Skip to main content

SD-WAN - Orchestration Plane

image.png

The orchestration plane is responsible for zero-touch deployment and security validation during deployment. It has the following characteristics:

  • Performs initial authentication
  • Orchestrates the connectivity between the management, control, and data plane
  • Requires a public IP address or 1:1 Network Address Translation (NAT)
  • Facilitates NAT traversal
  • Authorizes all control connections (allow list model)
  • Distributes a list of Cisco vSmart controllers to all Cisco WAN Edge routers

The SD-WAN Validator is a multitenant (explained later) element of the Cisco Catalyst SD-WAN fabric: 

  • First point of contact, performs initial authentication when devices are connecting to the organization overlay.
  • Facilitates mutual discovery of the control and mgmt. elements of the fabric using a zero-trust cert-based allowed-list model.
  • Automatically distributes a list of SD-WAN Controllers and the SD-WAN Manager to the WAN Edge routers during the deployment process.
  • When SD-WAN Controllers, Manager, or WAN Edge routers are behind NAT, the Validator facilitates the funciton of NAT traversal by allowing the learning of public (post-NAT) and private (pre-NAT) IP addresses. This discovery allows connectivity to be established across public (internet, 4G) and private (MPLS, PPP) WAN transports.
  • The Validator itself should reside in the public IP space or on the private space with 1:1 NAT so that all remote (especially internet-only) sites can reach it. When tied to the DNS, this reachable Validator IP address allows zero-touch deployment.
  • The Validator should be highly resilient. If it's down, no other device can join the overlay. When deployed as an on-premises solution by the customer, it is the responsibility of the customer to provide adequate infrastructure resiliency.

Multitenant: this means that a single physical or virtual SD-WAN Validator (historically called vBond) can be configured in two distinct deployment ways:

  • Single Tenant (Dedicated) Mode: The Validator is dedicated to a single enterprise, verifying and authenticating devices that belong exclusively to that one organization.

  • Multitenant Mode: Commonly used by Managed Service Providers (MSPs), a single shared Validator serves multiple completely separate customers (tenants) simultaneously. It securely authenticates, validates, and redirects WAN Edge devices from different tenants while maintaining strict logical isolation between their control data, eliminating the need to deploy dedicated orchestrator hardware for every individual customer.

Back to top