Picture a company with 40 branch offices. Every branch has one MPLS circuit back to the data center, and that's the WAN. Ten years ago it worked fine, because the email server, the file shares and the ERP system all lived in the data center.
Now most of those apps are SaaS. A user in branch 27 opens Microsoft 365, and the packet goes over MPLS to the data center, through the firewall stack, out to the internet, and all the way back. The branch has a cheap internet connection sitting right there, and the traffic still takes the long way round.
That problem is why software-defined WAN (SD-WAN) exists. In this post I'll explain what SD-WAN is, using Cisco Catalyst SD-WAN 20.18 and IOS XE 17.18 as the reference platform. There's no CLI here yet. This is the "why" post for the Cisco SD-WAN series.
The old WAN: one private circuit per branch
MPLS (Multiprotocol Label Switching) is a private WAN service that a carrier sells you. You hand packets to the provider at each site, and they come out at the other sites. You get a service-level agreement (SLA) and the provider can honor your QoS markings end to end.
If you've built a hub-and-spoke WAN before, you know the design. The data center is the hub, the branches are spokes, and anything a branch needs comes from the hub, internet access included.
Cisco's own design guide describes the typical legacy WAN like this: multiple MPLS transports, or MPLS paired with internet or LTE used as active/backup, "most often with Internet or software-as-a-service (SaaS) traffic being backhauled to a central data center or regional hub for Internet access."
Where it hurts
Take our 40 branches. This is a made-up example to show the shape of the problem, not real numbers from a real company:
- Backhaul: Every Microsoft 365, Webex or Salesforce session from 40 branches lands on the data center internet link and its firewalls. The branch user gets the extra latency of the round trip, and the data center link carries traffic that never needed to go there.
- Idle links: A branch with MPLS plus a backup internet circuit only uses the internet link when MPLS fails. You pay for two pipes and use one.
- Slow change: Need a new QoS rule for voice at all 40 sites? That's 40 router logins, or a script that you wrote and you maintain.
- Slow new sites: A new private circuit usually takes longer to order and install than a business internet line.
Cisco's design guide lists the same pain points for legacy WANs: bandwidth costs, poor SaaS performance, complex operations, long deployment times and limited application visibility.
The idea: use every link, run it from one place
SD-WAN keeps your MPLS if you want it and adds internet links next to it. The routers build encrypted tunnels over all of them and treat the result as one WAN, called the overlay. The physical circuits underneath are the underlay.
If you've run DMVPN, you already know half of this. DMVPN builds an IPsec overlay over any transport, and spokes can reach each other directly. SD-WAN takes that idea and adds two things DMVPN never had: a central controller that hands out routes and policy, and a manager where you configure every router from one screen.
What changes for the 40 branches
Here's the same hypothetical company after the move, feature by feature.
Both links carry traffic
Each branch now has MPLS and broadband, and both are active. Cisco's design guide calls this "a mix of MPLS and low-cost broadband or any combination of transports in an active/active fashion."
Think of it like ECMP (equal-cost multipath) in routing, but each application can pick its own path.
The router picks the path per application
The routers measure each tunnel all the time. Cisco Catalyst SD-WAN runs BFD (Bidirectional Forwarding Detection) inside every tunnel, and those probes record loss, latency and jitter. Application-aware routing compares those numbers with a rule you write.
Example: you write one policy that says voice needs latency under 150 ms. If the broadband path at branch 12 gets worse than that, voice for that branch moves to MPLS, and other traffic can stay on broadband. The 150 ms is my example value; you choose the threshold.
SaaS goes straight out locally
Direct internet access (DIA) lets a branch send internet-bound traffic out of its own internet link, instead of through the data center. Cisco's design guide describes DIA as allowing internet traffic from a VPN, all of it or a subset, "to locally exit the remote site."
That Microsoft 365 session from branch 27 now goes out of branch 27. The security checks move to the branch router or to a cloud security service.
One change, all sites
You make a change once in SD-WAN Manager (formerly vManage) and push it to every router that needs it. That QoS rule for voice is one change for all 40 branches, not 40 logins.
The parts of Cisco Catalyst SD-WAN
Cisco splits the job into four planes, each with its own component. One line each for now; the components post covers them in depth.
- SD-WAN Manager (management plane): the GUI and API where you configure and monitor everything. Think of it as your NMS that can also push config.
- SD-WAN Controller (control plane): hands out routes, keys and policy over OMP (Overlay Management Protocol). Cisco compares it to a BGP route reflector.
- SD-WAN Validator (orchestration plane): the first thing a new router talks to. It checks the router's identity, tells it where the Manager and Controllers are, and helps routers behind NAT find each other.
- WAN Edge routers (data plane): the hardware or virtual routers at each site that forward the actual traffic.
If the names vManage, vSmart and vBond are what you learned, they're the same three boxes. I mapped every old name to the new one in vManage, vSmart, vBond Are Now Manager, Controller, Validator.
What SD-WAN does not fix
SD-WAN doesn't make a bad internet circuit good. It can only choose the least bad path you give it, so a branch with two links on the same street cable can still lose both.
It also adds new things to run: the controllers, their certificates and a new policy model. The troubleshooting pillar of this series exists because those parts break in their own ways.
Next steps
Read the vManage, vSmart, vBond name map next if you learned the old names. After that, the series moves on to the components, OMP, TLOCs and VPNs, then into a Catalyst SD-WAN 20.18 lab built in my home lab. The full list is on the Cisco SD-WAN Explained page.