I85PREP
⌘ K
Cisco ENSDWI 300-415 study materials
Cisco ENSDWI 300-415 study resources

Cisco ENSDWI 300-415: SD-WAN Architecture and Controller Deployment

Cisco ENSDWI 300-415 · Work through your exam, one topic at a time.

All guide sections

SD-WAN Architecture and Controller Deployment

SD-WAN Architecture and Controller Deployment

This domain tests whether you can place each controller in the right plane, describe how a WAN Edge joins the fabric, and choose a redundant on-premises or cloud-hosted deployment.

Planes and roles

  • vManage - management plane: GUI, templates, policy authoring, monitoring, upgrades. It reaches devices over NETCONF/SSH and is never in the forwarding path.
  • vSmart - control plane: runs OMP, receives TLOCs and routes from WAN Edges, applies centralized policy, reflects best paths. It carries no user traffic.
  • vBond - orchestration plane: authenticates WAN Edges and controllers, answers the first connection, assists NAT traversal, and redirects devices to vSmart and vManage.
  • WAN Edges - build IPsec data tunnels to each other and run BFD over them for liveness and SLA measurement.

Bring-up sequence

  1. The edge boots with system-ip, site-id, organization name and a vBond address (bootstrap CLI, DHCP option 43, or PnP).
  2. It opens a DTLS connection to vBond on UDP 12346 and presents its certificate.
  3. vBond validates the chain and the device's entry in the allowed list, then returns vSmart and vManage addresses.
  4. The edge builds DTLS control connections to vSmart and vManage on 12346; the OMP session to vSmart comes up and TLOCs are advertised.
  5. vManage pushes templates over NETCONF (TCP 830); IPsec and BFD come up between edges.

Certificates and redundancy

All controllers and edges must chain to a common root - Cisco's PKI for cloud-hosted controllers, or the enterprise root (SCEP or manual) on-premises. vBond does not sign certificates. Deploy vManage as a three-node cluster, multiple vSmarts (every edge connects to all of them), and at least two vBonds.

Worked example

A branch edge sits behind a home router doing NAT, so its DTLS source port and address are rewritten and its TLOC would be wrong. vBond records the NAT-translated address and port of the control connection, and that public TLOC is what peers receive through OMP; IPsec is then built to the translated address. This is why vBond must stay reachable and why NAT needs no static one-to-one mapping.

Traps

  • Believing vSmart or vManage forwards packets - only edges do.
  • Forgetting that the vBond connection persists after boot and appears in show control connections.
  • Mixing certificate roots, which leaves control connections stuck in DTLS handshake.
  • Assuming a vManage outage stops traffic; existing tunnels keep forwarding.