Course contents

Advanced Cisco SD-WAN

For engineers who run or design Catalyst SD-WAN at work: multi-site and multi-region design, advanced OMP and policy, how application-aware routing decides, QoS and AppQoE, security and cloud integration, high availability, automation, and production capstones with test plans.

Advanced · 25 lessons

Covers Enterprise design, Policy, Application-aware routing, QoS, High availability and Automation.

This course assumes the foundations course: Cisco SD-WAN. It reuses the same lab and addressing, and it concentrates on design trade-offs, production impact, how to validate a change, and how each feature fails. Many features depend on the router model, the software release and the licence, so lessons name what to check before you rely on them. Lessons not yet written appear greyed in the outline.

What's in this course

13 modules · 25 lessons available, 77 more planned · about 6 hours of reading

Module 1: Enterprise design

Designing for many sites and regions: controller placement, transport choices and the cost of each topology.

  • 1.1Multi-site and multi-region architectureComing soon
  • 1.2Controller placement and scalingComing soon
  • 1.3MPLS, Internet and LTE/5G transport trade-offsComing soon
  • 1.4Regional hub-and-spokeComing soon
  • 1.5Full-mesh economics and tunnel scaleComing soon
  • 1.6Partial mesh and hybrid topologyComing soon
  • 1.7Hierarchical SD-WAN and Multi-Region Fabric15 min · Advanced
  • 1.8On-demand (dynamic) tunnelsComing soon

Module 2: Advanced OMP and TLOC

OMP in depth, best-path selection, TLOC extension, redistribution with loop control, and OMP troubleshooting.

  • 2.1OMP state, update processing and route attributesComing soon
  • 2.2Best path, route availability and selection factorsComing soon
  • 2.3TLOC extension and transport reachabilityComing soon
  • 2.4Dual-router TLOC extension designsComing soon
  • 2.5OSPF/BGP redistribution, tags and loop avoidanceLab20 min · Advanced
  • 2.6Route policy, filtering, summarization and preferenceComing soon
  • 2.7Deep OMP troubleshootingComing soon
  • 2.8OMP path limits, backup paths and source preferenceComing soon
  • 2.9Tunnel groups for topology controlComing soon

Module 3: Advanced policy

How policy is written and evaluated, control and data policy, localized policy, topology policy and policy groups.

  • 3.1Lists, sequence evaluation, default actions and directionComing soon
  • 3.2Centralized control policy and route modificationComing soon
  • 3.3Centralized data policy and forwarding actionsComing soon
  • 3.4Localized ACLs and QoSComing soon
  • 3.5Site, VPN, prefix, TLOC and app listsComing soon
  • 3.6Regional and custom topology policiesComing soon
  • 3.7Policy groups, validation and deployment lifecycleComing soon

Module 4: Advanced AAR

How BFD measurements become SLA decisions, brownout behaviour, and newer path optimisation features.

  • 4.1BFD-derived loss/latency/jitter measurementComing soon
  • 4.2BFD timing, aggregation and measurement limitationsComing soon
  • 4.3SLA classes and policy thresholdsComing soon
  • 4.4Application match, eligibility and preferred TLOCComing soon
  • 4.5DPI/application recognition and visibility limitsComing soon
  • 4.6Brownout and fallback behaviourComing soon
  • 4.7Newer path optimization features and version gatingComing soon

Module 5: QoS and AppQoE

QoS architecture, classification and scheduling, voice and video design, shaping and policing, and AppQoE.

  • 5.1QoS architecture and DSCP mappingComing soon
  • 5.2Ingress/egress classification and schedulingComing soon
  • 5.3Voice, video and interactive traffic designComing soon
  • 5.4Policing, shaping, buffer and WAN bandwidthComing soon
  • 5.5AppQoE optimization and prerequisitesComing soon
  • 5.6QoS counters and queue-drop troubleshootingComing soon
  • 5.7Forward error correction and packet duplicationComing soon
  • 5.8TCP optimisation, data redundancy elimination and AppNavComing soon

Module 6: Advanced security

PKI, IPsec algorithms, segmentation, the firewall and threat features, cloud security and Manager hardening.

Module 7: Cloud and hybrid WAN

Cloud design, Cloud OnRamp for SaaS and IaaS, direct internet access, SIG and multicloud transit.

Module 8: High availability

Controller high availability, dual-edge and dual-hub designs, failover over ISP or cellular, and resilience testing.

Module 9: Enterprise features

Service chaining, multitenancy, multicast, IPv6 and NAT design.

  • 9.1Service chaining through security servicesComing soon
  • 9.2Tenant separation and multitenancy limitsComing soon
  • 9.3Multicast capabilities and design limitsComing soon
  • 9.4IPv6 and dual-stack constraintsComing soon
  • 9.5NAT design and service interactionsComing soon

Module 10: Automation and observability

The Manager REST API, scripting and Ansible, safe automation practice and telemetry.

  • 10.1SD-WAN Manager REST API structureComing soon
  • 10.2Postman/cURL, sessions and safe credentialsComing soon
  • 10.3Python API inventory and state extractionComing soon
  • 10.4Ansible and idempotent changesComing soon
  • 10.5Automation staging, versioning and rollbackComing soon
  • 10.6Telemetry: SNMP/syslog/NetFlow/IPFIX and APIsComing soon

Module 11: Lifecycle and deep troubleshooting

A method for deep troubleshooting, upgrades and rollback, and migrating from an existing WAN.

  • 11.1Layered root-cause frameworkComing soon
  • 11.2Controller and certificate failuresComing soon
  • 11.3OMP route blackholes and TLOC resolutionComing soon
  • 11.4IPsec/BFD failures and packet dropsComing soon
  • 11.5QoS, AAR and application performanceComing soon
  • 11.6Software upgrades, compatibility and rollbackComing soon
  • 11.7Brownfield migration and coexistenceComing soon

Module 12: Production capstones

Production designs and validation: multi-hub architecture, site tiers, voice, segmentation, cloud and a cutover report.

  • 12.1Primary/DR multi-hub architectureComing soon
  • 12.2Platinum/Gold/Silver/Bronze site designsComing soon
  • 12.3Voice and business application AAR designComing soon
  • 12.4Multi-VPN segmentation implementationComing soon
  • 12.5AWS/Azure and secure breakoutsComing soon
  • 12.6Fault injection, validation and cutover reportComing soon

Module 13: Advanced scenarios

Four design problems that combine earlier features: a data centre per application, a last-resort circuit for one application, application-aware routing with many spokes, and route leaking between VPNs.

Start the first lesson →