Customer Success - Guided resource

Cisco Catalyst SD-WAN: Getting started guide

This guide walks you through the core steps required to get your network up and running, from initial onboarding to operational best practices.

  • Networking
  • Catalyst SD-WAN
  • Guide

Controller deployment and security trust

Deploy and bring up Cisco Catalyst SD-WAN Manager, Validator, and Controller instances

Provision and bring up the SD-WAN management and control elements: ensure at least one active instance of Cisco Catalyst SD-WAN Manager, SD-WAN Validator, and SD-WAN Controller cluster.

Content summarized by AI

To help you get started with your task, content across Cisco recommended sources has been summarized by AI

Information:  Summary is generated by AI and may not be validated by a subject matter expert.  Before using results, verify accuracy and completeness via the sources links below.

Summarized on September 30, 2026

To deploy the SD-WAN control plane components, software images for Cisco Catalyst SD-WAN Manager (vManage), SD-WAN Validator (vBond), and SD-WAN Controller (vSmart) must first be downloaded from the Cisco Software Download page. Ensure you select from the image format matching your target environment:

  • VMware ESXi: Download .ova packages.
  • Linux KVM / CML / OpenStack: Download .qcow2 packages.
  • Public Cloud (AWS, Azure, GCP): Deploy via Marketplace or cloud templates.
(Note: SD-WAN Validator images reside under WAN Edge Cloud category). [1]  Each VM is then deployed with required compute/RAM and secondary disk.

When the SD-WAN Manager VM boots for the first time, the administrator logs in with default credentials (admin/admin), sets a new password, selects a persona, and assigns a secondary disk [1]. Persona selection is critical for cluster deployments:
  • Standalone SD-WAN Manager: COMPUTE_AND_DATA
  • 3-node cluster: all three nodes use COMPUTE_AND_DATA
  • 6-node cluster: three nodes use COMPUTE_AND_DATA and three use DATA

After the VM reboots, the VPN 512 management interface (eth0) should be configured to enable out-of-band SSH access. The SD-WAN Validator and SD-WAN Controller nodes follow the same boot and interface configuration process as vManage, with vSmart performing identical steps to SD-WAN Validator [1].

Once SSH access is available on all controllers, basic CLI configuration must be applied to each node, including system hostname, a unique system IP, site ID, organization name, and the SD-WAN Validator address [1]. A VPN 0 transport interface with a tunnel interface must also be configured to enable control connections with routers and other controllers. Optionally, TLS can be configured as the control protocol on SD-WAN Controller and SD-WAN Manager nodes if required.

After the configuration is applied, verify that control connections are established using the CLI command show sdwan control connections. Alternatively, in SD-WAN Manager, navigate to Device Details > Control Connections or Troubleshooting > Control Connections (Live View). Once edge routers are on-boarded, data plane health can be checked with show sdwan bfd sessions, or by viewing real-time Tunnel and TLOC health under the WAN tab in Device Details.

Sources

  1. Rebuild Your Catalyst SD-WAN Fabric

Additional sources:

Copy
Helpful
Unhelpful
Next