Control, management, orchestration and data functions
The four SD-WAN functions, the component that does each, and what keeps working when one is lost.
Intermediate · 12 min read
You'll learn to name the four SD-WAN functions, match each to the component that performs it, and say what keeps working and what stops if the Manager, the Controller or the Validator is unreachable.
Technical definition
SD-WAN functions (planes) are the four jobs the fabric is split into: the management plane (configure and monitor), the orchestration plane (bring edges and controllers together), the control plane (distribute routes and policy) and the data plane (forward user traffic). Each is done mainly by one kind of component.
Splitting one router into four jobs
On a traditional router, one box learns routes, decides, forwards packets, holds the configuration and reports its own health. Cisco SD-WAN separates those jobs. That separation is what makes central policy possible, and it is also the reason that a fault in one part does not have the same effect as a fault in another.
One router, four jobs
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Each job has its own component.
Who does what
Who does what
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Read each row across: the left box names the item, the others describe it.
Some documents say the Validator is part of the control plane, others call it orchestration. Both are used. This course follows the four-way split in the table.
Who does what
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The names help you place a symptom.
How an edge uses all four
The edge starts with a minimum configuration that points it at the Validator and gives it a way to prove who it is, such as a certificate or a serial number the fabric has been told to expect.
The Validator authenticates the edge and tells it where the Controller and Manager are. In the lab, the Validator is VAL-01 at 10.255.0.12.
The edge builds control connections to the Controller (CTRL-01, 10.255.0.11) and to the Manager (10.255.0.10).
The Manager sends the edge its configuration and the Controller sends it routes and policy.
The edge builds data plane tunnels to the other edges and starts forwarding user traffic.
Authentication of each device uses certificates, and a later unit covers how they are issued and checked.
An edge uses all four
On small screens, swipe sideways or focus the diagram and use the arrow keys.
The Validator is used first and then no longer needed for traffic.
Management plane: the Manager
The Manager is where intent becomes configuration. An administrator builds templates or configuration groups, defines policy and attaches them to devices. The Manager also collects statistics and alarms from the fabric and exposes an API for automation. It is the part people sit in front of, so it can feel like the centre of the network. It is not on the path of user traffic and not needed for routing to continue.
Orchestration plane: the Validator
The Validator is the first thing an edge talks to. It confirms the edge is allowed in and introduces it to the rest. It also helps edges that sit behind NAT learn their public address, so that other edges can reach them. Edges and controllers must be able to reach the Validator's address, so it is usually given a public or otherwise reachable IP.
Control plane: the Controller
Each edge keeps a control connection to a Controller and exchanges routes with it using OMP. The Controller does not forward user packets. It receives each edge's routes, applies control policy, and sends results to the other edges. That is how an edge learns that a prefix lives behind another site, and which TLOCs to build tunnels to. Later lessons describe OMP and TLOCs in detail.
Data plane: the WAN Edge
The WAN Edge is the router at a site. It terminates the transports, builds IPsec tunnels to other edges, runs BFD (Bidirectional Forwarding Detection, a lightweight probe protocol) inside those tunnels to measure and detect failures, applies data policy and forwards the packets. The WAN Edge also runs ordinary routing toward the LAN.
Looking at the edge's control connections
Example output written for this lesson, simplified; real output has more fields and a different layout
BR-01#show sdwan control connections
PEER PEER SITE STATE LOCAL COLOR PEER PRIVATE IP UPTIME
TYPE SYSTEM IP ID
vsmart 10.255.0.11 1 up biz-internet 10.255.0.11 12:04:10:33
vsmart 10.255.0.11 1 up mpls 10.255.0.11 12:04:10:31
vmanage 10.255.0.10 1 up biz-internet 10.255.0.10 12:04:10:40
BR-01 has control connections to the Controller (shown by its old name, vsmart, in the TYPE column) and to the Manager. There is none to the Validator, because that connection is only used at the start and is normally closed once the edge has joined. Site ID 1 for the controllers, the colours and the uptime are examples for this lesson.
What keeps working when a component is lost
The table is a general guide. The exact behaviour, such as how long an edge keeps routes it already holds, depends on your release and settings, so check them before relying on a number of seconds or hours.
When a component is lost
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Plan for each failure.
What keeps working when a component is lost
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Read each row across: the left box names the item, the others describe it.
Mistakes when learning the planes
Placing user traffic on the Controller. It carries control information; the edges carry the data.
Treating the Manager as essential to forwarding. Its loss hurts operations before it hurts users.
Expecting a permanent Validator connection. It is a first-contact service.
Mixing the names. A question may use vSmart where another says Controller. They are the same component.
Test yourself on SD-WAN functions
Predict · scenario 1
Which component distributes OMP routes and control policy to the edges?
Predict · scenario 2
The Manager is down for maintenance. What is the most accurate statement about user traffic between branches?
Predict · scenario 3
A new WAN Edge is powered on with a minimum configuration. Which component does it contact first?
Predict · scenario 4
show sdwan control connections on an edge lists a Controller and a Manager but no Validator, and the edge is working. What does this mean?
FAQ
Why are the old names still used?
Cisco renamed the components but older documents, exam material, CLI output and many engineers still use the original names. Expect to see both. Manager is vManage, Controller is vSmart, Validator is vBond, and WAN Edge covers the routers, including those once called vEdge.
Is the Validator in the path of control traffic after an edge has joined?
No. The Validator helps an edge find and authenticate to the Controller and the Manager when it first connects, and then the edge keeps its own control connections to them. It is a gatekeeper at the start, not a relay for the connections that follow.
Do the four functions run on four separate devices?
Normally the Manager, Controller and Validator are separate virtual machines or cloud-hosted instances, and the WAN Edge is a router or virtual router. Deployment sizes and the number of each differ by network, so check the documentation for your release.