Traditional enterprise Wide Area Networks (WANs) were built for a different era of computing. In legacy architectures, remote branch offices relied on expensive, static Multiprotocol Label Switching (MPLS) circuits to backhaul all traffic through a centralized corporate data center before it could reach external destinations. As enterprise workloads migrated to public clouds (AWS, Microsoft Azure, Google Cloud) and Software-as-a-Service (SaaS) platforms (Microsoft 365, Salesforce), this hub-and-spoke model became an operational bottleneck, causing latency spikes, consuming unnecessary bandwidth, and driving up operational costs.
Cisco Software-Defined WAN (SD-WAN)—evolved from the foundational Viptela architecture and integrated into the Cisco Catalyst routing portfolio—fundamentally reimagines how enterprise networks connect distributed environments. By separating the network control plane from the underlying physical transport, Cisco SD-WAN constructs an agile, encrypted overlay network across any combination of broadband internet, MPLS, and 5G/LTE connections. The resulting fabric delivers centralized policy control, real-time application-aware routing, end-to-end segmentation, and unified security.
Understanding how Cisco SD-WAN works requires looking at its disaggregated plane architecture, the protocols that drive packet forwarding, how it improves upon legacy WANs, and how to plan for its deployment, design, and licensing.
Table of Contents
Cisco Catalyst SD-WAN Architecture: The Four Architectural Planes
Cisco SD-WAN separates network functions into four discrete, interacting operational planes: Orchestration, Management, Control, and Data. This decoupling ensures that no single device handles control logic, configuration management, and packet forwarding simultaneously, enabling horizontal scalability and high availability.
+--------------------------------------------------------------------------+
| MANAGEMENT PLANE |
| Cisco Catalyst SD-WAN Manager (vManage) |
| [Centralized GUI, Templates, Telemetry, REST APIs] |
+------------------------------------+-------------------------------------+
| (NETCONF / HTTPS)
+------------------------------------+-------------------------------------+
| ORCHESTRATION PLANE |
| Cisco Catalyst SD-WAN Validator (vBond) |
| [Initial Auth, Zero-Touch Bringup, NAT Traversal] |
+------------------------------------+-------------------------------------+
| (DTLS / TLS)
+------------------------------------+-------------------------------------+
| CONTROL PLANE |
| Cisco Catalyst SD-WAN Controller (vSmart) |
| [OMP Engine, Policy Engine, Key Distribution] |
+------------------------------------+-------------------------------------+
| (OMP Peering)
=====================================v======================================
DATA PLANE
Cisco Catalyst SD-WAN Edge Routers (cEdge / vEdge)
[Data Forwarding, IPsec Tunnels, BFD Probes, AAR Steering]
<==== Direct IPsec (Data Traffic over Internet / MPLS / 5G) ====>
1. The Orchestration Plane: Catalyst SD-WAN Validator (vBond)
The Orchestration plane acts as the initial gatekeeper of the SD-WAN fabric.
* Component: Cisco Catalyst SD-WAN Validator (formerly vBond).
* Function: When any edge router or controller powers on, it contacts the Validator over a known public IP or fully qualified domain name (FQDN). The Validator authenticates the connecting device using mutual public key infrastructure (PKI) certificates, validates the device’s chassis and serial numbers against an authorized whitelist, and orchestrates Network Address Translation (NAT) traversal.
* Role: Once identity is confirmed, the Validator informs the device of the IP addresses of the SD-WAN Manager and SD-WAN Controllers, facilitiating secure control connections before tearing down its own transient session.
2. The Management Plane: Catalyst SD-WAN Manager (vManage)
The Management plane serves as the single pane of glass for Day-0 through Day-2 operations.
* Component: Cisco Catalyst SD-WAN Manager (formerly vManage).
* Function: A centralized, multi-tenant or dedicated web dashboard that handles all network configuration, provisioning, software upgrades, monitoring, and troubleshooting.
* Role: Network engineers do not configure edge routers via localized CLI commands; instead, they define centralized feature and device templates in the Manager. The Manager pushes configurations to the control and edge devices via NETCONF and receives real-time telemetry, alarms, and flow statistics via internal telemetry pipelines. It also exposes comprehensive REST APIs for external automation frameworks and CI/CD pipelines.
3. The Control Plane: Catalyst SD-WAN Controller (vSmart)
The Control plane functions as the centralized brain of the network.
