# Four planes, one join sequence — Viptela SD-WAN Source: https://ai.techclick.in/blog_cisco_viptela_sdwan_four_planes Markdown: https://ai.techclick.in/blog_cisco_viptela_sdwan_four_planes.md Publisher: Techclick Infosec Pvt Ltd Viptela / Cisco Catalyst SD-WAN four planes and Day-0 bring-up: Validator, Manager, Controller, WAN Edge. Map old names, walk the join, prove control connections, fix CTORGNMMIS and DCONFAIL. ## 1. Why the old WAN broke Ticket: Pune branch cannot reach SAP in Mumbai. Internet and MPLS both ping. No IPsec overlay. Manager shows the router as not connected. Classic WAN backhauled SaaS and internet through the data center. Bandwidth was expensive, change windows were long, and a backup circuit sat idle. SD-WAN keeps the same underlay circuits and adds a software overlay that can use every transport in active/active mode. Cisco bought Viptela. The product is now Cisco Catalyst SD-WAN . Interviews still say Viptela. Draw both names, then forget the argument. Hero · underlay plus overlay Notice: two underlay circuits, one overlay decision layer. The Edge forwards. The controllers decide. Quick answer vBond (Validator) introduces the Edge. vManage (Manager) configures and monitors it. vSmart (Controller) reflects OMP routes, TLOCs, and policy. The WAN Edge encrypts and forwards. Control is DTLS/TLS. Data is IPsec plus BFD. ## 2. Four planes — old name and new name Cisco rebranded the controllers. The planes did not change. If you only remember one table from this lesson, remember this one. Feel · four stacked jobs Each plane has one job. Mixing them is how students fail ENSDWI and first-day tickets. Plane Old Viptela name Catalyst name What it actually does Orchestration vBond SD-WAN Validator First authentication. Hands out Manager and Controller reachability. Helps NAT discovery. Always DTLS. Management vManage SD-WAN Manager GUI and API. Templates, certificates, monitoring, Day 0–2. One permanent control connection from each Edge, over one transport. Control vSmart SD-WAN Controller OMP route reflector. Distributes prefixes, TLOCs, keys, and centralized policy. Never forwards user packets. Data vEdge / cEdge WAN Edge IPsec/GRE tunnels, BFD, QoS, BGP/OSPF on the service side, security features on IOS XE. Together, Manager + Controller + Validator are the control components . The Edge is not a controller. Figure 1 · four planes Cisco Catalyst SD-WAN four planes - Orchestration Validator vBond · DTLS 12346 Introduce + NAT Management Manager vManage · GUI / NETCONF 1 transport only Control Controller vSmart · OMP Routes · TLOC · policy Data WAN Edge vEdge / cEdge IPsec + BFD Identity that must match across the overlay Organization name Case-sensitive OU Mismatch = CTORGNMMIS Site-ID Same site = one place No intra-site IPsec System-IP Router ID, not underlay OMP peer identity TLOC system-IP + color + ipsec or gre Read left to right. Validator introduces. Manager owns config. Controller owns topology. Edge forwards. Say this out loud Validator is the airport information desk. Manager is the operations office. Controller is air-traffic control. The Edge is the aircraft. Planes do not swap jobs. #### VPN 0 Transport VPN. WAN interfaces and DTLS/TLS live here. Needs a default or static so the Edge can reach the Validator. #### VPN 512 Out-of-band management. OMP ignores it. It is not carried across the overlay. #### Service VPNs User LAN. Recommended 1–511. On IOS XE these become numbered VRFs. Do not put LAN in VPN 0. #### vEdge vs cEdge vEdge = Viptela OS (EOS/EOL: 20.6 last for 100/1000, 20.9 last for 2000/5000/Cloud). New designs use IOS XE WAN Edge (cEdge). ## 3. Bring-up flow Controllers come up first. Manager and Controller form persistent DTLS to every Validator, then a permanent DTLS or TLS session to each other. Only after that does an Edge have someone to join. The Edge never stays married to the Validator in a healthy overlay. Validator is the introduction. Manager and Controller are the