Ping Labz

Cisco SD-WAN Explained: The Complete Guide (2026)

Cisco SD-WAN, explained from scratch: what it is, how Manager, Controller, Validator and WAN Edge routers fit together, and a full map of the PingLabz series on Catalyst SD-WAN 20.18 and IOS XE 17.18.

Diagram: Cisco SD-WAN Explained, for Catalyst SD-WAN 20.18 and IOS XE 17.18.

Cisco SD-WAN is a way to run your whole WAN as one network, over any mix of MPLS, broadband and LTE links. Each site has a router that builds encrypted tunnels over every link it has. A central controller tells those routers which routes, keys and policies to use. A central manager lets you configure and watch every router from one screen. The routers then pick the best path for each application, based on what they measure on each tunnel right now.

That's the short version. This page is the map for the rest of the PingLabz SD-WAN series: what's here, what's coming, and where you should start.

Platform used in this series

Everything in this series targets Cisco Catalyst SD-WAN 20.18 for the control components and Cisco IOS XE 17.18 on the WAN Edge routers. The lab posts are built in my home lab on that version. Where an older release behaves differently, the post says so.

Cisco renamed the main parts in Release 20.12.1. You'll see the current names first in every post: SD-WAN Manager (formerly vManage), SD-WAN Controller (formerly vSmart) and SD-WAN Validator (formerly vBond). The full map is in this post.

How Cisco SD-WAN works, in one picture

If you know traditional routing, most of SD-WAN maps onto things you already use:

  • OMP (Overlay Management Protocol) is the routing protocol between the routers and the Controller. It works a lot like BGP with a route reflector.
  • A TLOC (transport locator) is how SD-WAN names a tunnel endpoint: system IP, color and encapsulation. Think of it as a next hop with a label saying which link it lives on.
  • A VPN in SD-WAN is a VRF. VPN 0 is the transport side, VPN 512 is management, and the numbers in between are your service VPNs.
  • The Validator is the meeting point. New routers find it first, much like a phone finds a SIP registrar, and it also helps routers behind NAT reach each other.

Concrete example: a branch router powers on, contacts the Validator, gets told where the Manager and Controllers are, downloads its config from the Manager and learns routes from the Controller over OMP. Then it builds IPsec tunnels to other sites and starts measuring them with BFD. The onboarding posts in Pillar 2 walk through each of those steps on real routers.

Diagram: Cisco Catalyst SD-WAN architecture. A control components group holds SD-WAN Manager for management through a GUI and API, SD-WAN Controller for the control plane carrying routes, keys and policy, and SD-WAN Validator for orchestration and first contact. Dashed arrows run from each one down to the WAN Edge routers: config from the Manager, OMP from the Controller and first contact with NAT help from the Validator. A note says OMP works a lot like BGP with a route reflector. Branch A, the Data Center and Branch B are WAN Edge routers joined by IPsec tunnels with BFD, sitting on an MPLS plus Internet underlay.

Start here

Pick the path that fits you.

Studying for CCNA or CCNP

  1. What Is SD-WAN? Why MPLS Alone Stopped Working
  2. vManage, vSmart, vBond Are Now Manager, Controller, Validator: The Name Map
  3. Then the rest of Pillar 1 in order (coming soon): components, the three planes, OMP, TLOCs and VPNs.

CCNP Enterprise ENCOR covers SD-WAN architecture, so Pillar 1 is the part to know well.

Working network engineer

  1. What Is SD-WAN? Why MPLS Alone Stopped Working if you're making the case to management.
  2. The name map, so older docs and TAC notes make sense.
  3. Then Pillar 2 to build a lab, and Pillar 6 when something breaks (coming soon).

Preparing for CCIE Enterprise Infrastructure

  1. The name map, because older study material uses the old names.
  2. Pillar 1 for the mechanics: OMP, TLOCs, colors and the control connections (coming soon).
  3. Pillars 3 and 4 for configuration and policy, then Pillar 6 for troubleshooting practice (coming soon).

The full series

Posts with links are live. Everything else is planned and listed in the order it will run inside each pillar.