* Component: Cisco Catalyst SD-WAN Controller (formerly vSmart).
* Function: The Controller maintains persistent, secure Datagram Transport Layer Security (DTLS) or Transport Layer Security (TLS) control sessions with all Edge devices in its domain.
* Role: The Controller runs the Overlay Management Protocol (OMP). Rather than allowing edge routers to exchange full routing tables directly with one another, each router advertises its local routes, encryption keys, and site policies to the Controller. The Controller applies centralized business and routing policies (e.g., topology constraints, traffic redirection, service chaining) and redistributes only the approved routing information back to the appropriate edge nodes.
4. The Data Plane: Catalyst SD-WAN Edge Routers (cEdge and vEdge)
The Data plane is responsible for packet forwarding.
* Component: Cisco Catalyst SD-WAN Edge routers, which include hardware and virtual platforms such as the Catalyst 8000 Edge Platforms Family, ISR/ASR series routers running Cisco IOS XE SD-WAN (cEdge), and legacy Viptela hardware/cloud appliances (vEdge).
* Function: Placed at branch offices, campus perimeters, data centers, and public cloud VPCs/VNets, Edge devices establish secure, point-to-point IPsec tunnels between each other over any available transport (underlay).
* Role: Edge routers maintain no local control plane calculations; they forward packets based on policies distributed by the Controller, monitor underlay link quality using Bidirectional Forwarding Detection (BFD), and apply localized security and quality of service (QoS) measures.
Technical Mechanics: OMP, Tunnel Formation, and Application-Aware Routing
The interaction between the Control and Data planes determines how Cisco SD-WAN discovers paths, secures connections, and steers user traffic. This workflow relies on three core mechanisms: the Overlay Management Protocol, automated IPsec key exchange, and Application-Aware Routing.
+-------------------------------------------------+
| Cisco Catalyst SD-WAN Controller (vSmart) |
+-------------------------------------------------+
^ ^
(1) OMP Advertises: (1) OMP Advertises:
- vRoutes (Prefixes) - vRoutes (Prefixes)
- TLOCs (Transport Locations) - TLOCs (Transport Locations)
- Symmetric Crypto Keys - Symmetric Crypto Keys
v v
+-------------------------------+ +-------------------------------+
| Branch Edge Router | | Data Center / Hub Router |
+-------------------------------+ +-------------------------------+
| |
| (2) Forms Direct IPsec Tunnel (AES-256) |
+================================================+
| (3) Continuous BFD Probing (Loss/Latency/Jitter)
| (4) Application-Aware Routing (AAR) Dynamic Steering
1. Control Plane Route Peering with OMP
The Overlay Management Protocol (OMP) is an extensible, routing-protocol variant (architecturally similar to BGP) that runs inside the secure DTLS/TLS control tunnels between Edge routers and the Controller. OMP exchanges three distinct types of routes:
* OMP Routes (vRoutes): Prefixes learned from the local site’s Local Area Network (LAN), whether acquired statically or via traditional routing protocols (OSPF, BGP, EIGRP).
* TLOCs (Transport Locations): The core identifier in Cisco SD-WAN. A TLOC represents an egress interface attached to an underlay transport and is defined by a three-tuple: System IP address, Color (a label such as mpls, public-internet, or biz-internet that categorizes the transport), and Encapsulation (typically IPsec or GRE).
* Service Routes: Advertisements indicating that a specific network service (such as a firewall, intrusion prevention system, or WAN optimization engine) is available at a particular site for traffic redirection and service chaining.
When a branch edge router connects to the network, it advertises its LAN prefixes bound to its local TLOCs to the Controller. The Controller processes this information against configured centralized control policies and reflects the resolved routing paths down to peer edge routers across the enterprise.
2. Zero-Touch Encryption Key Distribution
Traditional enterprise IPsec deployments require edge routers to conduct pairwise negotiations using Internet Key Exchange (IKE/ISAKMP). In a full-mesh topology with hundreds of sites, this generates an $O(N^2)$ scaling bottleneck, causing control plane exhaustion during network-wide rekeying events.
Cisco SD-WAN eliminates pairwise IKE negotiations entirely:
1. Each Edge router generates a local symmetric encryption key (AES-256).
2. The router transmits this key, alongside its TLOC information, directly to the Controller over the secure, authenticated OMP session.
3. The Controller acts as an authorized key reflector, distributing that Edge router’s encryption key only to authorized peer Edge routers that require a data path to that site.
