Deploy Cisco Catalyst SD-WAN Validator

Updated: July 7, 2026

Want to summarize with AI?

Configure the Cisco SD-WAN Validator orchestrator to authenticate controllers and routers, coordinate connectivity, and enable overlay network communication. Verify that the orchestrator is accessible and integrated with Cisco SD-WAN Manager.

Deploying the Cisco SD-WAN Validator orchestrator enables authentication of Cisco SD-WAN Controller controllers and vEdge routers, and coordinates connectivity within the overlay network.

Establishes secure communication between devices in the overlay network.
Allows devices behind NAT gateways to connect using a public IP address.

The Cisco SD-WAN Validator orchestrator is a software module that must be accessible to all devices in the overlay network. It is recommended to place it in a DMZ and assign a public IP address for connectivity.

Assigning a public IP address allows Cisco SD-WAN Controller controllers and vEdge routers in private address spaces to establish communication. The orchestrator runs as a VM on a network server and can be located anywhere in the network.

A Cisco Catalyst SD-WAN overlay network can have one or more Cisco SD-WAN Validators.

Before you begin

Ensure you have access to an ESXi or KVM hypervisor and a network server to host the Cisco SD-WAN Validator VM instance.

Verify network connectivity and availability of SSH access for configuration.

Follow these steps to deploy Cisco SD-WAN Validators:

Procedure

	1.	Create a Cisco SD-WAN Validator VM instance, either on an ESXi or a KVM hypervisor.
	2.	Create a minimal configuration for Cisco SD-WAN Validator, to allow it to be accessible on the network. Use SSH to open a CLI session to Cisco SD-WAN Validator and manually configure the device.
	3.	Add Cisco SD-WAN Validator to the overlay network so that Cisco SD-WAN Manager is aware of it.
	4.	If you are hosting Cisco Catalyst SD-WAN zero-touch-provisioning (ZTP) Cisco SD-WAN Validator server in your enterprise, configure one Cisco SD-WAN Validator to perform this role.
	5.	Create a full configuration for Cisco SD-WAN Validator. Use SSH to open a CLI session to Cisco SD-WAN Validator for the initial configuration. Then create configuration templates on Cisco SD-WAN Manager and attach them to Cisco SD-WAN Validator. When attached, the template parameters overwrite the initial configuration.

After completing these steps, the Cisco SD-WAN Validator orchestrator is deployed, accessible on the network, and integrated with Cisco SD-WAN Manager. Devices in the overlay network can authenticate and communicate securely.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.