Citrix SD-WAN Architecture and Deployment
This domain tests how Citrix SD-WAN is structured: master control nodes, client nodes, virtual WANs, virtual paths, and the difference between Standard and Enterprise editions. Expect design questions about site roles, link counts, and where orchestration and reporting live.
Platform and roles
- The MCN (Master Control Node) is typically in the data center and distributes configuration to client nodes at branches. Client nodes can be appliances or VPX instances.
- Standard edition provides core SD-WAN routing, link selection, and QoS; Enterprise edition adds WAN optimization and advanced security features depending on release.
- SD-WAN Center provides reporting and visibility; it is separate from the MCN's configuration role. Orchestrator can centralize management across deployments.
Virtual WAN and virtual paths
- A virtual WAN groups sites and defines the overlay. Each WAN link at a site is an interface with bandwidth, ISP, and cost attributes.
- A virtual path is a combination of a local link and a remote link. Two links at a branch and two at the MCN produce four virtual paths, each with its own latency, loss, and jitter measurements.
- Path selection uses those measurements plus policy; the overlay carries traffic over IPSec or the selected secure transport.
Deployment practice
- Define sites, zones, and link groups before policies. Zero-touch provisioning depends on correct serial and license records.
- Plan management VLANs, HA cabling, and out-of-band access before cutover. Validate MTU because overlay encapsulation reduces usable payload.
Worked example
Three branches each have two ISP links; the MCN has two links. Branch A has 2 x 2 = 4 virtual paths to the MCN, and the same for B and C, for 12 measured paths in total. If the design requires per-application path preference, you need policy based on those paths, not merely link failover. Reasoning: virtual paths are pairwise, so link count multiplies; a common mistake is to size for six links rather than twelve paths.
Traps that cost marks
- Treating virtual paths as links; the pairwise count changes failover and policy design.
- Confusing SD-WAN Center reporting with MCN configuration.
- Forgetting that Enterprise features such as WAN optimization require the correct edition and license.
- Ignoring MTU and fragmentation after overlay encapsulation.
- Deploying HA without planning failover links and switch independence.