SD-WAN & SD-Access Quick Reference

Both SD-WAN and SD-Access separate the control plane (a centralized controller making policy/routing decisions) from the data plane (the actual devices forwarding traffic) — this is the defining shift from traditional, per-device CLI-driven networking to controller-based networking.

vManage: the management/orchestration plane — where policy is defined and monitoring happens.

vSmart: the control plane — distributes routing and policy information to WAN edge routers using a control protocol (OMP).

vBond: the orchestration plane — handles initial authentication and connectivity between components.

vEdge/cEdge: the data plane — WAN edge routers actually forwarding traffic based on what the control plane told them.

Benefits: centralized policy across every branch at once, transport-independent (MPLS, broadband, LTE all treated uniformly), application-aware routing.

Limitations: added architectural complexity, a genuine learning curve for teams used to per-device CLI, and licensing/cost considerations that don't apply to a traditional WAN edge router.

Fabric control plane: based on LISP, maps endpoint identity to location.

Fabric data plane: VXLAN encapsulation, carrying the original frame across the fabric with the endpoint's identity preserved regardless of physical location.

Fabric policy plane: TrustSec/SGT-based, applying identity-based segmentation independent of IP addressing.

A fusion router (or a border node acting in that role) is the integration point between an SD-Access fabric and a traditional, non-fabric network — it translates between the fabric's VXLAN/LISP-based forwarding and conventional routing the rest of the campus still uses.

A full flash-cut to SD-Access everywhere at once is rarely realistic — expect a genuine transition period where fabric and traditional segments coexist and interoperate through these integration points.