4. When two Edge routers need to send traffic to each other, they already hold the peer’s public transport address and cryptographic key. They establish a direct, authenticated IPsec data tunnel without exchanging any cryptographic handshake directly across the public internet or private underlay.
3. Continuous Telemetry via Bidirectional Forwarding Detection (BFD)
Once an IPsec tunnel forms between two TLOCs, the Edge routers automatically instantiate Bidirectional Forwarding Detection (BFD) sessions inside the tunnel.
BFD operates without user configuration, sending lightweight echo and probe packets continuously across every active path (e.g., Branch-Internet to Hub-Internet, Branch-MPLS to Hub-MPLS). These probes collect continuous, empirical data for three key metrics:
* Packet Loss: Percentage of dropped packets over a defined sample window.
* Latency: Round-trip time (RTT) across the transport.
* Jitter: Variation in packet arrival times.
4. Dynamic Path Steering via Application-Aware Routing (AAR)
When application traffic enters a branch router’s LAN interface, the router identifies the traffic using Network Based Application Recognition (NBAR2), Deep Packet Inspection (DPI), or Layer 3/Layer 4 Access Control Lists (ACLs).
The router then applies Application-Aware Routing (AAR) policies defined by the administrator:
1. An AAR policy defines strict Service Level Agreement (SLA) thresholds for specific applications (e.g., Voice over IP requires latency $< 150\text{ ms}$, jitter $< 30\text{ ms}$, and packet loss $< 1\%$).
2. The local Edge router inspects its real-time BFD telemetry table for all viable outgoing TLOC tunnels connected to the target destination.
3. If the primary transport (e.g., MPLS) degrades and exceeds the jitter or packet loss threshold, the Edge router transparently reroutes application flows to an alternate healthy path (e.g., Business Broadband) on a per-packet or per-flow basis without dropping active TCP connections or voice calls.
4. If multiple transports satisfy the SLA, the router load-balances traffic across them according to configured weights.
Cisco SD-WAN vs. Traditional MPLS WAN
To understand the operational and financial impact of Cisco SD-WAN, it helps to compare it directly with the legacy MPLS WAN architectures it is designed to replace or optimize.
| Evaluation Criteria | Traditional MPLS WAN | Cisco Catalyst SD-WAN |
|---|---|---|
| Transport Dependency | Locked to single, carrier-managed circuits; multi-provider integration requires complex BGP redistribution. | Transport-agnostic; simultaneously aggregates MPLS, commercial broadband, satellite, and 4G/5G into a single logical fabric. |
| Control Architecture | Distributed control plane; every router independently computes routing tables and forms neighbor adjacencies. | Centralized control plane (Catalyst SD-WAN Controller); centralized policy engine with programmatic route calculation. |
| Network Management | Device-by-device configuration via decentralized CLI scripts; prone to human configuration drift. | Single pane of glass (Catalyst SD-WAN Manager); model-driven, template-based provisioning via GUI or REST APIs. |
| Bandwidth Cost & Utilization | High cost per megabit; secondary links often sit completely idle in active/passive failover configurations. | Significantly lower cost per megabit; all available circuits operate in active/active configurations with dynamic load-sharing. |
| Cloud & SaaS Traffic Handling | Inefficient backhauling; branch cloud traffic must traverse the data center before exiting to the internet. | Direct Internet Access (DIA) with Cloud OnRamp; securely routes SaaS/IaaS traffic straight from the branch to the nearest cloud edge. |
| Security Architecture | Relies on perimeter firewalls at centralized data centers; unencrypted traffic across private carrier links. | Native zero-trust security; automated end-to-end AES-256 IPsec encryption, with integrated on-box security (NGFW, IPS, URL filtering, SIG). |
| Path Selection & SLA Enforcement | Static routing based solely on link up/down state or simple metric costs; blind to packet loss and jitter until total failure. | Real-time Application-Aware Routing (AAR); dynamic steering based on live BFD measurements of loss, latency, and jitter. |
| Provisioning Velocity | Weeks or months per branch site; requires on-site carrier handoffs and manual staging by senior engineers. | Days or hours per branch site; Zero-Touch Provisioning (ZTP/PnP) allows non-technical field personnel to rack and cable devices. |
Deployment Workflow: Setting Up and Onboarding Cisco SD-WAN
Deploying a Cisco SD-WAN fabric requires a structured, multi-phase rollout: provisioning the controllers, establishing the cryptographic trust chain, defining centralized templates, and bringing up edge routers via automated zero-touch provisioning.
