Controller received 18 routes and installed none, and a new loopback on edge2 reached edge1 as an m route, distance 251, with no extra config.
The SD-WAN Controller tells routers where to send traffic but never forwards it. A 30-second capture found zero user-sized packets on the Controller link, and 1,000 pings between sites barely moved its counters while edge1's tunnels carried 1,044 each way.
Manager configures, Controller routes over OMP, Validator onboards, and only the WAN Edge routers forward user traffic. Two edges on 20.18.2.1 show the ports, the join order, and why an edge with one Controller keeps its Validator session up.
Cisco Catalyst SD-WAN in one page: what Manager, Controller, Validator, and WAN Edge do, how OMP, TLOCs, and VPNs fit together, and all 33 published posts in reading order, built on 20.18.2.1 with C8000v edges.
vManage is SD-WAN Manager, vSmart is SD-WAN Controller, and vBond is SD-WAN Validator, renamed from 20.12.1. On 20.18.2.1 the GUI uses the new names, but the CLI, certificates, alarms, and API still say vsmart, vbond, and even vedge-cloud.
SD-WAN runs every WAN link as one centrally managed overlay. A 40-branch MPLS network that backhauls Microsoft 365 through the data center shows the problem; active/active links, per-application path choice, and local Internet exits are the fix.
Nine Cisco ISE 3.5 labs, each built around a real failure and its fix: 11007 from an unknown RADIUS source, 15039 on a known printer, a dACL that blocked DNS, TACACS+ lockouts with 22056 and 13036, and a 5417 CoA key mismatch.
Three open source tools that fill gaps next to Zabbix: LibreNMS against Zabbix on the same SNMPv3 devices, Netdisco finding a whole lab from one CDP seed, and Suricata with Zeek alerting on anyone outside the NOC touching router management.
Four posts on open source change control for Cisco IOS XE: Oxidized config diffs in Git, Batfish catching a shadowed ACL line and a null route offline, NetBox as the Ansible inventory, and one change traced through every tool.