Pillar 1: How SD-WAN works

  • What Is SD-WAN? Why MPLS Alone Stopped Working (live)
  • Cisco Catalyst SD-WAN Components: Manager, Controller, Validator, WAN Edge (coming soon)
  • vManage, vSmart, vBond Are Now Manager, Controller, Validator: The Name Map (live)
  • Control Plane vs Data Plane vs Management Plane in SD-WAN (coming soon)
  • OMP Explained: BGP's Cousin in the Overlay (coming soon)
  • TLOCs Explained: System-IP + Color + Encapsulation (coming soon)
  • Colors, Restrict and Private vs Public Colors (coming soon)
  • VPN 0, VPN 512 and Service VPNs (They're VRFs) (coming soon)
  • DTLS/TLS Control Connections Step by Step (coming soon)
  • BFD in SD-WAN: Tunnel Liveness and SLA Measurement (coming soon)
  • IPsec Data Plane: Keys via OMP, No IKE (coming soon)
  • NAT Traversal and the Validator as STUN Server (coming soon)
  • Cisco SD-WAN Hardware & Licensing Explained (C8000, C8000v, DNA/Cisco Networking subscriptions) (coming soon)
  • SD-WAN Glossary: 60 Terms in Plain English (coming soon)

Pillar 2: Build the lab and onboard routers

  • Cisco SD-WAN Lab Options in 2026 (sandbox, CML, self-built) (coming soon)
  • Planning a 20.18 Lab: IPs, System-IPs, Site-IDs, Org Name (coming soon)
  • Installing SD-WAN Manager 20.18 (coming soon)
  • Validator and Controller Initial Config (coming soon)
  • Enterprise Root CA for SD-WAN Without a Smart Account (coming soon)
  • Uploading the WAN Edge Serial List Manually (coming soon)
  • Onboarding a Catalyst 8000v 17.18 in Controller Mode (coming soon)
  • Autonomous vs Controller Mode on IOS XE (and Switching) (coming soon)
  • vEdge in 2026: Onboarding and Why It's End-of-Life (coming soon)
  • Zero-Touch / PnP Onboarding Explained (coming soon)
  • Installing SD-WAN Certificates When tclsh Is Blocked in Controller Mode (coming soon)

Pillar 3: Configuration and routing

  • Feature Templates vs CLI Templates vs Configuration Groups (coming soon)
  • Device & Feature Templates Hands-On (coming soon)
  • Configuration Groups and Feature Profiles on 20.18 (coming soon)
  • Template Variables and Bulk CSV Attach (coming soon)
  • Service VPN with OSPF on the LAN (coming soon)
  • Service-Side BGP and Route Redistribution Loops (coming soon)
  • TLOC Extension Between Two Edges (coming soon)
  • VRRP and Dual-Edge Sites (coming soon)
  • Transport-Side BGP/Static to MPLS PE (coming soon)
  • Multi-Region Fabric (MRF) Basics (coming soon)
  • SD-WAN Segmentation End to End (VPNs to campus VRFs/SGTs) (coming soon)
  • Upgrading Controllers and Edges (software lifecycle, compatibility) (coming soon)
  • Converting Feature Templates to Configuration Groups (Conversion Tool, 20.18.2) (coming soon)
  • EIGRP on the Service Side (and redistribution into OMP) (coming soon)
  • Multicast over Cisco SD-WAN (replicators, PIM on service side) (coming soon)
  • SD-Routing: Managing Non-SD-WAN Routers from Manager (coming soon)

Pillar 4: Policies, path selection and QoS

  • Centralized vs Localized Policy Explained (coming soon)
  • Policy Groups and the 20.x UI Policy Workflow (coming soon)
  • Hub-and-Spoke on 20.18: Classic Control Policy vs Topology Group (coming soon)
  • Regional Mesh and Partial Mesh Topologies (coming soon)
  • TLOC Preference and Path Selection via Control Policy (coming soon)
  • Centralized Data Policy: Steering and Blocking Traffic (coming soon)
  • Application-Aware Routing and SLA Classes on 20.18 (coming soon)
  • AAR vs Data Policy: Who Wins? (coming soon)
  • End-to-End QoS (forwarding classes, QoS map, rewrite) (coming soon)
  • Localized Data Policy: Policer and ACL (coming soon)
  • Per-Tunnel QoS and Adaptive QoS (coming soon)
  • SD-AVC and Application Recognition (NBAR) (coming soon)
  • Service Chaining to a Firewall (coming soon)
  • Policy Precedence and Order of Operations Cheat Sheet (coming soon)
  • AppQoE Explained: TCP Optimization, FEC, Packet Duplication, DRE (coming soon)