marriage. Journey · four join beats Discover Validator → authenticate → learn Manager and Controller → keep those, drop Validator. Figure 2 · WAN Edge join sequence WAN Edge Day-0 bring-up sequence 1. Reach Validator DTLS UDP 12346 2. Authenticate Cert + serial list 3. Learn list Manager + Controller 4. Permanent control Manager ×1 · Controller × transports 5. Drop the Validator session (unless the Edge is out of equilibrium) Then NETCONF from Manager + one OMP session per Controller (system-IP) Healthy after join • 0 standing Validator sessions • 1 Manager over first-up transport • Controller per transport (typically 2) • OMP up · TLOCs advertised • BFD up on each TLOC pair Out of equilibrium Missing Manager, or missing a Controller / OMP session. Edge keeps a permanent Validator session until the count is right. That is a symptom, not the design. Source: Cisco Catalyst SD-WAN Design Guide — WAN Edge control connections. Pre-train these words DTLS / TLS — control channel. Validator is always DTLS. Manager and Controller default to DTLS; TLS (TCP) can be configured and wins if one side asks for it. OMP — Overlay Management Protocol. BGP-like. Carries prefixes, TLOCs, keys, and policy. One session per Controller, keyed by system-IP. TLOC — Transport Locator. Three-tuple: system-IP + color + encapsulation. Color cannot repeat on one Edge. BFD — runs on every data-plane tunnel. Measures loss, latency, jitter. Control up + BFD down is a data-plane ticket, not a bring-up ticket. ## 4. How to choose the onboard method All three methods end at the same Validator. They differ in how the Edge learns that Validator’s address. Method Use when First contact Do not mix Manual / CLI bootstrap Lab, brownfield, or no cloud reachability You type vbond , org, site-id, system-ip, VPN 0 tunnel Leaving organization-name different from controllers ZTP vEdge / Viptela OS factory default Resolves ztp.viptela.com , then is pointed at your Validator Using this URL on IOS XE PnP IOS XE WAN Edge (cEdge) Resolves devicehelper.cisco.com via Cisco Plug and Play Connect Using the vEdge ZTP hostname Authorized serial list states, from the Design Guide: Valid — full member. Control + OMP + data. - Invalid — no control connections. - Staging — control forms, but OMP sends no routes, no data policy, no TLOCs. Traffic does not forward. Use this to test a box before production. ## 5. Runbook — Side A / B / C Lab values on this page are dummy: org Techclick-Lab , site-id 100 , system-ip 10.1.10.1 , Validator 203.0.113.10 / vbond.lab.example.com . Confirm live syntax on your release before you type on a real box. ### Side A — Edge (IOS XE / cEdge) Source: Cisco TAC 214509 — system block, VPN 0 tunnel, certificate, clock. - #### Confirm identity and clock Wrong clock breaks cert validation ( CRTVERFL ). Organization name is case-sensitive and must match every controller. cEdge · dummy lab show clock show sdwan control local-properties | include organization-name|site-id|system-ip|certificate|dns-name|chassis-num|serial-num - #### System block must exist Required fields (concept — verify syntax on your IOS XE train) system system-ip 10.1.10.1 site-id 100 organization-name Techclick-Lab vbond vbond.lab.example.com - #### VPN 0 transport with tunnel No tunnel option on the WAN interface = no control. Need a route in VPN 0 toward the Validator. - #### Reach Validator, then watch history Proof commands ping vrf 0 203.0.113.10 show sdwan control connections show sdwan control connections-history show sdwan control local-properties Common lab mistake On vEdge the command is show control connections . On IOS XE insert sdwan : show sdwan control connections . Same output idea. Wrong keyword looks like the feature is missing. ### Side B — Manager (certificates and list) Source: Design Guide authorized-list model + TAC 214509 Configuration → Certificates → Send to Controllers . https://manager.lab.example.com — Configuration → Certificates Training mock · not live Configuration → Certificates → WAN Edge list ### WAN Edge authorized serials Chassis / unique-id Serial State Hostname C8000V-9AB12C 016E9A10 Valid pune-br1 C8000V-9AB12D 016E9A11 Staging lab-spare ISR4331-FGL0001 016E9A12 Invalid — Sync from PnP Send to Controllers List lives on Manager, then must be pushed. Send to Controllers or the Validator still rejects the chassis ( BIDNTVRFD ). - #### Get the serial onto the overlay Plug and Play Connect at software.cisco.com (signed list) or a CSV from 20.3.1 onward. Sync or upload into Manager. - #### Set Valid (or Staging first) If you imported without “validate devices”, everything starts Invalid . Invalid = no control. Staging = control only, no OMP payload. - #### Send to Controllers Until this push, Validator does not trust the chassis. Confirm later with show orchestrator valid-vedges on the Validator. - #### Attach a device template Missing template shows NOVMCFG toward Manager. Control may still reach Validator/Controller while Manager tears down. https://manager.lab.example.com — Configuration → Devices Training mock · not live Configuration → Devices → WAN Edge ### pune-br1 · site 100 Peer Color Protocol State Manager 10.0.1.1 biz-internet dtls up Controller 10.0.1.5 biz-internet dtls up Controller 10.0.1.5 mpls dtls up Validator — dtls transient / gone Healthy Edge: Manager on one color, Controller on each color, Validator not sitting there forever. ### Side C — Sync / prove Source: Design Guide control-connection summary + TAC 214509 history codes. - #### Control table is green Expect show sdwan control connections ! peer-type vmanage — one row, state up ! peer-type vsmart — one row per transport (often two) ! peer-type vbond — absent, or only if out of equilibrium - #### OMP and TLOCs Next show sdwan omp peers show sdwan omp tlocs advertised show sdwan bfd sessions - #### If history is ugly, decode the code Do not rebuild IPsec first. Read LOCAL ERROR on show sdwan control connections-history . ## 6. After join — control vs data Bring-up success is control-plane success. Users still fail if BFD never comes up. Separate the two tickets. Figure 3 · runtime path after a healthy join Control plane versus data plane after join Pune Edge site 100 Controller OMP Manager NETCONF Mumbai Edge site 10 - CONTROL · DTLS/TLS · orange DATA · IPsec AES-256-GCM + BFD per TLOC · cyan/navy If users are down, ask which plane first No Manager / Controller rows → bring-up / firewall / serial / org-name Control up, BFD down → TLOC not advertised, NAT, or data-plane ACL User packets never hairpin through vSmart. Controller only reflects. Edge-to-Edge is the data plane. Firewall ports (from the Design Guide) Validator listens on UDP 12346 . Manager and Controller cores use 12346, then 12446, 12546… TLS uses TCP (commonly 23456 on the controller side). If large UDP is dropped, you get DCONFAIL even when ping works. ## 7. Traps and proof Ops · prove it, then close the ticket Green ping is not proof. Control table + OMP + BFD is proof. Symptom / code First meaning First fix DCONFAIL DTLS never completes. Firewall, no default in VPN 0, DTLS port closed, large UDP dropped. Ping next hop and Validator. Open UDP 12346. Capture if small packets pass and large ones die. CTORGNMMIS Organization name does not match. Compare organization-name on Edge vs controllers. Case matters. BIDNTVRFD / CRTREJSER Chassis or serial not on the authorized list, or list not pushed. PnP/CSV → Manager → Valid → Send to Controllers . Check show orchestrator valid-vedges . CRTVERFL Certificate cannot be validated. Fix clock. Reinstall root chain. Confirm cert validity window. NOVMCFG No device template in Manager. Attach a template. Do not chase IPsec. DISTLOC TLOC disabled after a color, system-IP, or clear-control change. Expected after those changes. Wait for rebuild. Do not treat as a new serial problem. Control up, BFD down Join worked. Data plane did not. show sdwan omp tlocs advertised then BFD. Different ticket from