Cisco Catalyst SD-WAN High Availability Configuration Guide, Releases 26.x and Later

Resilient data plane for Cisco Catalyst SD-WAN

Updated: October 14, 2026

Want to summarize with AI?

Introduces the resilient data plane feature for Cisco Catalyst SD-WAN, explaining its activation, backup tunnel setup with IKEv2/IPsec and BGP, and seamless traffic forwarding in case of control component connectivity loss.

Resilient data plane is a high availability feature that

helps a device maintain branch-to-hub connectivity when the device loses control connections to the SD-WAN Control Components for an extended period, and
uses standard IKEv2/IPsec tunnels and BGP routes that operate independently of the SD-WAN Control Components.

Cisco Catalyst SD-WAN normally uses connections to the Cisco Catalyst SD-WAN Control Components, OMP routes, and Cisco Catalyst SD-WAN IPsec tunnels to forward traffic. If a Cisco IOS XE Catalyst SD-WAN device cannot reach the Cisco SD-WAN Control Components for an extended period, or starts without connectivity to these components, the Cisco Catalyst SD-WAN overlay might not be available even when an underlay path to a hub remains reachable.

The resilient data plane provides a backup path. When the activation conditions are met, the Cisco IOS XE Catalyst SD-WAN device brings up locally configured IKEv2/IPsec tunnels to one or more hubs. BGP exchanges routes across each tunnel in its single configured service VRF. When connectivity to one of the Cisco SD-WAN Control Components or an overlay BFD session becomes available again, the device disables the resilient tunnels and returns to normal Cisco Catalyst SD-WAN forwarding.

Benefits

Maintains branch connectivity when the Cisco Catalyst SD-WAN overlay and Cisco SD-WAN Control Components are unavailable but an underlay path to a hub still works.
Supports recovery after a cold boot without connectivity to the Cisco SD-WAN Control Components.
Supports multiple service VRFs, hubs, and transports. Only one resilient tunnel is supported for each tunnel source and tunnel destination pair.
Uses standard IKEv2/IPsec and BGP functions that do not depend on the Cisco SD-WAN Control Components.
Automatically returns traffic to the Cisco Catalyst SD-WAN overlay after connectivity recovers.

How the resilient data plane works

Summary

The device enters resilient mode when all the following conditions are met:

All Cisco Catalyst SD-WAN overlay BFD sessions are down, or Graceful Restart has expired.
No connection to the Cisco Catalyst SD-WAN Controller is available.
The cold-boot activation delay has expired, when applicable.
If a last-resort circuit is configured, the LR activation delay has expired without restoring Cisco Catalyst SD-WAN connectivity.

Workflow

In resilient mode, the device enables all configured resilient tunnels across all protected service VRFs. Each tunnel negotiates an IKEv2/IPsec security association.

The device exits resilient mode when any overlay BFD session or connection to one of the Cisco SD-WAN Control Components becomes available.

Compatibility information for the resilient data plane

Objective

Use this information to confirm that your IIoT router platform and Cisco Catalyst SD-WAN environment support the resilient data plane.

Supported platforms

The resilient data plane is supported only on the following IIoT router platforms operating in Cisco Catalyst SD-WAN mode.


Platform	Supported models
Cisco Catalyst IR1101 Rugged Series Router	IR1101
Cisco Catalyst IR1800 Rugged Series Routers	IR1835
Cisco Catalyst IR8140 Heavy Duty Series Router	IR8140
Cisco Catalyst IR8340 Rugged Series Router	IR8340

Software and system requirements


Requirement	Support information
Device software	Cisco IOS XE Catalyst SD-WAN Release 26.2.1 or later
Operating mode	Cisco Catalyst SD-WAN mode
Licensing	No special license is required for the resilient data plane.
Controller requirements	Cisco Catalyst SD-WAN Control Components Release 26.2.1 or later

Prerequisites for the resilient data plane

Before you configure the resilient data plane, ensure that the following conditions are met:

IP connectivity is available between the branch tunnel source and the hub tunnel endpoint.
The hub is configured as an IKEv2/IPsec responder and a BGP peer for each protected service VRF
Matching IKEv2 pre-shared keys are configured on the hub and branch Cisco IOS XE Catalyst SD-WAN devices.
You have identified the service VRFs, tunnel addresses, BGP autonomous system numbers, and routes to advertise.
Each resilient BGP neighbor in a service VRF has a unique BGP administrative distance greater than 251.

Restrictions for the resilient data plane

When you configure and use the resilient data plane, follow these restrictions:

Only service VRFs with a resilient tunnel configuration can use the backup path.
Configure the resilient data plane only through the CLI. Cisco SD-WAN Manager configuration is not supported.
Application-Aware Routing (AAR) and centralized data policies are not supported for resilient tunnels. Use route maps to filter resilient-tunnel BGP routes; centralized control policies do not apply to these routes.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.