Cisco ENSDWI 300-415 key terms

The centralized Cisco vManage software that provisions devices, pushes templates and policies, and collects statistics across the overlay. It holds the configuration intent but does not forward customer data traffic itself.

The logical, encrypted topology built on top of any transport, connecting SD-WAN routers through IPsec tunnels regardless of the underlying WAN link type. It carries the actual customer traffic between sites.

The physical or provider transport network-MPLS, internet, LTE-that carries the encrypted overlay tunnels. Its characteristics such as loss and latency directly influence path selection decisions.

Transport Locator. A unique identifier for a WAN interface on an SD-WAN router, composed of system IP, color, and encapsulation. It tells the control plane where a device can be reached per transport.

A label attached to a WAN interface that identifies the transport type, such as biz-internet, mpls, or lte. Policies and path selection reference colors rather than physical interfaces.

Overlay Management Protocol. The control-plane protocol that distributes routes, TLOC information, and policies between controllers and routers, forming the SD-WAN topology and enabling secure tunnel establishment.

The DTLS or TLS session an SD-WAN router maintains to the controllers for OMP exchange. It carries no data traffic but must be up for the router to receive routes and policy.

The IPsec tunnel between SD-WAN routers that actually forwards user traffic. It is brought up after OMP and BFD confirm reachability, and it encrypts all packets crossing the overlay.

An encrypted point-to-point connection between SD-WAN routers protecting overlay traffic. Cisco SD-WAN uses it for data forwarding and can also carry the control connections when configured that way.

Bidirectional Forwarding Detection. A lightweight hello protocol that measures liveness, latency, loss, and jitter on each tunnel, feeding the data used for application-aware routing and failover.

A named set of thresholds for latency, jitter, and loss that defines acceptable performance for a traffic category. Path selection compares live BFD measurements against the SLA class to choose a tunnel.

A policy mechanism that steers traffic onto the best tunnel per application by comparing real-time BFD metrics to an SLA class, with fallback actions when no path meets the threshold.

A reusable definition in vManage that generates device configuration. Feature templates define individual features, while device templates combine feature templates and attach them to devices.

A template describing settings for one feature, such as VPN, BGP, or security. It contains variables and is assembled into a device template for deployment to routers.

The top-level template that binds feature templates to a specific device or device group, resolving variables and producing the final configuration pushed to the router.

A template that delivers raw device configuration lines instead of structured feature templates. It offers flexibility for unsupported features but bypasses variable validation and structured modeling.

A placeholder in a template whose value is supplied per device or device group at attach time. Variables let one template serve many devices with different addresses and identifiers.

A logical grouping of devices that share variable values and template attachment. It simplifies scaling by applying one configuration intent to many routers at once.

A unique, loopback-style identifier assigned to every SD-WAN device. It anchors the control plane, appears in TLOC and OMP routes, and must be unique across the overlay.

A numeric identifier grouping devices that belong to the same physical location. It drives topology decisions such as hub-and-spoke versus full mesh and is used in policy matching.

The allowed connectivity pattern among sites, such as hub-and-spoke, partial mesh, or full mesh. It determines which routers can form data tunnels with each other.

A policy authored in vManage and distributed through OMP to many devices. It covers topology, traffic routing, and access control and is applied globally rather than per device.

A policy attached directly to specific devices or templates, such as a route policy or QoS map. It is not distributed by OMP and applies only where it is attached.

A centralized policy component that matches traffic by application, prefix, or site and directs it to preferred paths, including application-aware routing with SLA classes and fallback.

A centralized policy that classifies traffic and applies actions such as marking, queuing, policing, or dropping. It commonly enforces QoS and security treatment across the overlay.

A configuration defining forwarding classes and their bandwidth, queue, and drop behavior. It is referenced by localized or traffic data policy to shape how packets are treated.

A design where branch traffic exits locally to the internet instead of backhauling to a data center. It improves latency and bandwidth but requires local security enforcement.

Redirecting traffic through a service such as a firewall or IPS, either on-box or via a service node. It lets security be applied selectively within the overlay path.

An ordered sequence of service nodes that traffic traverses, defined by a centralized policy. It allows multiple security functions to be applied in a specific order.

A centralized policy that inspects or blocks traffic based on application, URL, or intrusion signatures. It enforces firewall, IPS, or URL filtering behavior across sites.

The trust anchor installed on controllers and routers to validate identities during control and data connection setup. It underpins the certificate-based authentication of the overlay.

A setting on a WAN interface that permits overlay services such as IPsec, BFD, and OMP to use that interface. Without it, the interface cannot participate in the overlay.

The default overlay encapsulation carrying a shim header for TLOC and VPN identification. It enables per-tenant segmentation and path metadata over any transport.

A logical partition on SD-WAN routers that separates traffic, similar to a VRF. Each segment has its own routing table and can be mapped to different policies.

The vManage dashboards and alarms showing device health, tunnel status, BFD metrics, and application performance. It is the first stop when diagnosing overlay problems.

The ordered method of checking control connections, OMP routes, BFD state, and data tunnels to isolate faults. It moves from control plane to data plane systematically.

The vManage-driven process of replacing device images, often staged by device group. It requires verifying compatibility and controller reachability before and after the change.

A tunnel built only when matching traffic appears, rather than kept permanently up. It reduces tunnel count and resource use in large topologies while preserving connectivity.