SD-WAN Zero to Hero Training

Learn the sd-wan control plane elements: vmanage, vsmart, vbond, and edge devices, their deployment on esxi or kvm, and core concepts like vpn zero and key propagation.

Examine data plane devices in the sd-wan fabric, including edge and branch routers, licensing implications, and security features such as firewall, DNS filtering, and a built-in TPM chip.

Explore the sd-wan lab topology across two data centers and two branches, including the land and branch ip schemas, viptela fabric connections, and site id based grouping.

Execute the sd-wan bring up by initializing the control plane, then deploy data plane devices, configuring system wide and VPN zero for transport and VPN 512 for management.

Configure the system-wide items for vbond and vsmart deployment—system name, site ID, organization name, vbond location, and vpn zero and vpn 512 settings—and validate and commit while verifying inter-controller reachability.

Bring up the SD-WAN control plane by logging into vmanage, configuring organization and vbond, adding vbond and vsmart controllers, generating CSRs, and installing permanent certificates from a root CA.

Deploy VHA branch devices with minimal configuration, enable automatic dataplane certificate installation via a serial-number list and a one-time password, and validate devices through the we manage dashboard.

Bring up control plane (vbond, vsmart, vmanage) with mutual authentication over dtls/tls to form tunnels, then establish data plane ipsec tunnels via edge tpm validation of serials and org names.

Verify the sd-wan fabric by checking control connections, local properties, and certificate install, then validate the data plane with IPsec tunnels, BFD sessions, and inbound/outbound connections.

Explore the Vmanage dashboard front panel, with columns showing device status, transport health, inventory and app health across VSmart, VEdge, and VBond, plus control connections and cloud analytics.

Navigate the vManage dashboard to monitor an SD-WAN network, inspecting BFD, OMP, and DTLS control connections, vSmart peering, and end-to-end data-plane visibility of application flows, VPN logs, and tunnel performance.

Explore the vmanage dashboard from the control plane to sites, IPsec tunnels, and transport health, analyze latency, jitter, loss, and top applications, and configure application aware routing.

Learn to configure sd-wan devices through vmanage using CLI templates and feature templates, understanding system wide, VPN wide, and policy settings, with reusable object templates for scalable deployment.

Learn how device configuration templates in sd-wan centralize standardization, enable variable-based customization, and push consistent configurations across branches via Vmanage and Netconf.

Learn to create and deploy feature templates for a branch 1v1 with sd-wan, plan system, aaa, logging, and vpn settings from running data, and refine templates before pushing to vmanage.

Create, edit, and save non-default and system-wide sd-wan templates, configuring Triple A, banners, logging, BFT, VPN zero, and VPN interface settings.

Learn how to create and attach feature templates in a Viptela SD-WAN environment, customize device templates with variables, and verify configuration with Netconf push and config difference checks.

Build and push a template in Vmanage, then validate deployment. Create variables for host name, site ID, and MPLS IP, then attach to devices with change management.

Classify branch sites and define reusable template variables to standardize sd-wan configurations, enabling 15–20 core values per template and scalable deployments.

Discover OMP, the overlay management protocol between vSmart devices, enabling overlay network orchestration, service chaining, traffic engineering, and VPN topology management with control over the underlay.

Understand the three OMP route types—service side VPN routes, TLoc routes, and service routes—and how vSmart uses next-hop attributes to distinguish MPLS and internet paths.

Verify omp routes across cli and gui, examining vpn, tloc, and service routes, and interpret originator, site preference, and chosen, installed, resolved statuses for accurate path selection.

Analyze OMP attributes and TLoc concepts in SD-WAN, including origin, originator, and preference, and demonstrate weight-based load balancing for incoming vs outgoing traffic with color and encapsulation details.

Explore how OMP path selection avoids loops by validating routes, evaluating distance and preferences, and monitoring IPsec tunnels with BFD to update the forwarding table.

Demonstrate redistribution of routes between OSPF and OMP in a branch topology, showing both IGP-to-OMP and OMP-to-OSPF configurations, verification, and origin tracking.

