Cisco Catalyst SD-WAN architecture: Manager, Controller, Validator, OMP and TLOCs

From Viptela to Catalyst SD-WAN

Cisco bought Viptela in 2017 and built its main SD-WAN product from it. The components were first called vManage, vSmart, vBond and vEdge; since 2023 Cisco calls the product Cisco Catalyst SD-WAN and the components SD-WAN Manager, SD-WAN Controller and SD-WAN Validator. You will see both sets of names in documentation, logs and job adverts, so learn both. For vendor-neutral SD-WAN ideas, start with What is SD-WAN?.

The four roles

Controllers can be hosted by Cisco in the cloud, by a partner, or on your own servers. Most deployments run at least two Controllers for resilience.

Identity and control connections

Every device carries an organisation name (which must match exactly across the fabric), a system IP (a loopback-like identifier, not necessarily routed) and, for edges, a site ID that groups devices at the same location. Devices prove who they are with certificates.

1. A new edge contacts the Validator over DTLS and both sides check certificates and the device's serial number against an allowed list.
2. The Validator tells the edge the addresses of the Manager and Controllers.
3. The edge builds permanent DTLS or TLS control connections to the Manager and to the Controllers.
4. OMP sessions start over the Controller connections, and the edge receives its configuration from the Manager.

OMP and TLOCs

OMP (Overlay Management Protocol) is the routing protocol of the overlay. It runs only between edges and Controllers, much like BGP route reflection: edges never peer with each other. OMP carries three kinds of route:

• OMP routes: the site's LAN prefixes, learnt from connected, static, OSPF or BGP routes in service VPNs.
• TLOC routes: the WAN attachments of each edge.
• Service routes: services such as firewalls available at a site, used for service chaining.

A TLOC (transport locator) is identified by the system IP, a colour and the encapsulation. Colours such as mpls, biz-internet, public-internet and lte label each transport. By default an edge tries to build an IPsec tunnel from each of its TLOCs to every remote TLOC; the restrict option limits tunnels to the same colour, which you use for private transports such as MPLS. BFD runs inside every tunnel to check liveness and measure loss, latency and jitter, which application-aware routing uses later.

Data plane encryption keys are not negotiated tunnel by tunnel with IKE. Each edge sends its keys to the Controllers, which pass them on. This is what lets thousands of tunnels form quickly.

Real-world example: a retail chain's first look at the dashboard

A sports retailer with 60 stores moved from MPLS to Cisco SD-WAN with cloud-hosted controllers. Each store had an MPLS circuit (colour mpls, restricted) and a broadband line (colour biz-internet). The engineers gave each store a site ID matching its store number and a system IP from a reserved 10.255.0.0/16 range, which made the Manager dashboard easy to read. When one store showed only one tunnel up, the TLOC view showed its broadband TLOC had a private address and no public NAT mapping; the store router behind the ISP's equipment needed a bridge-mode change, after which the Validator could see the correct public address and full tunnels formed.