+------------------------------------------------------------------------------------+
| PHASE 1: CONTROLLER DEPLOYMENT |
| Instantiate Manager, Controller, & Validator (Cisco Cloud Hosted or On-Premises) |
+-----------------------------------------+------------------------------------------+
|
v
+------------------------------------------------------------------------------------+
| PHASE 2: CERTIFICATE & TRUST INFRASTRUCTURE |
| Install Enterprise/Cisco PKI Root Certificates & Sync Authorized Serial Number List |
+-----------------------------------------+------------------------------------------+
|
v
+------------------------------------------------------------------------------------+
| PHASE 3: CONFIGURATION TEMPLATES |
| Create Feature Templates (System, NTP, BFD, VPNs) & Attach to Master Device Template|
+-----------------------------------------+------------------------------------------+
|
v
+------------------------------------------------------------------------------------+
| PHASE 4: EDGE ONBOARDING VIA ZERO-TOUCH PROVISIONING (ZTP / PNP) |
| 1. Connect WAN & Power On Edge Router |
| 2. Router acquires DHCP IP & DNS |
| 3. Contacts Cisco Plug-and-Play (PnP) Connect Portal |
| 4. Redirected to Validator -> Authenticates & receives Manager/Controller IPs |
| 5. Controller pushes OMP Routes; Manager pushes Device Template Configurations |
+------------------------------------------------------------------------------------+
Phase 1: Controller Cluster Deployment
- Choose Hosting Model: Select between Cisco-hosted cloud infrastructure (AWS or Azure, managed directly by Cisco) or an enterprise on-premises hypervisor deployment (VMware ESXi or KVM).
- Deploy the Validator: Deploy the Catalyst SD-WAN Validator on a publicly routable IP address or an address reachable via 1-to-1 static NAT.
- Deploy the Manager and Controller: Instantiate the Catalyst SD-WAN Manager cluster and Catalyst SD-WAN Controller instances, assigning each unique System IPs and site identifiers.
Phase 2: Certificate Installation and Identity Trust
- Root Certificate Authority (CA) Integration: Install the enterprise Root CA certificate or Cisco Automated PKI certificate bundle across all controllers to establish a shared cryptographic chain of trust.
- Generate and Sign CSRs: Generate Certificate Signing Requests (CSRs) for all controller instances, submit them to the CA, and import the signed identity certificates into each system.
- Sync Authorized Device Whitelist: Link the Catalyst SD-WAN Manager with your enterprise Cisco Smart Account and Plug-and-Play (PnP) portal. Download the cryptographically signed authorized serial number file (
provision.file) containing all purchased hardware chassis and serial numbers, and upload it into the Manager.
Phase 3: Constructing Configuration Templates
- Define Feature Templates: Build granular, modular feature templates within the Manager to cover device subsystems:
- System Template: Sets system IP, site ID, hostnames, and console configurations.
- Transport VPN (VPN 0): Configures physical WAN interfaces, IP address assignments (static or DHCP), TLOC colors, and tunnel parameters.
- Management VPN (VPN 512): Configures dedicated out-of-band management interfaces.
- Service VPNs (VPN 1–511): Configures internal corporate LAN interfaces, VRFs, subnets, and local dynamic routing protocols (BGP/OSPF).
- Assemble Device Templates: Consolidate these individual feature templates into an overarching master Device Template assigned to specific hardware models (e.g., Catalyst 8300 or 8200).
Phase 4: Edge Device Onboarding via Zero-Touch Provisioning (ZTP/PnP)
- Physical Installation: Ship the factory-default Edge router to the branch site. An on-site technician mounts the device and connects WAN interfaces to the designated carrier modems or circuit termination equipment without connecting local console cables.
- Network Address Acquisition: The router boots and requests an IP address, default gateway, and DNS server information via DHCP on its active WAN interfaces.
- PnP Discovery: The device uses DNS to contact the factory-default Cisco Plug-and-Play portal (
devicehelper.cisco.com). - Validator Redirection: The Cisco PnP portal verifies the device’s hardware serial number, identifies its associated enterprise Smart Account, and redirects the Edge router to the organization’s dedicated Validator public IP address.