Explore Viptela policy types, including control, data, and app route policies, and learn centralized versus localized policy deployment, traffic lists, and how vManage and vSmart push rules to VEdge devices.

Explore the vsmart policy architecture, comparing control policies (configure and execute on vsmart) with data policies (execute at the Vedge and downloaded from vsmart), and understand policy direction and structure.

Build vSmart control policy to block the 77 prefix from branch one to branch two using a prefix list and VPN ten, outbound; verify branch two does not learn route.

Explore how vSmart policy execution drives app route and control and data policies, including service chaining, traffic engineering, route leaks, flow templates, and nat flow for sd-wan topologies.

Create a hub and spoke sd-wan policy to force traffic through the data center and remove direct branch tunnels. Use vmanage to match tlocs and sites and verify IPsec status.

Master sd-wan policy lab examples from real-life scenarios, including multi topology control policy, service redirection and insertion, data policies, and application aware routing, aligned with Cisco exam prep.

Learn how to implement multi-topology sd-wan policies with hub-and-spoke and full-mesh vpn ten and vpn 20 using Vmanage, including creating control and data policies and applying them.

Learn to implement service insertion in SD-WAN by directing traffic to firewalls and data center hubs, and create and edit hub-and-spoke or full-mesh policies, and test with traceroute.

Configure a data center priority control policy to favor the primary data center, create tloc lists and groups of interest, and apply and verify via centralized policy.

Learn to configure an extranet (root-leak) policy that shares routes from vpn 20 and 40 into vpn 100 and exports back, using a loopback 100 and a centralized control policy.

Learn how data policies on the edge box control bidirectional traffic, override OMP routing, and work alongside control policies with data prefixes, MPLS preference, and service chaining.

Explore how app-aware routing uses application ids and sla mappings in centralized data policies to steer traffic across links, with bfd monitoring loss, latency, and jitter.

Configure the app-root policy in Vmanage, define audio/video and web SLA classes, and apply a data policy with MPLS primary and internet backup across all branches and data centers.

verify data policy application aware routing by inspecting policy creation, tunnel status, and channel path for audio video; assess SLA with loss, latency, jitter, and revert to MPLS after testing.

Explore how cloud express enables cloud on ram optimization for SaaS and infra services in the sd-wan fabric, improving latency, jitter, and loss through real-time application visibility.

Enable cloud express on the vmanage dashboard, configure applications and client sites, and connect gateway sites for secure internet exit and SaaS optimization.

Enable TCP optimization on long-latency links like VSAT to boost SaaS performance, using system wide, VPN wide, or per-flow policies, and verify with show app tcp opt and active flows.

Discover how to enable viptela analytics in vmanage, fetch app-wise, service-based, and IP-based reports, export them as pdf or excel, and leverage email alerts and custom dashboards.

Explore cloud-based V analytics in Cisco SD-WAN, delivering network availability and uptime insights with reports on least performing apps, top bandwidth users, and anomalous families, exportable as pdf or excel.

Explore vAnalytics features to generate PDF reports on latency, loss, and jitter for tunnels and carriers, assess network health, and track downtime by site within a cloud-enabled SD-WAN environment.

Learn how to integrate Viptela with Zscaler by configuring GRE tunnels and VPN zero interfaces in Vmanage, routing internet traffic to Zscaler for secure cloud exit.

Define policy-based access for Zscaler integration by redirecting traffic to the firewall via vEdge interfaces, configuring gray one and gray two as primary and secondary channels, and applying GRE tunnels.

Learn what iWAN is, the technology behind it, and how DMVPN and performance routing work, then study the migration strategy to SD-WAN.

Understand Iven concepts and how they differ from Cisco SD-Wan, examine your lab setup with the CLI, and learn a step-by-step migration plan from data center to branch.

Learn why Cisco's intelligent WAN enables mixed transport, centralized policy management, and cloud-ready security, accelerating migration from iWAN to Estevan for cost savings and improved SLA visibility.

Explore transport-independent design in SD-WAN, comparing Ivan and Estevan deployments with dual MPLS, hybrid, and dual internet, and how app-aware routing and security evolve.

