Skip to main content

SD-WAN - Components & Functions

1. Core SD-WAN Architecture Concepts

  • Role Separation: The Cisco Catalyst SD-WAN solution separates operational planes to build a highly scalable, secure, and efficient network fabric.

  • Virtualization of Routing: It is based on the same routing principles used on the global internet but virtualizes routing functions that previously required dedicated physical hardware.

  • Transport Independence: The strict separation between the control plane and the data plane allows the overlay network to run seamlessly over any physical transport circuit (such as MPLS, Internet/INET, or 4G).

  • Overlay Structure: The virtualized network runs as an overlay on cost-effective physical hardware or virtual machines (VMs).

2. The Architectural Planes & Components

The SD-Access fabric is structured into three distinct operational planes:

image.png

+--------------------------------------------------------------------------------+
|  MANAGEMENT & ORCHESTRATION PLANE                                              |
|  - SD-WAN Manager (Day 0/1/2, REST APIs) | SD-WAN Validator | SD-WAN Analytics |
+--------------------------------------------------------------------------------+
                                       |
                         (Secure DTLS Control Channel)
                                       v
+--------------------------------------------------------------------------------+
|  CONTROL PLANE                                                                 |
|  - SD-WAN Controllers (Overlay routing policies and rules)                     |
+--------------------------------------------------------------------------------+
                                       |
                         (Secure DTLS Control Channel)
                                       v
+--------------------------------------------------------------------------------+
|  DATA PLANE                                                                    |
|  - WAN Edge Routers (Cisco IOS XE / C8000V VM)                                 |
|  - Connected via Secure IPsec Data Channels                                    |
+--------------------------------------------------------------------------------+

A. Management and Orchestration Plane

Responsible for provisioning, configuration, network health observation, and onboarding.

  • SD-WAN Manager:

    • Acts as the single pane of glass for central monitoring, software installation, image upgrades, and provisioning.

    • Handles Day 0, Day 1, and Day 2 operations across all overlay devices.

    • Supports both single-device changes and bulk provisioning operations simultaneously.

    • Leverages REST APIs to facilitate third-party external automation and context sharing.

  • SD-WAN Validator:

    • Acts as the gatekeeper.

    • It automatically authenticates and authorizes all other SD-WAN devices when they attempt to join the overlay network fabric.

  • SD-WAN Analytics:

    • Provides deep monitoring, intelligence gathering, and historical data analysis for the overlay fabric.

B. Control Plane

Determines network paths and logical rules.

  • SD-WAN Controllers:

    • Centralized controller nodes that oversee and manage the control plane of the SD-WAN fabric.

    • They calculate and maintain the rules and policies for routing traffic through the overlay network.

    • Efficiently govern provisioning, maintenance, and fabric security.

C. Data Plane (Forwarding Plane)

Passes the actual data packets across the physical circuits based on rules defined by the control plane.

  • WAN Edge Routers:

    • The physical or virtual endpoints deployed across the enterprise topology, including Cloud, Data Center, Campus, Branch, and CoLo (Colocation) environments.

    • Can be physical routers running the Cisco IOS XE operating system.

    • Can be virtual machines running in the cloud, such as the Cisco Catalyst 8000V.

3. Study Guide: Security Channel Classifications

A critical area of SD-WAN engineering is the distinct protocols used to secure control traffic versus data traffic:

  • Secure DTLS Control Channel: Established between the centralized controllers (SD-WAN Controllers, SD-WAN Manager, SD-WAN Validator) and the WAN Edge Routers to safely exchange control plane routing instructions, authentication states, and configurations.

  • Secure IPsec Data Channel: Dynamically established directly between the WAN Edge Routers across the underlay transports to encrypt and protect user data traffic moving between sites.

4. Architectural Summary

Operational Plane Primary Component(s) Key Technical Role Secure Connection Type
Management & Orchestration

SD-WAN Manager

SD-WAN Validator

SD-WAN Analytics

Centralized Day 0/1/2 operations, bulk config upgrades, REST APIs, analytics.

Validator provides automatic node authentication upon join

 Secure DTLS Control Channel (to Edge Routers)
Control Plane SD-WAN Controllers Manages the overlay routing rules, topology configurations, and fabric path-selection policies Secure DTLS Control Channel (to Edge Routers)
Data Plane WAN Edge Routers (IOS XE physical hardware or virtual C8000V VMs)

Forwards raw user data packets across physical transports (MPLS, Internet, 4G).

Deployed at Branch, Campus, DC, Cloud, and CoLo nodes

 Secure IPsec Data Channel (inter-router
Back to top