CCNP Enterprise -300-415 ENSDWI : Implementing Cisco SD-WAN

Describe on-prem controller deployment for sd-wan, detailing vmanage, vbond, and vsmart behind firewalls, 1-to-1 nat, transport interfaces, dtls/tls and ipsec tunnels, and certificate and whitelisting.

Master the complete Cisco sd-wan bringup workflow from hypervisor installation to certificate management, including zero-touch provisioning and configuring Vmanage, Vbond, and vSmart edges.

Deploy the viptela control plane by installing the OS, configuring VPN zero and static routes, registering vbond, vmanage, and vsmart in vmanage, and initiating the CSR certificate workflow.

Configure the vbond and vsmart vpn interfaces with manual IPs, using the local keyword for vbond, then set a static route and verify inter-controller reachability via ping.

Log in to the Vmanage dashboard, add controllers (vbond, vsmart, and Vmanage), and configure dtls or tls as available, then generate CSRs for certificates.

Configure and verify certificates and whitelisting to establish secure dtls or tls tunnels between vbond, vmanage, vsmart, and edge devices with TPM, using mutual authentication, PKI 2048-bit keys, and AES-256.

Explore the vmanage dashboard to monitor fabric health and device status, view real-time application analytics, and drill into per-device dashboards for loss, latency, jitter, and tunnel metrics.

Perform ZTP for Cisco SD-WAN by attaching the device in Vmanage and uploading a template from CSV, then validate WAN, DHCP, DNS, and OMP with IPsec and TLOC.

Learn the end-to-end sd-wan device onboarding workflow, from v1 authentication to vmanage and vsmart control plane provisioning, with smart accounts, licenses, plug-and-play portal, and deployment options automated or manual.

Configure sd-wan devices through vmanage using cli and feature templates, building reusable objects and policies for system wide, vpn wide, and policy settings across vpn zero, management, and transport.

Learn to plan and create Cisco SD-WAN feature templates for a branch, extract device parameters from the running configuration, and assemble small templates (system, aaa, logging, vpn, policies) before deployment.

Create and manage Cisco SD-WAN templates in vmanage, validate and push configurations, and use variables for dynamic values across devices, with change management and template copies.

Classify branch sites and define variables for templates, including hostname, site ID, mpls, internet ip, gateway, and OSPF, then use excel-driven templates to ensure consistency and standardization across deployments.

Verify data plane tunnels and underlay and overlay communication, study the TLOC extension and TLOC routes in OMP, and prepare for overlay management lab work.

Verify the sd-wan setup by checking the control connection with show control connection, inspecting local properties and certificate status, and reviewing the connection and data-plane ipsec tunnels and bfd sessions.

Verify all OMP route types—service, TLoc, and VPN—across CLI and GUI, inspecting path IDs, labels, originator attributes, and statuses (chosen, installed, redistributed, unresolved, invalid) to distinguish learned versus self-originated routes.

Master OMP best path selection and loop avoidance through tloc validity, administrative distance, route and tloc preferences, origin; while BFD and vsmart govern tunnel liveliness and hold-down and hello-tolerance timers.

Explore how VRRP, OSPF, and BGP operate within Cisco SD-WAN using dedicated labs and use cases to compare changes in VRRP with OSPF/BGP and redistribute IGP over OMP.

Verify vr rp behavior in sd-wan by simulating omp failures, monitoring real-time master and backup roles, and using template changes, show debug, and tcpdump to validate vpn traffic.

Learn to configure OSPF in SD-WAN with Viptela, adding a loopback to area zero and redistributing routes via vSmart and OMP using GUI templates.

verify BGP routes in sd-wan by examining omp routes and vpns, evaluating originator and preference values, and using ipsec topology changes to prefer data centers or hub and spoke arrangements.

Explore sd-wan policy types—control, data, centralized, and localized—and how vsmart enables routing, app-aware routing, and vpn segmentation with hub-and-spoke topologies.

Define and apply viptela sd-wan policies by distinguishing control and data policies, centralized or localized, and attach them to site lists with direction for control plane and data plane.

Learn vSmart policy overview and architecture, including policy direction and the control versus data policy distinction, with configure, apply, and execute steps and core constructs like lists, match, and action.