- Mutual Authentication: The Edge router and Validator mutually authenticate using the router’s hardware-embedded Trusted Anchor module (TAm / Secure Unique Device Identifier [SUDI]) and the enterprise Root CA.
- Joining the Overlay: The Validator passes the IP addresses of the Manager and Controller to the router. The router tears down its session with the Validator, establishes permanent DTLS/TLS control connections with the Controllers, connects to the Manager to download its assigned Device Template, and begins establishing encrypted IPsec data tunnels with peer Edge routers.
Cisco Catalyst SD-WAN Validated Designs and Documentation
For enterprise production environments, Cisco publishes blueprints known as Cisco Validated Designs (CVDs). These documents provide tested, end-to-end architectures designed to eliminate guesswork around scalability, high availability, and security integration.
Core Architectural CVD Blueprints
- Cisco Catalyst SD-WAN End-to-End Deployment Guide: The foundational CVD detailing control plane placement, multi-region controller scaling, firewall parameter configuration, and hardware high-availability designs across branch, campus, and data center locations.
- Cloud OnRamp for SaaS CVD: Technical design specifications covering automated probing and optimal path selection for business-critical SaaS applications (e.g., Microsoft 365, Webex), including localized DNS resolution strategies and Direct Internet Access (DIA) security controls.
- Cloud OnRamp for Multi-Cloud (IaaS/Colocation) CVD: Reference architectures for automating transit VPC/VNet deployments across AWS, Azure, and Google Cloud, or deploying unified cloud interconnects within Equinix and Megaport colocation facilities.
- Secure SD-WAN / SASE Architecture Guide: Blueprints detailing the integration of on-premise security stacks (Snort IPS, Enterprise Firewall, URL Filtering, Advanced Malware Protection) and cloud-delivered security via Cisco Umbrella and Cisco Secure Access (Security Service Edge / SSE).
Documentation Hierarchy
When planning, configuring, and operating a fabric, administrators rely on four primary categories of technical documentation:
+-----------------------------------------------+
| CISCO VALIDATED DESIGNS (CVDs) |
| Comprehensive System Reference Blueprints |
+-----------------------+-----------------------+
|
+--------------------------------------+--------------------------------------+
| | |
v v v
+--------------------------+ +---------------------------+ +---------------------------+
| CONFIGURATION GUIDES | | COMMAND REFERENCES | | REST API DOCUMENTATION |
| Procedural, Task-Focused | | Edge CLI, IOS XE SD-WAN | | Programmatic Endpoints & |
| Setup and Feature Guides | | Debugging & Verification | | Postman Collection Specs |
+--------------------------+ +---------------------------+ +---------------------------+
- Configuration Guides: Task-focused, release-specific manuals (e.g., Cisco Catalyst SD-WAN Systems and Quality of Service Configuration Guide) organized by functional domain. These explain procedural configuration within the Manager GUI and template engines.
- Command Reference Guides: Low-level syntax documentation detailing Edge CLI commands, debug routines, and operational verification commands (e.g.,
show sdwan omp routes,show sdwan bfd sessions,show sdwan control connections) used for troubleshooting on Cisco IOS XE SD-WAN. - REST API Documentation: Interactive API references hosted locally on the Manager instance (accessible at
https://<vmanage-ip>/apidocs), detailing endpoints, JSON payloads, and authentication methods for programmatic network management. - Release Notes and Compatibility Matrices: Critical lifecycle documentation identifying hardware support, hypervisor compatibility, supported software upgrade paths, and verified bug fixes per target code release (e.g., Cisco IOS XE 17.x / Catalyst SD-WAN 20.x).
Cisco Catalyst SD-WAN Licensing Tiers and Subscription Models
Procuring Cisco Catalyst SD-WAN requires selecting a software subscription tier paired with the appropriate hardware or virtual routing platform. Cisco licenses SD-WAN under the Cisco Catalyst Software (formerly Cisco DNA) framework.
