SD-WAN Architecture Overview

Software-Defined WAN (SD-WAN) replaces the traditional hardware-centric WAN with a software-based virtual IP fabric that runs as an overlay on top of ordinary transport services. Rather than every router making independent routing decisions the way a legacy WAN does, the Cisco SD-WAN solution splits its architecture into four distinct planes, each handling a specific part of the job.

Orchestration Plane (vBond)

vBond is responsible for authenticating and authorizing every SD-WAN component before it’s allowed to join the fabric, effectively acting as the gatekeeper for control connections. It also distributes vSmart and vManage reachability information out to the WAN Edge routers, so they know how to reach the rest of the control infrastructure, and it helps devices behind NAT establish connectivity. Because it has to be the very first point of contact for a new device joining the fabric, vBond is the only SD-WAN component that needs a public IP address — every other component only needs to know vBond’s address or DNS name to get started.

Management Plane (vManage)

vManage gives administrators centralized configuration, monitoring, and troubleshooting through a single GUI — often described as a “single pane of glass” for the whole SD-WAN fabric. It provides real-time alerting, centralized provisioning, and helps keep configuration standardized across the fabric. vManage also exposes a REST API and supports CLI, Syslog, SNMP, and NETCONF, and it is where policies are actually authored before being pushed out — over NETCONF — to vSmart or vEdge devices.

Control Plane (vSmart)

vSmart handles fabric discovery and keeps an OMP (Overlay Management Protocol) peering relationship with every vEdge in the fabric. Through this peering, it distributes connectivity information between vEdges and orchestrates how secure data-plane connections between them get established. vSmart is also where control policies live — things like service chaining, traffic engineering, and controlling the topology on a per-VPN basis — and it stores centralized policy while distributing data policy out to the devices that need to enforce it.

Data Plane (vEdge)

vEdge routers are what actually forward traffic, acting on the decisions handed down from the control plane and building secure tunnels directly to other vEdges. They take care of encryption, general traffic security, and QoS enforcement, while keeping a secure control connection back to vSmart over OMP. vEdges are also where data policy and application-aware routing policy get implemented, and they export performance statistics back up to the management plane. They support standard routing protocols like OSPF and BGP along with VRRP, come in both physical and virtual form factors (with throughput tiers around 100 Mbps, 1 Gbps, and 10 Gbps), and support Zero Touch Deployment for easier rollout.

Topology: Full Mesh by Default

Left to its default behavior, every vEdge in the fabric tries to build an IPsec tunnel to every other vEdge across every available link, which quickly turns into a full mesh with a lot of management overhead as the fabric grows. Policy can be used to deliberately limit this — shaping the topology into a hub-and-spoke design, a partial mesh, or some hybrid combination that better fits the actual traffic patterns of the business.