Create a centralized control policy to block a specific subnet from propagating to branch two in Cisco sd-wan, by matching a prefix list, vpn ten, and site 300, then reject.

Understand vSmart policy execution, including top-to-bottom processing, sequence numbers, and defaults, and apply app route, data policies, service chaining, and route leaks for sd-wan traffic control.

Explore how application aware routing guides SD-WAN decisions and enables direct internet access during outages. Reduce backhaul by letting branches reach cloud resources directly.

Define app routing policies for cloud-based sd-wan, push centralized or localized data policies from vSmart to vEdge, and route applications based on measured loss and latency.

Learn to build an app routing policy in Viptela fabric, with prefix and VPN lists, loss latency jitter, and VPN match actions, then apply it via site lists and vSmart.

Extend app-aware routing by configuring vpn, https, and voice/video app lists, defining sequence-based policies on vsmart, and applying the app route policy to branches.

Compare centralized data policy and NAT root approaches to deploying DIA, detailing NAT flow and IPsec overlay, and how the DIA tracker reroutes traffic when a tunnel or path fails.

Dia exit design uses separate vrfs for guest and corporate traffic, applying centralized data policy and track to reroute via alternate ipsec tunnels when internet links fail.

Deploy a Cisco SD-WAN data policy in a dia lab by configuring data prefix lists and overlays, then push the policy to edge devices to form an IPsec tunnel.

Explore security and quality of service within sd-wan, including service insertion, application aware firewall, and route leak prerequisites for cross-vpn firewall policies.

Explore how data policy in the Viptela fabric shapes the data plane via service chaining, matching DHCP value ten and routing traffic to the firewall using VPN and site lists.

Protect sd-wan networks by addressing external and internal threats across branch, data center, and cloud edges with a rich security stack on Cisco devices, including DNS, IPS, and URL filtering.

Explore container architecture for Cisco SD-WAN, detailing the control plane, data plane, and service plane, the appnav tunnel, and the installation steps via Vmanage.

Download and upload the Cisco sd-wan virtual image to the vmanage software repository, then create security policies in configuration and security for compliance and guest access.

Discover how to configure Cisco SD-WAN firewall policies in Vmanage, including app-aware inspection and L7 capabilities, zone-based rules for compliance, and route-leaked cross-VPN security.

Analyze how quality of service policies control packet flow in the Viptela fabric, from ingress classification and ACLs to forwarding classes, queues, and IPsec encapsulation.

Configure access lists and a rewrite policy on VPN ten interfaces, map classes AF1 and AF2 with raid markings, and apply the QoS policy to enable class-based traffic handling.

Learn how to configure a Viptela policer to limit rate and burst, and drop excess packets; apply policies to VPN interfaces in ingress or egress; and verify with show commands.

Learn to redirect traffic between links using viptela qos policers and vSmart data policies, with a 10 mbps commit and 20 mbps burst, monitoring vpn traffic.

Explore how to monitor the sd-wan fabric with Vmanage analytics and view application and vpn insights. Enable analytics, review network health and network capability reports, and download PDF insights.

Discover how rest apis in vmanage enable fast, accurate automation using swagger, json data, and four methods: get, put, post, delete, to manage devices, certificates, monitoring, and troubleshooting.

Fix errors in the API call to check control connections by locating the correct API in vManage and comparing CLI, GUI, and API outputs for controllers, vManage, and vSmart.

Upgrade the vmanage first, then the controllers and finally the edge devices, using the repository images and activation steps, ensuring Vedge is equal or lower than the controllers.

Learn to bring up a Cisco sd-wan home lab using vmanage, vbond, vsmart, and edge devices, performing manual and automated certification, plug and play, and orchestration-based baseline configuration.

Learn the fundamentals of sd-wan policy design, including omb route selection criteria, centralized vs localized policy, data vs control policy, and the match‑and‑action policy construction applied to edge devices.

Explore implementing Cisco sd-wan control policies and data policies to prefer dc1 or dc2 for branches, using site lists, prefixes, and omp-driven routing.

Learn how VPN membership policy and local route policy control IPsec tunnels in Cisco SD-WAN, restricting VPN ten and VPN twenty, with netconf-based local policy.