
Explore Cisco Catalyst SD-WAN's four-plane architecture and the dual naming, showing how vManage, vSmart, vBond, and vEdge (cEdge) work together from zero-touch provisioning to secure IPSec tunnels.
Explore the control plane with OMP, the overlay management protocol that carries prefixes, TLOC routes, and service routes between edges and the vsmart controller, using automatic peering and IPSec tunnels.
Discover site inventories and application needs to create three-tier templates, define real transport data, and write testable requirements guiding SD-WAN policy and migration.
Design transport by tier and apply a consistent color vocabulary to manage tunnels and support resilience. This approach delivers significant cost savings across data center, large branches, and small branches.
Design topology to match traffic, not fashion, weighing full mesh, hub-and-spoke, and regional hybrid; Meridian adopts a two-region regional hybrid with local mesh, regional hubs, and a core.
Master the SD-WAN system-ip and site-id addressing scheme, aligned by region and site, using a single allocation sheet to ensure unique, non-overlapping underlay and LAN addressing for clear policy.
Learn how certificates and a two-part trust model secure sd-wan onboarding, detailing root ca options, certificate lifecycle, and how the authorized wan edge list plus certificate validity ensure site integration.
Verify all controllers share the same case-sensitive organization name and valid certificates to the root CA, and confirm the validator address and authorized WAN edge list.
Learn a four-step verification ritual to verify health and diagnose join failures in sd-wan, using control connections, local properties, omp routes, and bfd sessions, plus a decision-tree troubleshooting approach.
Learn how to migrate live branches from MPLS to SD-WAN using a parallel run, five-step process, validating the overlay and failover before cutover, with a simple rollback.
Configure the large branch in sd-wan: two active transports with correct colors, a single trunk carrying three service vpns, and bgp/ospf routes redistributed into omp to enable fabric-wide reachability.
Turn the default full mesh into a hub-and-spoke topology using an outbound control policy that rewrites spokes' next hops to the hub's TLOC, reducing tunnels and centralizing control.
Discover how application-aware routing uses SLA classes and app-route policies, backed by continuous BFD measurements, to steer each application onto a compliant path.
Implement direct internet access at each store to break out cloud and internet traffic locally with NAT and a data policy, reducing latency and WAN load for Microsoft 365.
Advertise a firewall as a fabric service and steer untrusted traffic through a central hub for inspection via service routes, while Trusted SAAS breaks out locally.
Assemble Meridian’s data plane on a store edge, applying four independent, policy-driven treatments to distinct traffic types, then verify each behavior with a post-deployment ritual.
Segmentation is the foundational, cheap security control in sd-wan deployments, removing attacker paths through macro and micro segmentation, with a disciplined, short exception list for cross-zone flows.
Explore how the embedded security stack turns WAN edges into branch security devices, applying layered firewall, IPS, URL filtering, malware, and DNS protection with on box or cloud inspection.
Apply direct internet access securely by choosing on-box inspection for trusted saas like Microsoft 365 and steering untrusted guest traffic to inspected paths, balancing performance and security.
Split cloud into two sd-wan problems—iaas reachability and saas path optimization—and use Cloud OnRamp tools accordingly, guided by the run or consume question.
Extend the SD-WAN fabric into public cloud with Cloud OnRamp for IaaS, deploying the Catalyst 8000v as a virtual WAN edge in the VPC, and preserve existing segmentation and VPNs.
Survey the main integration points as the fabric grows, adopting cloud-delivered security via SIG for scalable DIA and deferring S-D-C-I and legacy interoperation until needed.
Diagnose control-plane and onboarding faults by reading the connection history with show sdwan control connection-history, interpreting error codes, and applying fixes, including awareness of the certificate expiry outage.
Diagnose data-plane faults when green control connections mislead; separate the control plane from the data plane and use layer 3 and 4 checks with BFD and OMP to find fixes.
Adopt a living runbook to capture incidents, onboard new sites, and guard against drift while monitoring certificate expiry and long-term capacity trends for a durable, operable SD-WAN fabric.
***Before enrolling, watch the free preview videos, so you know what you are getting. ***
Most SD-WAN training throws features and acronyms at you. This course does the opposite: it follows one realistic enterprise — a mid-size retailer we call “Meridian” — through a complete SD-WAN project, from an aging MPLS network all the way to a secured, cloud-connected, fully operational fabric. You learn every concept exactly where a real project needs it, so nothing ever feels abstract.
Designed as a conceptual framework, this video-and-article course details the fundamentals of SD-WAN technology and network design methodology. Please be advised that the scope of this course is strictly theoretical, focusing on architecture rather than practical lab simulations or product demonstrations.
You’ll start with why SD-WAN exists and how the fabric actually moves a packet (OMP, TLOCs, colors, IPsec, BFD, and VPN segmentation). Then you’ll design the network end to end — transports, topology, segmentation, controllers, addressing, and certificate trust — and capture it in a High-Level Design. From there you build it: bring the controllers to a trusted state, onboard your first WAN Edge with zero-touch provisioning, and configure at scale with templates and configuration groups.
Next you migrate live, trading branches onto the fabric in controlled waves without a business-impacting outage, then make the fabric intelligent: centralized control policy to shape topology, and data policy with Application-Aware Routing to steer voice onto the healthiest path, break Microsoft 365 out locally, protect traffic with QoS, and steer guest traffic through a firewall. You’ll then secure the fabric to a provable, PCI-ready standard, extend it to the cloud, and finish with a complete operations and troubleshooting toolkit — a monitoring practice, a layered diagnostic method, and three fault playbooks.
Every lesson pairs a short, plain-English video with a written theory article you can search and revisit, and every section closes with a knowledge-check quiz. The examples target Cisco Catalyst SD-WAN (Viptela), but the deeper method — separate the planes, design against requirements, stage every change, verify before you trust, make segmentation provable, read before you touch — is portable to any platform and any vendor.
By the end you’ll own the mental models to reason about the fabric and the hard-won “watch out for this” habits to run a project like this yourself.
Disclaimer: This is an independent educational course. It is not affiliated with, authorized by, sponsored by, or endorsed by Cisco Systems, Inc. Cisco, Catalyst, IOS XE, Viptela, and related product names are trademarks of Cisco Systems, Inc. and/or its affiliates; Microsoft 365 and Azure are trademarks of Microsoft; AWS is a trademark of Amazon, Inc. All other trademarks belong to their respective owners. The company “Meridian,” along with all sites, addresses, IP ranges, device identifiers, and command output, is fictional and illustrative, simplified for teaching. Feature names, syntax, licensing, and platform behavior change between software releases — always verify against current vendor documentation and test in a lab before applying anything to a production network. This course contains the use of artificial intelligence.