Pillar 5: Security and cloud

  • Direct Internet Access (DIA) with NAT (coming soon)
  • NAT DIA Tracker and Fallback (coming soon)
  • Zone-Based Firewall on the WAN Edge (coming soon)
  • UTD: IPS and URL Filtering (Snort container) (coming soon)
  • Umbrella / Cisco Secure Access (SSE) Integration via SIG Tunnels (coming soon)
  • Cloud OnRamp for SaaS Explained (coming soon)
  • Cloud OnRamp for Multicloud: AWS & Azure (coming soon)
  • Security Policy Order of Operations (DIA + ZBFW + UTD) (coming soon)
  • Hardening the Controllers (certs, ACLs, RBAC, TLS) (coming soon)
  • TrustSec/SGT Propagation over SD-WAN (coming soon)

Pillar 6: Troubleshooting casebook

  • Control Connections Down: The 10 Errors (CTORGNMMIS, CRTREJSER, BIDNTVRFD, DCONFAIL…) (coming soon)
  • Certificate Problems: Expired, Wrong Org, Serial Not in Allow List (coming soon)
  • BFD Sessions Down Between Sites (coming soon)
  • OMP Routes Missing or Not Installed (coming soon)
  • Template/Config Group Push Failed (coming soon)
  • App-Route Not Steering: Debugging AAR (coming soon)
  • Tunnels Stuck Behind NAT (symmetric NAT) (coming soon)
  • MTU, TCP-MSS and Fragmentation in the Overlay (coming soon)
  • Packet Trace and Simulate Flows from the Manager (coming soon)
  • Using Embedded Packet Capture and NWPI (coming soon)
  • Manager Cluster / Database Health Issues (coming soon)
  • Clock, DNS and Org-Name Gotchas at Onboarding (coming soon)
  • Cisco SD-WAN Show Commands Cheat Sheet (cEdge) (coming soon)
  • Monitoring: Manager dashboards, SNMP, syslog, ThousandEyes agent (coming soon)

Pillar 7: Automation

  • SD-WAN Manager REST API Basics (auth, token, first GET) (coming soon)
  • Python: Pull Device Inventory and BFD Health (coming soon)
  • Ansible for Catalyst SD-WAN (coming soon)
  • Terraform sdwan Provider: Config Groups as Code (coming soon)
  • Catalyst SD-WAN Python SDK (catalystwan) (coming soon)
  • Webhooks and Alarms to Slack/Zabbix (coming soon)
  • pyATS Tests for SD-WAN Edges (coming soon)
  • Backup/Restore and Config Diff via API (coming soon)

Pillar 8: Design, migration, comparisons and exams

  • Cisco SD-WAN Design Guide: Small, Medium, Large (coming soon)
  • Migrating DMVPN to Cisco SD-WAN (coexistence) (coming soon)
  • IWAN/MPLS Migration Patterns (coming soon)
  • Cisco SD-WAN vs DMVPN (coming soon)
  • Cisco SD-WAN vs Meraki SD-WAN (coming soon)
  • Cisco vs Fortinet SD-WAN (coming soon)
  • ENCOR 350-401 v1.2 Topic 1.2 (SD-WAN) Study Guide (coming soon)
  • 300-415 ENSDWI Exam Guide and Lab Plan (coming soon)
  • Cisco SD-WAN Interview Questions (50, with answers) (coming soon)
  • What's New in Catalyst SD-WAN 20.18 / 26.x (coming soon)
  • Cisco Catalyst SD-WAN vs Other Vendors (Fortinet, Palo Alto Prisma, VeloCloud, Versa) (coming soon)

SD-WAN builds on things covered elsewhere on PingLabz. If the overlay idea is new, the DMVPN series is a good warm-up, and the IPsec posts explain the encryption under the tunnels.

Share Share Share Share Share Email

Read next