Course contents

Unit 2: Core Cisco componentsLesson 2.6 (6 of 6 in this unit)13 of 27 in the Cisco SD-WAN course

Control component workflow and role separation

How the Manager, Controller, Validator and WAN Edge work together from a new edge's first contact to forwarding, and how to place a fault on the component that owns it.

Intermediate · 11 min read

You'll learn to follow a new WAN Edge from first contact to forwarding traffic, name the component that owns each step, and place a symptom on the right component before logging in to any device.

Technical definition

Role separation in Cisco SD-WAN means that management, control, orchestration and forwarding are done by different components: the Manager (formerly vManage), the Controller (formerly vSmart), the Validator (formerly vBond) and the WAN Edge (formerly vEdge for the older routers). Each has a narrow job, and a fault usually belongs to one of them.

Four components, one branch coming online

The control components and who talks to whom
The control components and who talks to whomThe Manager at 10.255.0.10, the Controller CTRL-01 at 10.255.0.11 and the Validator VAL-01 at 10.255.0.12 form the control plane. Every WAN edge keeps a control connection to the Controller and to the Manager. A new edge first contacts the Validator, which tells it where the Controller and Manager are. Edges exchange routes with the Controller over OMP and build data plane tunnels directly to each other.Manager10.255.0.10CTRL-0110.255.0.11VAL-0110.255.0.12Transport networksHUB-0110.255.1.1HUB-0210.255.1.2BR-0110.255.2.1BR-0210.255.2.2control connectionsfirst contactGreen: data plane tunnels, edge to edge

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Control traffic goes to the controllers. User traffic goes edge to edge and never passes through the Controller or Manager, which is why a lost controller leaves existing tunnels running for a while.

The lab has a Manager at 10.255.0.10, a Controller (CTRL-01) at 10.255.0.11, a Validator (VAL-01) at 10.255.0.12, and WAN Edges HUB-01, HUB-02, BR-01 and BR-02. When BR-02 is installed, each component does one thing in turn, and nobody does another's job. Following that sequence once is the best way to keep the roles apart. Each role has its own lesson; this one connects them: Manager, Controller and Validator.

A branch coming online
A branch coming onlineEach component does its part in order.Edge bootswith bootstrapValidatorintroducesControllerroutes and policyManagerconfiguration

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The sequence is the troubleshooting map.

The roles side by side

The roles side by side
The roles side by sideComponent; Plane; Owns; Does not do. Manager: Management Configuration, inventory, monitoring, users and roles Routing, forwarding, introductions Controller: Control OMP, routes, TLOCs, centralized policy Configuring devices, forwarding user traffic Validator: Orchestration First contact, authentication, introductions, NAT help Routes, configuration, monitoring WAN Edge: Data IPsec tunnels, BFD, forwarding, enforcing policy Deciding the fabric's routing policyComponentPlaneOwnsDoes not doManagerManagementConfiguration, inventory,monitoring, users androlesRouting, forwarding,introductionsControllerControlOMP, routes, TLOCs,centralized policyConfiguring devices,forwarding user trafficValidatorOrchestrationFirst contact,authentication,introductions, NAT helpRoutes, configuration,monitoringWAN EdgeDataIPsec tunnels, BFD,forwarding, enforcingpolicyDeciding the fabric'srouting policy

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

A new edge, step by step

  1. The edge comes up on a transport. It has a WAN address and a way to reach the Validator. The WAN Edge is acting alone here.
  2. The Validator introduces it. It authenticates the edge and gives it the Controller and Manager addresses.
  3. The edge builds its control connections. One to the Controller and one to the Manager, over DTLS or TLS (see secure control connections).
  4. The Manager configures it. The configuration attached to the device is pushed over its Manager connection, and the device reports back.
  5. The edge advertises over OMP. It sends its prefixes and TLOCs to the Controller.
  6. The Controller applies policy and distributes. Other edges receive the routes and TLOCs that policy allows.
  7. The edges build tunnels. Tunnels form between TLOCs, BFD starts, and user traffic can flow edge to edge.

The order shows dependencies. Without step 2, there are no connections. Without step 3, no configuration and no OMP. Without step 7, routes exist but cannot be used. A fault at one step shows up as a symptom at the next, which is why the cause is often one step earlier than the symptom.