Provision a dual DC IWAN environment by configuring MPLS and internet paths, setting IP address pools and hub devices in IVAN via Epic M, and integrating NetFlow with live index.

Configure the MC master controller and multiple devices in a dual data center iwan environment by setting management IPs, validating snmp, auto populating parameters, and defining lAN and isp interfaces.

Learn how to provision a dual data center iwan environment, configure routing protocols and prefixes for two data centers and branches, and verify a master controller with two border routers.

Explore intelligent path control and application aware routing across Ivan and Estevan, featuring ABC visibility, application optimization, cloud security integration, and DMVPN with IPsec and front door.

Explain dynamic multipoint VPN (dmvpn) with IPsec tunnels, on-demand tunneling, hub-and-spoke and spoke-to-spoke topologies, HRP DNS resolution, and phase 3 improvements for scalable, transport-independent Estevan fabric networking.

explore dmvpn hub-and-spoke configurations, create vrfs for mpls and internet transports, and configure gre multipoint tunnels with ipsec profiles for secure vpn connectivity.

Log into the hub and border devices to verify dmvpn configurations, transport, tunnels, and ipsec profiles. Then use traceroute to confirm hub-spoke paths and dynamic dmvpn routing.

Explore performance routing and intelligent path control, from BFR to application aware routing, with a hub master controller pushing policies, SLA-based path decisions, and dynamic monitoring across DMVPN IPsec tunnels.

Explain PfR components and deploying IWAN intelligent path control through master and hub controllers, branch borders, and DMVPN topology. Define prefixes, policies, and SLA-based path selection.

Verify PfR configuration across the SD-WAN topology from the master controller to data center and branches, using traceroute and traffic classes to observe path changes between MPLS and internet.

Explore direct internet access from branch offices, comparing local exit with cloud gateways, and configure zone-based firewalls, NAT, and IPsec VPN options to securely route branch traffic to the internet.

Configure dia, assign interfaces, and implement acl and nat policies for direct internet access. Verify with ip sla tracking and multi-path bgp across two gateways.

Verify DIA verification by pinging from the LAN interface and checking translations. Inspect policy maps, class maps, juniper security, and Estevan to confirm icmp sessions and IP SLA monitoring.

Migrate from ivan to sd-wan sites with step-by-step guidance for data center, single and dual routers, protocol redistribution, verification, and vsmart to devices policy across 16 videos.

Plan the sd-wan migration with a data-center first approach, detailing Estevan versus non Estevan sites, OMP, VPN zero, and feature template deployment.

Explore the SD-WAN migration lab from data center to branch, upgrading legacy images, validating hardware, and converting traditional routing to Estevan with feature templates and BGP over VPN.

Book a Cisco Dcloud migration lab slot, log in with your credentials, import topology, and deploy the control plane and WAN devices; expect about one hour for completion.

Examine data center migration strategies, comparing before and after topology, with edge devices and redundant links, and describe onboarding to VManage using templates and centralized policy.

Bring up dc edge 1 via bootstrap to onboard the csr device, form the control connection to vmanage, install certificates, and verify onboard progress before pushing the full template.

Bring up three data center devices using bootstrap config, install certificates, activate chassis numbers, push the BGP template via vmanage, and verify control connections.

Configure BGP between core and CSI devices, establish peers, advertise the default route, verify with show commands, and redistribute between BGP and OMP to integrate underlay with the SD-WAN fabric.

Learn to advertise BGP routes into OMP to vsmart, use vsmart as a route reflector, rediscover OMP in BGP with filters; create OMP templates and verify config diff.

Demonstrates redistributing the internal BGP routes from OMP into BGP, using vmanage templates, route policies, and tagging to steer DC1/DC2 DCI traffic in sd-wan.

Configure BGP to redistribute OMP into BGP using vManage, verify routes across vSmart, DCI, and core routers, and apply route policies and tagging to steer reverse traffic.

Migrate branches by upgrading hardware or software images to meet sd-wan requirements, verify router images, set the boot image, reload, then configure bootstrap and push the sd-wan template from vmanage.

