Cisco Catalyst SD-WAN Onboarding Guide, Releases 26.x and Later

PDF

Configure the vBond orchestrator

Updated: July 7, 2026

Want to summarize with AI?

Log in

Configure the vBond orchestrator to enable device authentication and integration into the overlay network. This process includes initial CLI setup, system IP assignment, WAN interface configuration, and preparation for template-based management.

Configure the vBond orchestrator to provide essential authentication and orchestration functions in the overlay network. This task ensures that vBond is reachable, properly identified, and ready for device onboarding and management.

  • Enable device authentication and verification for overlay network participation.

  • Prepare vBond for management via configuration templates in vManage.

Follow these steps to configure the vBond orchestrator for initial operation in the overlay network:

The vBond orchestrator is a critical component in Cisco SD-WAN deployments, responsible for authenticating and verifying devices before they join the overlay network. This task is performed after deploying the vBond VM or hardware and before attaching configuration templates from vManage.

Use this procedure when setting up a new vBond instance or reinitializing an existing one to factory defaults.

  • Perform this configuration before onboarding other devices to the overlay network.

Before you begin

Ensure the vBond VM or hardware is deployed and powered on in your overlay network environment. You must have SSH access to the vBond device and the default admin credentials.

  • vBond must have a public IP address for overlay network connectivity.

  • Default username and password are both admin.

Procedure

1.

Open a CLI session to Cisco SD-WAN Validator via SSH.
2.

Log in as the user admin, using the default password admin. The CLI prompt is displayed.
3.

Enter configuration mode.

For Cisco Catalyst SD-WAN Control Components Release 20.14.x and later releases:

Example:

vSmart# config
vSmart(config)#

For releases before Cisco Catalyst SD-WAN Control Components Release 20.14.x:

Example:

vBond# config 
vBond(config)#
4.

Configure the hostname.

For Cisco Catalyst SD-WAN Control Components Release 20.14.x and later releases:

Example:

vSmart(config)# system host-name vBond

For releases before Cisco Catalyst SD-WAN Control Components Release 20.14.x:

Example:

vBond(config)# system host-name hostname

Configuring the hostname is optional, but recommended. The hostname appears in the CLI prompt and on various Cisco SD-WAN Manager screens to identify the device.
5.

Configure the system IP address.

Example:

vBond(config-system)#system-ip ip-address

Cisco SD-WAN Manager uses the system IP address to identify the device for configuration management.
6.

Configure the IP address of Cisco SD-WAN Validator as a public address.

Example:

vBond(config-system)#vbond ip-address local

In Releases 16.3 and later, the address can be IPv4 or IPv6. In earlier releases, it must be IPv4. The local option designates the device as vBond, not a vEdge router. vBond must run on a standalone VM or hardware router.

The IP address must be a public address so that all devices in the overlay network can reach Cisco SD-WAN Validator.
7.

Configure a time limit for confirming a software upgrade is successful.

Example:

vBond(config-system)#upgrade-confirm minutes

The time can be from 1 through 60 minutes. If confirmation is not received within the configured time, the device reverts to the previous software image.
8.

Change the password for the user "admin".

Example:

vBond(config-system)#user admin password password

The default password is "admin".
9.

Configure an interface in VPN 0 to connect to the Internet or WAN transport network.

Example:

vBond(config)#vpn 0 interface interface-name
vBond(config-interface)#ip address ipv4-prefix/length
vBond(config-interface)#ipv6 address ipv6-prefix/length
vBond(config-interface)#tunnel-interface
vBond(config-tunnel-interface)# encapsulation ipsec
vBond(config-interface)#no shutdown

In Releases 16.3 and later, the IP address can be IPv4 or IPv6. In earlier releases, it must be IPv4. Ensure the prefix for the interface contains the IP address configured in the vbond local command.

Note

The encapsulation ipsec command is not mandatory for configuring a tunnel interface in these releases:

  • Cisco Catalyst SD-WAN Control Components Release 20.18.1 and later

  • Cisco Catalyst SD-WAN Control Components Release 20.15.3 and later release of 20.15.x

Note

The IP address must be a public address so that all devices in the overlay network can reach Cisco SD-WAN Validator.
10.

Commit the configuration.

Example:

vBond(config)#commit and-quit
vBond#
11.

Verify that the configuration is correct and complete.

Example:

vBond#show running-config
12.

After the overlay network is operational, create a vBond configuration template on Cisco SD-WAN Manager containing the initial configuration parameters.

  • System feature template: configure hostname, system IP address, and vBond functionality.

  • AAA feature template: configure a password for the "admin" user.

  • VPN Interface Ethernet feature template: configure the interface in VPN 0.

It is also recommended to configure the following general system parameters:

  • From the Cisco SD-WAN Manager menu, choose Administration > Settings and configure Organization name.

  • From the Cisco SD-WAN Manager menu, choose Configuration > Templates. From System configuration template drop-down, select create template and configure Timezone, NTP servers, and device physical location.

  • Click Additional Templates and from banner feature template drop-down, select Create Template. Configure Login banner.

  • From System feature configuration template drop-down, select Create Template and configure disk and server parameters.

  • From AAA feature configuration template drop-down, select Create Template and configure AAA, RADIUS and TACACS servers.

  • Click Additional Templates and from SNMP feature template drop-down, select Create Template and configure SNMP.

    Note

    For Cisco SD-WAN Validators, SNMP polling should only be performed using VPN 512 interface.

After completing this task, the vBond orchestrator is configured with a public IP address, system parameters, and WAN connectivity. The device is ready for integration into the overlay network and further management via vManage configuration templates.

Below is an example of a simple configuration on Cisco SD-WAN Validator. This configuration includes several factory-default and default values.

vBond#show running-config 
system
 host-name         vBond
 gps-location latitude 40.7127837
 gps-location longitude -74.00594130000002
 system-ip         172.16.240.161
 organization-name "Cisco"
 clock timezone America/Los_Angeles
 vbond 11.1.1.14 local
 aaa
  auth-order local radius tacacs
  usergroup basic
   task system read write
   task interface read write
  !
  usergroup netadmin
  !
  usergroup operator
   task system read
   task interface read
   task policy read
   task routing read
   task security read
  !
  user admin
   password encrypted-password
  !
 !
 logging
  disk
   enable
  !
!
vpn 0
 interface ge0/0
  ip address 11.1.1.14/24
  no shutdown
 !
 ip route 0.0.0.0/0 11.1.1.1
!
vpn 512
 interface eth0
  ip dhcp-client
  no shutdown
 !
!

What to do next

See Add Cisco SD-WAN Validator to the Overlay Network for next steps.