One MPLS circuit, two WAN Edge routers: without TLOC extension your redundancy is fiction. This post explains how one router uses a transport physically connected to the other and how it fits a redundant branch design.
DIA lets branch internet traffic exit locally instead of backhauling to a data center firewall. See how it works in Catalyst SD-WAN, how the data policy is configured, and the security question local breakout forces you to answer.
Localized policy is what runs on the SD-WAN edge itself: interface ACLs, QoS treatment, and route policies filtering what a branch redistributes into OMP. Syntax follows Cisco's current 20.x documentation.
Application-aware routing measures loss, latency, and jitter on every transport and steers each app onto a path that meets its SLA. This article covers centralized data policy, SLA classes, and how the fabric measures paths, per Cisco's 20.x docs.
In SD-WAN you do not configure routing policy on the routers. Centralized control policy is one document on the Controller that shapes topology, path preference, and reachability for the entire overlay.
OMP carries everything in Catalyst SD-WAN: routes, TLOCs, service routes, keys, and policy. This deep dive walks each advertisement type and the path selection logic, with WAN Edge CLI drawn from Cisco's current 20.x documentation.
CLI templates, feature templates, and configuration groups arrived in three different eras of Catalyst SD-WAN. This article explains what each provisioning model is, why it exists, and which one to use in 2026.
Not every network should be a fabric. This article covers where SD-Access earns its controller, identity service, and hardware requirements, and where a senior engineer should say no to deploying it.
SD-Access segments in two layers: virtual networks for macro-segmentation and SGTs for micro-segmentation. This post explains what each layer isolates, how they combine, and where the policy is actually enforced.
The border node is where an SD-Access fabric meets everything else, and where IP transit, SDA transit, and Layer 2 handoff get confused. Untangle all three and see how VRF-lite, BGP, and LISP carry traffic out of the fabric.
An endpoint plugs in and seconds later it is in the right virtual network with the right SGT and policy. This article walks SD-Access host onboarding from physical port to enforced policy: 802.1X, SGT assignment, and LISP registration.
An SD-Access fabric is a set of roles: edge, border, control plane, and fabric in a box. This guide explains what each role runs (LISP, VXLAN) and which pieces you can verify standalone versus what needs Catalyst Center.