Summarized on September 30, 2026
†he controller hosting model must be selected before any devices are deployed, since control components are always brought up first. [1] The two primary options are:
- Cisco Cloud-Hosted (recommended): Control components (SD-WAN Manager, SD-WAN Controller, SD-WAN Validator) are deployed in AWS or Azure and managed by Cisco, which handles provisioning, certificates, redundancy, backups, and disaster recovery. This model requires Internet reachability from WAN Edge routers.
- On-Premises Deployment: Control components are hosted in a customer-owned data center or private cloud on ESXi or KVM. The customer is responsible for provisioning, certificates, backups, and disaster recovery. This model is often chosen by organizations with strict security or compliance requirements, such as financial institutions or government entities.
The next step is to assess the existing enterprise WAN architecture and the transport circuits available at each site. [1] Legacy WAN architectures typically rely on MPLS paired with Internet or LTE in an active/backup fashion, but Cisco Catalyst SD-WAN supports a mix of MPLS, Direct Internet Access (DIA), and 4G/5G cellular transports operating in an active/active fashion to optimize capacity and reduce bandwidth costs. Each transport is identified by a color attribute on the WAN Edge router's tunnel interface, and common transport choices include:
- MPLS (private color) for business-critical or latency-sensitive traffic
- Broadband Internet (public color such as biz-internet) for bulk or general data traffic
- LTE/cellular as an active transport or circuit of last resort that activates only when all other transports become unavailable
The network topology model — hub-and-spoke, full-mesh, or regional mesh — must also be determined during planning. [1] By default, WAN Edge routers attempt to build IPsec tunnels to all other TLOCs in the overlay, creating a full mesh. Hub-and-spoke or partial-mesh topologies can be enforced using centralized control policies or tunnel groups, which is especially useful for limiting tunnel scale at branch sites. For large deployments, a multi-regional design groups WAN Edge routers within regions, with border routers connecting to other regions and preventing intra-region TLOCs from being advertised across regional boundaries.