+----------------------------------------------------------------------------------+
| CISCO CATALYST SD-WAN PREMIER |
| [Includes Everything in Advantage PLUS Cisco Umbrella SIG / SSE Integrations, |
| ThousandEyes Enterprise Agents, & Full SASE Architecture] |
+----------------------------------------+-----------------------------------------+
|
+----------------------------------------v-----------------------------------------+
| CISCO CATALYST SD-WAN ADVANTAGE |
| [Includes Everything in Essentials PLUS Application-Aware Routing (AAR), |
| Cloud OnRamp (SaaS/IaaS), Integrated On-Box Security (IPS/NGFW), Multi-Region] |
+----------------------------------------+-----------------------------------------+
|
+----------------------------------------v-----------------------------------------+
| CISCO CATALYST SD-WAN ESSENTIALS |
| [Base SD-WAN Overlay, Centralized Management, Basic Path Steering, VPN Segments]|
+----------------------------------------------------------------------------------+
1. Cisco Catalyst SD-WAN Essentials
The entry-level tier for organizations needing basic SD-WAN connectivity without advanced cloud or security requirements:
* Capabilities: Centralized management via Catalyst SD-WAN Manager, basic overlay creation, static and basic dynamic routing, simple path preference steering, and segmentation (up to 4 VPNs).
* Limitations: Excludes Application-Aware Routing (AAR), advanced on-box security inspection, and Cloud OnRamp integrations.
* Target Environment: Small branch offices with basic dual-broadband connectivity that route all internet-bound traffic through a corporate data center.
2. Cisco Catalyst SD-WAN Advantage
The standard enterprise tier for most corporate and campus production environments:
* Capabilities: All capabilities of the Essentials tier, plus:
* Application-Aware Routing (AAR) based on live loss, latency, and jitter metrics.
* Unlimited segmentation and service VPNs.
* Cloud OnRamp for SaaS, IaaS, and Colocation environments.
* Integrated enterprise on-box security stack: Snort Intrusion Prevention System (IPS), Zone-Based Enterprise Firewall (ZBFW), URL Filtering, and Advanced Malware Protection (AMP).
* Cisco Multi-Region Fabric (Hierarchical SD-WAN) support.
* Advanced telemetry streaming, integration with Cisco DNA Spaces, and full REST API access.
* Target Environment: Distributed enterprises deploying local Direct Internet Access (DIA), hybrid cloud workloads, and multi-region WAN topologies.
3. Cisco Catalyst SD-WAN Premier
The premium enterprise tier, designed for organizations pursuing an integrated Secure Access Service Edge (SASE) architecture:
* Capabilities: All capabilities of the Advantage tier, plus:
* Built-in integration with Cisco Umbrella Secure Internet Gateway (SIG) / Cisco Secure Access, providing cloud-delivered DNS-layer protection, Secure Web Gateway (SWG), and Cloud Access Security Broker (CASB).
* Bundled enterprise licensing for Cisco ThousandEyes, supporting synthetic testing and monitoring across internet, cloud, and SaaS paths directly from Edge routers.
* Target Environment: Modern cloud-first enterprises requiring end-to-end network visibility and unified SASE security across distributed branches and remote workers.
4. Bandwidth and Throughput Tiers
Cisco structures software licenses according to the aggregate encrypted throughput passing through the edge router. Subscriptions are organized into standardized performance brackets:
* Tier 0 (T0): Up to 25 Mbps aggregate encrypted throughput (tailored for ultra-small branches, retail kiosks, or IoT deployments).
* Tier 1 (T1): Up to 100 Mbps aggregate encrypted throughput.
* Tier 2 (T2): Up to 250 Mbps to 1 Gbps aggregate encrypted throughput (standard branch and regional office deployments).
* Tier 3 (T3): Greater than 1 Gbps aggregate encrypted throughput (high-capacity campus edges, aggregated hub environments, and primary data centers).
5. Procurement and Subscription Terms
- Term Lengths: Licenses are procured as recurring subscriptions over 3-, 5-, or 7-year terms.
- Hosting Entitlement: Cloud-hosted controller infrastructure (Manager, Controller, Validator) managed by Cisco is included at no additional hosting cost for Advantage and Premier subscription tiers.
- Portability: Catalyst software licenses are generally portable across hardware generations, allowing organizations to upgrade physical router platforms during the subscription term without repurchasing their base software entitlement.
Cisco SD-WAN replaces rigid, hardware-bound enterprise networks with an agile, software-defined overlay. By separating the network into orchestration, management, control, and data planes, it gives administrators centralized visibility and control over distributed environments. Technologies like OMP, zero-touch key exchange, and Application-Aware Routing automate secure tunnel deployment and ensure traffic flows dynamically along the healthiest paths. Combined with standardized CVD reference architectures and flexible subscription licensing, the platform provides a clear path to modernizing enterprise transport and establishing an integrated Secure Access Service Edge.
Comments