Hands-On Lab: Configuring SD-WAN Basic Overlay with vManage-Style Templates (Conceptual CLI)

Lab Objective

Configure two SD-WAN edge routers with system and TLOC parameters, verify each establishes a control connection to a controller, and confirm a data plane BFD/IPsec tunnel forms directly between the two edges over the overlay.

Lab Purpose

The DMVPN labs covered earlier in this series required manually configuring NHRP, tunnel interfaces, and routing protocols on every device individually. SD-WAN centralizes this: edge routers register with a controller, which then distributes policy and connectivity information, allowing overlay tunnels to form largely automatically rather than through hop-by-hop manual configuration.

Lab Topology

Edge1 (Site 100) ---- WAN ---- Controller (vSmart-equivalent)
Edge2 (Site 200) ---- WAN ---- