T Techclick ← All lessons
Cisco · Catalyst SD-WAN · Viptela · Interactive lesson

Four planes, one join sequence — Viptela SD-WAN

The branch Edge is up. MPLS and Internet are both green. Still no overlay. This page is the model you draw before you type a command: four planes, the Day-0 join, then the three errors that stop it.

18 min read · L2 primary · Quiz at end

After this page you can

1. Why the old WAN broke

Ticket: Pune branch cannot reach SAP in Mumbai. Internet and MPLS both ping. No IPsec overlay. Manager shows the router as not connected.

Classic WAN backhauled SaaS and internet through the data center. Bandwidth was expensive, change windows were long, and a backup circuit sat idle. SD-WAN keeps the same underlay circuits and adds a software overlay that can use every transport in active/active mode.

Cisco bought Viptela. The product is now Cisco Catalyst SD-WAN. Interviews still say Viptela. Draw both names, then forget the argument.

Hero · underlay plus overlay
Branch WAN rack with MPLS and Internet circuits rising to four control nodes
Notice: two underlay circuits, one overlay decision layer. The Edge forwards. The controllers decide.
Quick answer

vBond (Validator) introduces the Edge. vManage (Manager) configures and monitors it. vSmart (Controller) reflects OMP routes, TLOCs, and policy. The WAN Edge encrypts and forwards. Control is DTLS/TLS. Data is IPsec plus BFD.

2. Four planes — old name and new name

Cisco rebranded the controllers. The planes did not change. If you only remember one table from this lesson, remember this one.

Feel · four stacked jobs
Four stacked glass platforms for orchestrate, manage, control, and forward
Each plane has one job. Mixing them is how students fail ENSDWI and first-day tickets.
PlaneOld Viptela nameCatalyst nameWhat it actually does
OrchestrationvBondSD-WAN ValidatorFirst authentication. Hands out Manager and Controller reachability. Helps NAT discovery. Always DTLS.
ManagementvManageSD-WAN ManagerGUI and API. Templates, certificates, monitoring, Day 0–2. One permanent control connection from each Edge, over one transport.
ControlvSmartSD-WAN ControllerOMP route reflector. Distributes prefixes, TLOCs, keys, and centralized policy. Never forwards user packets.
DatavEdge / cEdgeWAN EdgeIPsec/GRE tunnels, BFD, QoS, BGP/OSPF on the service side, security features on IOS XE.

Together, Manager + Controller + Validator are the control components. The Edge is not a controller.

Figure 1 · four planes
Orchestration Validator vBond · DTLS 12346 Introduce + NAT Management Manager vManage · GUI / NETCONF 1 transport only Control Controller vSmart · OMP Routes · TLOC · policy Data WAN Edge vEdge / cEdge IPsec + BFD Identity that must match across the overlay Organization name Case-sensitive OU Mismatch = CTORGNMMIS Site-ID Same site = one place No intra-site IPsec System-IP Router ID, not underlay OMP peer identity TLOC system-IP + color + ipsec or gre

Read left to right. Validator introduces. Manager owns config. Controller owns topology. Edge forwards.

Say this out loud

Validator is the airport information desk. Manager is the operations office. Controller is air-traffic control. The Edge is the aircraft. Planes do not swap jobs.

VPN 0

Transport VPN. WAN interfaces and DTLS/TLS live here. Needs a default or static so the Edge can reach the Validator.

VPN 512

Out-of-band management. OMP ignores it. It is not carried across the overlay.

Service VPNs

User LAN. Recommended 1–511. On IOS XE these become numbered VRFs. Do not put LAN in VPN 0.

vEdge vs cEdge

vEdge = Viptela OS (EOS/EOL: 20.6 last for 100/1000, 20.9 last for 2000/5000/Cloud). New designs use IOS XE WAN Edge (cEdge).

3. Bring-up flow

Controllers come up first. Manager and Controller form persistent DTLS to every Validator, then a permanent DTLS or TLS session to each other. Only after that does an Edge have someone to join.

The Edge never stays married to the Validator in a healthy overlay. Validator is the introduction. Manager and Controller are the marriage.

Journey · four join beats
Four glass panels: discover, authenticate, learn controllers, stay connected
Discover Validator → authenticate → learn Manager and Controller → keep those, drop Validator.
Figure 2 · WAN Edge join sequence
1. Reach Validator DTLS UDP 12346 2. Authenticate Cert + serial list 3. Learn list Manager + Controller 4. Permanent control Manager ×1 · Controller × transports 5. Drop the Validator session (unless the Edge is out of equilibrium) Then NETCONF from Manager + one OMP session per Controller (system-IP) Healthy after join • 0 standing Validator sessions • 1 Manager over first-up transport • Controller per transport (typically 2) • OMP up · TLOCs advertised • BFD up on each TLOC pair Out of equilibrium Missing Manager, or missing a Controller / OMP session. Edge keeps a permanent Validator session until the count is right. That is a symptom, not the design.

Source: Cisco Catalyst SD-WAN Design Guide — WAN Edge control connections.

Pre-train these words

DTLS / TLS — control channel. Validator is always DTLS. Manager and Controller default to DTLS; TLS (TCP) can be configured and wins if one side asks for it.

OMP — Overlay Management Protocol. BGP-like. Carries prefixes, TLOCs, keys, and policy. One session per Controller, keyed by system-IP.

TLOC — Transport Locator. Three-tuple: system-IP + color + encapsulation. Color cannot repeat on one Edge.

BFD — runs on every data-plane tunnel. Measures loss, latency, jitter. Control up + BFD down is a data-plane ticket, not a bring-up ticket.

4. How to choose the onboard method

All three methods end at the same Validator. They differ in how the Edge learns that Validator’s address.

MethodUse whenFirst contactDo not mix
Manual / CLI bootstrapLab, brownfield, or no cloud reachabilityYou type vbond, org, site-id, system-ip, VPN 0 tunnelLeaving organization-name different from controllers
ZTPvEdge / Viptela OS factory defaultResolves ztp.viptela.com, then is pointed at your ValidatorUsing this URL on IOS XE
PnPIOS XE WAN Edge (cEdge)Resolves devicehelper.cisco.com via Cisco Plug and Play ConnectUsing the vEdge ZTP hostname

Authorized serial list states, from the Design Guide:

5. Runbook — Side A / B / C

Lab values on this page are dummy: org Techclick-Lab, site-id 100, system-ip 10.1.10.1, Validator 203.0.113.10 / vbond.lab.example.com. Confirm live syntax on your release before you type on a real box.

Side A — Edge (IOS XE / cEdge)

Source: Cisco TAC 214509 — system block, VPN 0 tunnel, certificate, clock.

  1. Confirm identity and clock

    Wrong clock breaks cert validation (CRTVERFL). Organization name is case-sensitive and must match every controller.

    cEdge · dummy lab
    show clock
show sdwan control local-properties | include organization-name|site-id|system-ip|certificate|dns-name|chassis-num|serial-num

  2. System block must exist

    Required fields (concept — verify syntax on your IOS XE train)
    system
 system-ip             10.1.10.1
 site-id               100
 organization-name     Techclick-Lab
 vbond                 vbond.lab.example.com

  3. VPN 0 transport with tunnel

    No tunnel option on the WAN interface = no control. Need a route in VPN 0 toward the Validator.

  4. Reach Validator, then watch history

    Proof commands
    ping vrf 0 203.0.113.10
show sdwan control connections
show sdwan control connections-history
show sdwan control local-properties
Common lab mistake

On vEdge the command is show control connections. On IOS XE insert sdwan: show sdwan control connections. Same output idea. Wrong keyword looks like the feature is missing.

Side B — Manager (certificates and list)

Source: Design Guide authorized-list model + TAC 214509 Configuration → Certificates → Send to Controllers.

https://manager.lab.example.com — Configuration → Certificates
Training mock · not live

Configuration → Certificates → WAN Edge list

WAN Edge authorized serials

Chassis / unique-idSerialStateHostname
C8000V-9AB12C016E9A10Validpune-br1
C8000V-9AB12D016E9A11Staginglab-spare
ISR4331-FGL0001016E9A12Invalid—

List lives on Manager, then must be pushed. Send to Controllers or the Validator still rejects the chassis (BIDNTVRFD).

  1. Get the serial onto the overlay

    Plug and Play Connect at software.cisco.com (signed list) or a CSV from 20.3.1 onward. Sync or upload into Manager.

  2. Set Valid (or Staging first)

    If you imported without “validate devices”, everything starts Invalid. Invalid = no control. Staging = control only, no OMP payload.

  3. Send to Controllers

    Until this push, Validator does not trust the chassis. Confirm later with show orchestrator valid-vedges on the Validator.

  4. Attach a device template

    Missing template shows NOVMCFG toward Manager. Control may still reach Validator/Controller while Manager tears down.

https://manager.lab.example.com — Configuration → Devices
Training mock · not live

Configuration → Devices → WAN Edge

pune-br1 · site 100

PeerColorProtocolState
Manager 10.0.1.1biz-internetdtlsup
Controller 10.0.1.5biz-internetdtlsup
Controller 10.0.1.5mplsdtlsup
Validator—dtlstransient / gone

Healthy Edge: Manager on one color, Controller on each color, Validator not sitting there forever.

Side C — Sync / prove

Source: Design Guide control-connection summary + TAC 214509 history codes.

  1. Control table is green

    Expect
    show sdwan control connections
! peer-type vmanage  — one row, state up
! peer-type vsmart   — one row per transport (often two)
! peer-type vbond    — absent, or only if out of equilibrium

  2. OMP and TLOCs

    Next
    show sdwan omp peers
show sdwan omp tlocs advertised
show sdwan bfd sessions

  3. If history is ugly, decode the code

    Do not rebuild IPsec first. Read LOCAL ERROR on show sdwan control connections-history.

6. After join — control vs data

Bring-up success is control-plane success. Users still fail if BFD never comes up. Separate the two tickets.

Figure 3 · runtime path after a healthy join
Pune Edge site 100 Controller OMP Manager NETCONF Mumbai Edge site 10 CONTROL · DTLS/TLS · orange DATA · IPsec AES-256-GCM + BFD per TLOC · cyan/navy If users are down, ask which plane first No Manager / Controller rows → bring-up / firewall / serial / org-name Control up, BFD down → TLOC not advertised, NAT, or data-plane ACL

User packets never hairpin through vSmart. Controller only reflects. Edge-to-Edge is the data plane.

Firewall ports (from the Design Guide)

Validator listens on UDP 12346. Manager and Controller cores use 12346, then 12446, 12546… TLS uses TCP (commonly 23456 on the controller side). If large UDP is dropped, you get DCONFAIL even when ping works.

7. Traps and proof

Ops · prove it, then close the ticket
Operations desk with a monitor showing green health checkmarks
Green ping is not proof. Control table + OMP + BFD is proof.
Symptom / codeFirst meaningFirst fix
DCONFAILDTLS never completes. Firewall, no default in VPN 0, DTLS port closed, large UDP dropped.Ping next hop and Validator. Open UDP 12346. Capture if small packets pass and large ones die.
CTORGNMMISOrganization name does not match.Compare organization-name on Edge vs controllers. Case matters.
BIDNTVRFD / CRTREJSERChassis or serial not on the authorized list, or list not pushed.PnP/CSV → Manager → Valid → Send to Controllers. Check show orchestrator valid-vedges.
CRTVERFLCertificate cannot be validated.Fix clock. Reinstall root chain. Confirm cert validity window.
NOVMCFGNo device template in Manager.Attach a template. Do not chase IPsec.
DISTLOCTLOC disabled after a color, system-IP, or clear-control change.Expected after those changes. Wait for rebuild. Do not treat as a new serial problem.
Control up, BFD downJoin worked. Data plane did not.show sdwan omp tlocs advertised then BFD. Different ticket from bring-up.
Pilot checklist
Interview trap

Students say “vBond is the brain.” No. Controller (vSmart) is the brain. Validator is the introducer. Manager is the pane of glass. If you say vBond reflects OMP routes, you fail the oral.

Knowledge check

Six judgment items. Same ticket you opened with: branch up, overlay missing.

Q1

A new Edge must learn where Manager and Controller live. Which plane does that introduction?

Correct: b. Re-read Four planes. Validator is first contact. Manager is not the introducer.
Q2

After a healthy join, show sdwan control connections still shows a permanent Validator row. What does that mean?

Correct: a. Re-read Bring-up flow. Validator is transient unless the Edge cannot hold the required control count.
Q3

History shows CTORGNMMIS. What do you check first?

Correct: c. Re-read Traps. Org-name is an overlay-wide identity, not a routing knob.
Q4

Two WAN Edges at the same branch share site-id 100. Why is there no IPsec tunnel between them?

Correct: b. Re-read Four planes / Site-ID. Same site is one place. Use TLOC-extension or a LAN protocol on-site, not a surprise overlay tunnel.
Q5

A spare router is set to Staging on the WAN Edge list. Control is up. Users still have no prefixes. Why?

Correct: d. Re-read How to choose. Staging is a deliberate half-join for testing.
Q6

Manager and Controller rows are up. BFD to the data center is down. What is the first move?

Correct: b. Re-read After join. Control up means bring-up worked. BFD is a different plane.

Sources

Related: Fundamentals (older page) · Controllers · WAN Edge onboarding · OMP · TLOCs · VPN segmentation

Cisco SD-WAN series: this lesson is the gold four-plane + join map. Use the older Blogforge pages for extra drills, then come back here when a ticket is on fire.