Course contents

Unit 2: Core Cisco componentsLesson 2.1 (1 of 6 in this unit)8 of 27 in the Cisco SD-WAN course

Manager: configuration, inventory, monitoring and RBAC

What the SD-WAN Manager (vManage) owns: configuration, device inventory, monitoring and role-based access, and what it does not do, so a symptom can be sent to the right component.

Intermediate · 10 min read

You'll learn to list the four jobs of the SD-WAN Manager, say what it does not do, and decide whether a missing route, a failed template push or a user who sees too much is a Manager problem.

Technical definition

SD-WAN Manager (formerly vManage) is the management plane of Cisco SD-WAN. It holds the configuration of every device, the inventory of which devices belong to the fabric, the monitoring data, and the user accounts and roles that decide who may change what. Administrators use its web interface or its REST API.

A change that reached 3 of 4 routers

An administrator pushes a new template to the four edges in the lab: HUB-01, HUB-02, BR-01 and BR-02. Three report success and one stays on the old configuration. Before touching any router, the useful question is which component owns each part of that story. The Manager owns the template, the list of devices it was attached to, the push and its result, and the audit of who started it. It does not own the route that a branch uses afterwards. This lesson separates those jobs, so a symptom can be sent to the right component.

The four jobs

The four jobs
The four jobsJob; What the Manager does; Lab example. Configuration: Builds device configuration from templates or configuration groups and pushes it to devices that are attached. Also holds the policies that the Controller later uses. A template for BR-01 and BR-02 with site ID, system IP and tunnel interface colours Inventory: Keeps the list of devices that are allowed in the fabric and their state: reachable or not, which template, which software. Edges and controllers appear here. The device list showing HUB-01, HUB-02, BR-01, BR-02, CTRL-01 and VAL-01 Monitoring: Collects status and statistics from devices and shows them as dashboards, tables and alarms: control connection state, tunnel health, interface and application data. An alarm when BR-02 loses a control connection Access control (RBAC): Decides who can log in and what they can see or change, through users, user groups and roles. A read-only operator who can view dashboards but cannot push templatesJobWhat the Manager doesLab exampleConfigurationBuilds device configuration fromtemplates or configuration groups andpushes it to devices that areattached. Also holds the policiesthat the Controller later uses.A template for BR-01 and BR-02 withsite ID, system IP and tunnelinterface coloursInventoryKeeps the list of devices that areallowed in the fabric and theirstate: reachable or not, whichtemplate, which software. Edges andcontrollers appear here.The device list showing HUB-01,HUB-02, BR-01, BR-02, CTRL-01 andVAL-01MonitoringCollects status and statistics fromdevices and shows them as dashboards,tables and alarms: control connectionstate, tunnel health, interface andapplication data.An alarm when BR-02 loses a controlconnectionAccess control (RBAC)Decides who can log in and what theycan see or change, through users,user groups and roles.A read-only operator who can viewdashboards but cannot push templates

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

The Manager has a web interface for people and a REST API for scripts and other systems. Both use the same data and the same permissions, so a script that is allowed to read the inventory is not given more rights because it skips the web page.

The four jobs of the Manager
The four jobs of the ManagerConfigure, monitor, troubleshoot and administer.ManagerConfiguretemplates and groupsMonitorstatus and statisticsTroubleshoottools and logsAdministerusers and roles

On small screens, swipe sideways or focus the diagram and use the arrow keys.

It is the single point of management.

What the Manager does not do

What the Manager does not do
What the Manager does not doIt does not forward traffic or run routing.Forward trafficEdges do thisDistribute routesController does thisAuthenticate devices firstValidator does this

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Edges continue without it.
  • It does not forward user packets. Traffic between BR-01 and HUB-01 goes through the IPsec tunnels, not through the Manager.
  • It does not run OMP or choose routes. That is the Controller (formerly vSmart), covered in the next lesson.
  • It does not help a new device find the fabric. That is the Validator (formerly vBond).
  • It does not replace the router's own checks. A device still validates what it receives and can refuse a bad configuration.

How the Manager reaches a device

A WAN Edge builds a secure control connection to the Manager, as it does to the Controller. Management traffic (configuration, status, statistics) rides on that connection, so the Manager does not need to log in to the router's management address or SSH to it. This is why a router with no control connection to the Manager shows as unreachable in the inventory even when the router is forwarding traffic normally. The mechanism of the connection is in DTLS/TLS secure control connections.

Reaching a device
Reaching a deviceA secure control connection carries management traffic.ManagerControl connectionsecureDeviceapplies configuration

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The device must be connected.

From template to device

  1. The device is known. It is in the inventory and has joined the fabric, with a control connection to the Manager.
  2. A configuration is attached. An administrator links a template or configuration group to the device and fills in the values that differ per router, such as system IP and site ID.
  3. The Manager builds the final configuration. It combines the shared parts with the per-device values.
  4. The Manager pushes it. The device receives and applies the configuration and reports the result. A device that is not reachable cannot receive it.
  5. The result is recorded. The task shows success or failure for each device, so one router can fail while the others succeed.