Continue branch 3 migration by applying bootstrap config, authenticating, installing the permanent certificate, and confirming the device joins the fabric after template attachment via vmanage.

After migration, validate sd-wan by checking data plane and control plane, certificates, ipsec tunnels, and routing reachability between Estevan and non Estevan sites.

Execute the branch number five migration to sd-wan by cutting over from mpls to an internet link, onboard devices with bootstrap and root certs, apply templates and configure bgp peers.

Configure BGP peering between the core router, BCC, and Estevan over MPLS, verify with BGP summary, and redistribute OMP to advertise data-center and MPLS prefixes via sd-wan.

Learn to implement hub-and-spoke central policy in sd-wan by configuring vmanage and vsmart templates, activating the policy, and steering routes via omp from hub to spokes in Estevan data center.

Explore the step-by-step migration from iWAN to Cisco SD-WAN, including deploying Estevan controllers and migrating data centers and branches with attention to features, bandwidth, and deployment models.

Identify sites and prerequisites for migration by comparing feature parity between Ivan and Esteban, bandwidth, and platform capabilities, and document high and low level designs to guide a secure migration.

Analyze pre migration configuration and hardware options, including feature parity between Ivan and Estevan. Evaluate deployment choices—Cisco cloud, MSP cloud, or on-prem—along with licensing, throughput, and visibility considerations.

Explore cloud versus on-prem SD-WAN controller deployment, Cisco hosted controllers with vmanage, vbond, and vsmart, plus migration planning, redundancy, and NetFlow and SNMP integration.

Describe the lab topology with a single DC and three branches, then execute a two-phase migration moving the DC first, then branches via vmanage.

Learn how to use an automation script to back up vmanage to a local directory, clean the vmanage, and perform selective restores of templates, policies, and Vsmart components using regex.

Perform a greenfield data center migration by provisioning minimum fabric-ready configuration on C edge devices, attaching the deployment template in Vmanage, and establishing BGP peering with core routers.

Attach the vSmart template, activate the central policy, and run the automation for verification tasks; explore on-demand tunneling and monitoring of control connections across devices.

Migrate branch three from iwan to sdwan by converting the router to an Estevan device, enabling controller mode, and deploying bootstrap, certificate configurations, and templates via Vmanage.

Post migration validation for branch three uses an automation tool to verify control connections, IPsec tunnels, and DC routes, then generate a branch three report for management.

Onboard and migrate branch five from iwan to sdwan by converting BR5BC to sdwan mode, ensuring bootstrap configuration and certificate, then enable controller mode and verify vmanage control connections.

Onboard branch five in SD-WAN, migrate from iwan to SD-WAN, apply and adjust the internet type two template, and validate BGP and IPsec tunnels through vManage troubleshooting.

Learn how per tunnel qos verification is implemented in Cisco Estevan, tracing dmvpn and on-demand tunneling, through local policies, device templates, and queue configurations.

Learn to use an automation tool to generate comprehensive SD-WAN device reports, pull system and software information across seven devices, and redirect output for review.

Advance your SD-WAN Secops expertise by learning how to enable security, install the image, and configure firewall, IPS/IDS, and policy rules across use cases, including URL filtering and umbrella integration.

Explore Cisco's sd-wan security features, including the firewall, IPS, filtering, and AMP, learned step by step to enhance sd-wan security.

Identify SD-WAN security challenges from external, internal, and cloud-based threats. Learn to secure branch, data center, and cloud edges using Cisco's security stack with DNS, IPS, and URL filtering.

Explore SD-WAN threat defense by examining attack surfaces across branch, data center, and cloud, and implement edge security with IPsec, VPN, firewall, IPS, DNS security, and AMP via Vmanage.

Explore how Cisco Viptela fabric achieves strong security with 256-bit encryption, TLS and IPsec tunnels between control and data planes, and a scalable full-mesh IPsec topology.

Learn how device identity and security rely on the TPM and Cisco trusted anchor module for secure boot, tamper-proof storage, and automatic certificate validation via PnP and Vmanage.