A new edge, step by step
A new edge, step by stepSix steps in order.1 Reach the ValidatorDNS and transport2 Authenticatecertificate and serial3 Connect to Controllercontrol connection4 Receive configurationfrom the Manager5 Form tunnelsBFD

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The first failed step is where to look.

Placing a symptom on a component

Place the symptom
Place the symptomMatch the symptom to the component.SymptomNo connectionValidator or reachabilityNo routesController or OMPNo configManager

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Then check that component first.
Placing a symptom on a component
Placing a symptom on a componentSymptom; Owner; First check. New router does not appear in the fabric: Validator step, then identity Route to the Validator, its address, device list and certificate Router appears but cannot be managed: Manager connection The Manager line in the control connections Configuration push fails on one device: Manager The task result for that device A prefix is missing at a branch: Controller OMP table at each hop, then control policy Route present but not used: WAN Edge TLOC resolution and BFD sessions Traffic uses the wrong path: Policy, then the edge Which centralized policy applies, and the path state A user changed something they should not have: Manager Roles and audit informationSymptomOwnerFirst checkNew router does notappear in the fabricValidator step, then identityRoute to the Validator, its address,device list and certificateRouter appears butcannot be managedManager connectionThe Manager line in the controlconnectionsConfiguration pushfails on one deviceManagerThe task result for that deviceA prefix is missing ata branchControllerOMP table at each hop, then controlpolicyRoute present but notusedWAN EdgeTLOC resolution and BFD sessionsTraffic uses the wrongpathPolicy, then the edgeWhich centralized policy applies, andthe path stateA user changedsomething they shouldnot haveManagerRoles and audit information

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

What survives when a component is lost

Because the roles are separate, losing one does not stop the others in the same way. The effect is a pattern worth knowing before a failure. Exact timers and limits depend on the release, so check yours.

What survives when a component is lost
What survives when a component is lostLost; Existing traffic; What stops. Manager: Normally continues Configuration, monitoring and user access Controller: Continues for a period with routes already held New routes and policy changes; routes can age out if the outage is long Validator: Normally continues New devices joining, and devices that need to start over One WAN Edge: Other sites continue That site, until it returnsLostExisting trafficWhat stopsManagerNormally continuesConfiguration, monitoring and useraccessControllerContinues for a period with routesalready heldNew routes and policy changes; routescan age out if the outage is longValidatorNormally continuesNew devices joining, and devices thatneed to start overOne WAN EdgeOther sites continueThat site, until it returns

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

One command, all the roles

show sdwan control connections

On a WAN Edge: the lines show which controller components the router reaches. A missing or failed line points at that component's role.

On an edge this command maps straight onto the table above. A Controller line that is up shows OMP can run. A Manager line that is up shows management works. A missing line says which role to investigate. For a symptom that is not about connections, move to the OMP table or the BFD sessions, in that order.

Mistakes to avoid

  • Starting troubleshooting on the device where the user noticed the problem, instead of the component that owns the function.
  • Treating the Controller as a forwarding path, or the Manager as part of routing.
  • Assuming every component is needed for traffic to flow. The data plane depends on routes and tunnels that already exist.
  • Checking control, data and management planes together. Check them one at a time, in the order of the workflow.

Test yourself on the workflow

Predict · scenario 1

Put these in the order a new WAN Edge meets them: Controller, Validator, Manager.

Predict · scenario 2

A prefix is present on the Controller but missing on BR-02. Which role should you investigate?

Predict · scenario 3

The Validator is unreachable for an hour. BR-01 and BR-02 are already up with Controller and Manager connections. What is the likely effect on their traffic?

Predict · scenario 4

A user cannot sign in to the Manager's web interface, but every WAN Edge forwards normally and has a healthy Controller connection. Which statement fits?

FAQ

Why split the roles instead of using one controller?
Each job has different needs. The Validator has to be reachable by devices that have not joined yet. The Controller handles routing for the whole fabric. The Manager deals with people and configuration. Separating them lets each be placed, secured and made redundant on its own terms, and a fault in one does not take down the others.
Do all four need to be separate machines?
They are separate roles. How they are deployed, whether as separate virtual machines or as part of a hosted service, depends on the deployment model and the release. Check the design guide for yours.
Which component should I check first when a branch is down?
Start from the symptom. Cannot be managed: the Manager connection. Missing routes: the Controller and OMP. Cannot join: the Validator step. Tunnels fail: the WAN Edge, its transports and TLOCs. The table in this lesson gives the rest.