Cloud-hosted SD-WAN control component access

Updated: July 30, 2026

Want to summarize with AI?

Provides guidelines for edge device and management access to cloud-hosted SD-WAN control components, including VPN interface configuration and domain name usage.

Edge device access to SD-WAN control components

Use the VPN 0 tunnel interface to connect edge devices to SD-WAN control components.

Configure edge devices to communicate with SD-WAN control components using Transport Layer Security (TLS) or Datagram Transport Layer Security (DTLS) ports.

Firewall configuration

If your deployment includes an on-premises firewall, enable traffic on any safe IP address range, such as 0.0.0.0, for these TLS or DTLS ports. Alternatively, enable traffic to the current public IP addresses of the cloud-based SD-WAN control components.

Note

To find the assigned public IP address, log in to the Catalyst SD-WAN Portal and navigate to: Overlay Details > Controller view > Public IP.

For more information about TLS and DTLS ports, refer to the "Ports Used by Cisco Catalyst SD-WAN Devices Running Multiple vCPUs" section in the Cisco Catalyst SD-WAN Getting Started Guide.

Management access to SD-WAN Manager

Connect to SD-WAN Manager for management access using fully qualified domain names (FQDNs) mapped to the VPN 512 public IP. 

If the fabric is provisioned with a three-node or six-node SD-WAN Manager cluster, then the FQDN resolves to the public IP addresses of all of the SD-WAN Manager instances.

HTTPS access for SD-WAN Manager

You can access SD-WAN Manager using HTTP or HTTPS. You cannot access other SD-WAN control components by HTTP or HTTPS.

Domain names for SD-WAN Manager and SD-WAN Validator

In a Cloud-hosted SD-WAN environment, domain names are assigned only to SD-WAN Manager and SD-WAN Validator for cloud hosting.

Access SD-WAN Validator by domain name

When you configure nodes in the SD-WAN fabric, use the FQDN of the SD-WAN Validator. Do not use the IP address. Using the domain name ensures continued reliable operation in case the SD-WAN Validator IP addresses change or more SD-WAN Validators are added to the fabric.

DNS server recommendation

Configure a DNS server accessible in VPN 0 for all nodes in the SD-WAN fabric, including hardware and software edge devices and control components.

Example DNS configuration:

vpn 0 
   dns 208.67.222.222 primary
   dns 208.67.220.220 secondary

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.