Explore how the sd-wan fabric secures itself by scalable control and data planes, with vSmart driven routing, OMP, and IPsec tunnels enabling segmented, policy-driven traffic.

Explore how to combine firewall, intrusion prevention, url filtering, dns security, and advanced malware protection into a unified threat management approach, with layer seven inspection and customizable policies.

Explore how firewall, DNS, and URL filtering use NBAR to attach application ID metadata, guiding firewall decisions in encrypted DNS flows to the cloud.

Learn container architecture with control plane, data plane, and service plane, push config via Vmanage and iac, and explore snort engine workflows, url filtering, amp, and cloud vs on-box lookup.

Download the Cisco virtual image from the SD-WAN XC router and ISR platform, upload it to the Vmanage maintenance software repository, and configure security policies for branch devices.

Navigate the Cisco SD-WAN 19.1 security dashboard, featuring firewall, IPS, and AMP insights, and explore device-level monitoring, time filters, and embedded security tools across main, VPN, and maintenance views.

Learn to implement firewall and intrusion prevention policies in the Cisco SD-WAN vmanage dashboard. Explore app aware firewall, zone based rules, and route leakage across VPNs with gui and cli.

Configure SD-WAN guest access security by implementing app aware firewall and URL filtering, managing whitelists and blacklists, and integrating DNS security with Cisco Umbrella for threat protection.

Explore Python programming for SD-WAN automation, with a focus on integrating Python with the SD-WAN API, building a foundation through a comprehensive Python video series.

Review the agenda and objectives: Python basics, data types, conditions, loops, functions, lists, arrays, dictionaries, files, and error handling, with hands-on labs for networking automation.

Explore integer, floating-point, and boolean data types in Python, with binary and hexadecimal representations, and verify types using type(). Note Python is case sensitive.

Learn how strings work with quotes, escaping, and printing, and how to use lists as simple data structures, with examples in Python 3.

Learn how to declare and use variables in Python, build expressions with operators, understand precedence, and add comments. Explore identifiers, literals, and printing, including text and number concatenation.

Explore modules and functions in Python, learn the flow of execution, and master parameters, arguments, imports, libraries, and return values through practical examples.

Explore user defined functions in Python, pass arguments with defaults, use the asterisk and double asterisk for variable length inputs, and compute area of circle with input and pi.

Learn to define and call functions, use input and print statements, and apply if logic to find the biggest among numbers and determine pass or fail through practice exercises.

Learn control flow with if and else conditions, using true/false booleans and comparisons to drive program execution, with Python-like examples of user input and else branches.

Explore while and for loops, learn loop conditions and nesting, and practice iterating over lists, tuples, and dictionaries to perform actions like squaring numbers.

Learn Python loop control with break, continue, and pass, explore how break exits a loop when a space matches, how continue skips iterations, and how pass acts as a placeholder.

Learn how fruitful functions return values, use parameters, and distinguish local and global scope. Explore function composition, recursion as string slicing, and Python examples with return behavior and lab practice.

Explore recursion through a factorial example, master string slicing and immutability in Python, and leverage built-in string functions like split, replace, count, and startswith for practical programming.

Explore Python string modules and arrays, importing string to access ascii letters, lowercase, uppercase digits, and using formatter and template, plus array indexing and type codes B and I.

Master Python list operations and tuples, exploring mutability and common methods such as append, extend, insert, pop, remove, reverse, and sort, plus for loops and API usage.

Explore how lists behave with aliasing and cloning, showing how mutations affect copies and how to preserve originals. Compare list operations, list comprehensions, and lambdas with tuples as immutable sequences.

Master dictionaries as unordered key-value data structures, using methods like keys, get, items, update, and delete, practice iterating key-value pairs and lists of dictionaries to print user ids and names.

Learn to perform file operations in Python, including reading hostnames from storage, writing and appending to text files, and distinguishing text and binary modes while opening and closing files.

Explore common programming errors and exceptions, and learn to handle them with try and except blocks to gracefully manage division by zero and other runtime issues.

Explore how to import built-in and custom modules, call functions across programs, and reuse code by packaging and exporting modules, including examples with date, time, and calendar.