In practice, a push that fails on one device is usually about that device: it is unreachable, it has a value the template does not accept, or its software does not support a feature in the template. Read the task result for that device before editing the shared template.

From template to device
From template to deviceCreate, attach, push and verify.TemplatecreateAttachto devicesPushapplyVerifydevice state

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A push applies the configuration.

RBAC: users, groups and roles

Role-based access control (RBAC) gives each person only the rights their job needs. The usual pattern is a user who belongs to a user group, and the group carries what that group may read or change, for example monitoring only, or policy changes without user management. Deploy it on day one, not after an incident: a shared administrator account makes it impossible to say who made a change.

RBAC
RBACUsers belong to groups and groups have roles.UserGroupRolewhat is allowed

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Give the least access needed.
RBAC: users, groups and roles
RBAC: users, groups and rolesPerson; Needs; Reasonable access. Service desk: See whether a site is up View dashboards and device status only Network engineer: Change templates and policies Configuration rights, not user management Platform owner: Manage users and the system itself Full rights, kept to a small number of peoplePersonNeedsReasonable accessService deskSee whether a site is upView dashboards and device statusonlyNetwork engineerChange templates and policiesConfiguration rights, not usermanagementPlatform ownerManage users and the system itselfFull rights, kept to a small numberof people

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

The exact group names, built-in roles and how a role maps to individual features depend on your release, so check what yours ships with. Many organisations also connect the Manager to an external identity service for login; the options differ between releases.

Checking the Manager's view from a router

show sdwan control connections

On a WAN Edge: is there a connection to the Manager, and is it up? The Manager shows as a peer of type vmanage.

Example output written for this lesson, simplified; real output has more fields and a different layout
BR-01#show sdwan control connections
PEER TYPE  PEER SYSTEM IP  SITE ID  LOCAL COLOR   STATE
vsmart     10.255.0.11     1        biz-internet  up
vsmart     10.255.0.11     1        mpls          up
vmanage    10.255.0.10     1        biz-internet  up
The last line is the Manager at 10.255.0.10. The type is still shown as vmanage, the older name. If this line is missing or not up, the Manager cannot monitor or configure BR-01, whatever the Controller lines say. The full output of this command is read in the lesson on secure control connections.

Which component owns the symptom

Which component owns the symptom
Which component owns the symptomSymptom; Start with; Why. Template push fails on one router: Manager task result and that router's reachability Configuration is the Manager's job Router shows unreachable in the inventory but carries traffic: The router's control connection to the Manager Management and forwarding are separate A prefix is missing at a branch: The Controller and OMP Routes are not the Manager's job A user can see or change too much: RBAC groups and roles Access is decided in the ManagerSymptomStart withWhyTemplate push fails onone routerManager task result and that router'sreachabilityConfiguration is the Manager's jobRouter showsunreachable in theinventory but carriestrafficThe router's control connection tothe ManagerManagement and forwarding areseparateA prefix is missing ata branchThe Controller and OMPRoutes are not the Manager's jobA user can see orchange too muchRBAC groups and rolesAccess is decided in the Manager

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Read each row across: the left box names the item, the others describe it.

Mistakes to avoid

  • Blaming the Manager for a routing fault. It builds the configuration, but routes are exchanged by the Controller and the edges.
  • Treating "the Manager is down" as "the network is down". Existing tunnels and routes normally keep working while management is unavailable.
  • Editing a managed router by hand and forgetting that the Manager still holds the old intent.
  • Sharing one administrator login, which removes any record of who changed what.

Test yourself on the Manager

Predict · scenario 1

Which of these is a job of the SD-WAN Manager?

Predict · scenario 2

The Manager is switched off for maintenance. BR-01 and HUB-01 still have healthy control connections to the Controller. What is the most likely effect on a user in BR-01 sending traffic to HUB-01?

Predict · scenario 3

A template push succeeded on HUB-01, HUB-02 and BR-01 but not on BR-02. BR-02 shows unreachable in the inventory. What should you check first?

Predict · scenario 4

A service desk user can open the template editor and push to devices. The job only needs the user to see whether sites are up. Which feature should be changed?

FAQ

If the Manager goes down, does the network stop forwarding?
Normally no. Forwarding is done by the WAN Edge routers using routes and tunnels they already have, and routes come from the Controller. What stops is management: no new configuration, no new monitoring data, and no changes by users. Plan for the Manager to be recovered, but do not expect traffic to depend on it.
Is the Manager a router?
No. It is a server application, deployed as a virtual machine or in a cloud service, and it does not forward user packets or hold the overlay routing table. Your release notes and design guides describe the supported ways to deploy it.
Can I configure a WAN Edge from its own CLI instead?
Often yes, but a device that the Manager configures through a template or a configuration group is meant to be changed there. A local change can be overwritten at the next push or leave the Manager showing a different picture from the router. Check how your release treats a device in this state before editing it by hand.