I85PREP
⌘ K
ENAUTO 300-435 study materials
ENAUTO 300-435 study resources

ENAUTO 300-435: Cisco SD-WAN

ENAUTO 300-435 · Work through your exam, one topic at a time.

All guide sections

Cisco SD-WAN

Domain 5, Cisco SD-WAN, tests the vManage REST API, and vManage is called Cisco SD-WAN Manager from release 20.x even though the /dataservice API is unchanged, plus the architecture that makes it scriptable: controllers, templates, policy and statistics.

Architecture you must hold

vBond authenticates and orchestrates; vSmart runs OMP and distributes routes and policy; vManage is management and the API surface. Data planes are vEdge or cEdge routers. TLOCs are advertised over OMP, protected by IPsec, and validated by BFD across the underlay.

Authentication

There is no Basic auth. POST https://{vmanage}:8443/j_security_check with form fields j_username and j_password returns a JSESSIONID cookie that every later request must carry; state-changing calls also need X-XSRF-TOKEN, taken from the login response or the XSRF-TOKEN cookie. The API root is https://{vmanage}:8443/dataservice/. Self-signed certificates are normal on-premises, so scripts often disable verification, which is acceptable in a lab and never in production.

Common endpoint families

  • Inventory and health: /dataservice/device, /dataservice/device/monitor, /dataservice/device/counters.
  • Statistics: /dataservice/statistics/interface, /dataservice/statistics/tunnel.
  • Templates: /dataservice/template/feature, /dataservice/template/device, /dataservice/template/device/config/attachfeature or attachcli.
  • Policy: /dataservice/template/policy/vedge and /vsmart.
  • Configuration groups, 20.4 and later: /dataservice/config-group.

Paging

List calls return {"header": {...}, "data": [...]}. Pass page and pageSize and check header for the record count, because a default page size will hide devices from a naive loop.

Worked example

You need every unreachable device. Log in and keep the JSESSIONID; loop GET /dataservice/device?page={n}&pageSize=100, appending data until a page returns fewer than 100 records; filter on reachability or status not equal to reachable. Reasoning: an unpaged call may return only the first page, and treating that as the full inventory is the most common bug against this API. A 401 partway through the loop means the session expired, so re-run j_security_check and continue rather than failing the run.

Traps

  • Sending Basic auth to vManage.
  • Dropping the cookie or the XSRF token on later calls.
  • Putting a vBond or vSmart address in the URL instead of vManage.
  • Assuming one page is the whole inventory.
  • Using port 443 where the on-premises API listens on 8443.