bring-up. Pilot checklist Org-name, site-id, system-ip, vBond identical in intent across the overlay. - WAN Edge list = Valid (or Staging on purpose) and sent to controllers. - show sdwan control local-properties shows certificate Installed / Valid and the WAN color up. - Control table: Manager ×1, Controller × transports, Validator gone. - OMP peers up. TLOCs advertised. BFD up per TLOC pair. - Same site-id on two Edges? Do not expect an IPsec tunnel between them. Interview trap Students say “vBond is the brain.” No. Controller (vSmart) is the brain. Validator is the introducer. Manager is the pane of glass. If you say vBond reflects OMP routes, you fail the oral. ## Knowledge check Six judgment items. Same ticket you opened with: branch up, overlay missing. Q1 A new Edge must learn where Manager and Controller live. Which plane does that introduction? Control plane — vSmart reflects the first TLOC Orchestration plane — Validator (vBond) authenticates and hands out the list Data plane — BFD discovers controllers Management plane — Manager is the only first hop Correct: b . Re-read Four planes. Validator is first contact. Manager is not the introducer. Q2 After a healthy join, show sdwan control connections still shows a permanent Validator row. What does that mean? The Edge is out of equilibrium — it is missing a required Manager or Controller/OMP session Design is correct; Validator stays up forever like BGP BFD is down, so Validator substitutes for IPsec Organization name matched, so Validator must remain Correct: a . Re-read Bring-up flow. Validator is transient unless the Edge cannot hold the required control count. Q3 History shows CTORGNMMIS . What do you check first? IPsec transform set on both TLOCs Whether BFD hello interval is 1 second organization-name on the Edge versus every controller — case-sensitive Delete the device from PnP and re-add it as Staging Correct: c . Re-read Traps. Org-name is an overlay-wide identity, not a routing knob. Q4 Two WAN Edges at the same branch share site-id 100. Why is there no IPsec tunnel between them? OMP cannot run on two devices By default IPsec is not formed between Edges that share a site-id They must use GRE only inside a site Validator blocks intra-site colors Correct: b . Re-read Four planes / Site-ID. Same site is one place. Use TLOC-extension or a LAN protocol on-site, not a surprise overlay tunnel. Q5 A spare router is set to Staging on the WAN Edge list. Control is up. Users still have no prefixes. Why? Staging disables DTLS Staging only allows MPLS colors The Validator serial list cannot contain Staging devices OMP does not send routes, data policy, or TLOCs to a Staging Edge Correct: d . Re-read How to choose. Staging is a deliberate half-join for testing. Q6 Manager and Controller rows are up. BFD to the data center is down. What is the first move? Re-run ZTP against ztp.viptela.com Treat it as data plane: confirm the TLOC is advertised, then debug BFD / NAT / ACL Change organization-name to match the circuit provider Set the device to Invalid so it rebuilds IPsec Correct: b . Re-read After join. Control up means bring-up worked. BFD is a different plane. Check answers Reset ## Sources - Cisco — Catalyst SD-WAN Design Guide (planes, rename, control connections, site-id, TLOC, OMP, VPN 0/512, authorized list, ports, vEdge EOS). - Cisco TAC — Troubleshoot SD-WAN Control Connections (Doc ID 214509, recertified 20 Jul 2026) — history codes, required system block, show sdwan control … . - Cisco — Getting Started / overlay bring-up — ZTP automatic portions, Validator port 12346. - Cisco — 300-415 ENSDWI — architecture, controllers, WAN Edge, operations. Related: Fundamentals (older page) · Controllers · WAN Edge onboarding · OMP · TLOCs · VPN segmentation Cisco SD-WAN series: this lesson is the gold four-plane + join map. Use the older Blogforge pages for extra drills, then come back here when a ticket is on fire. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt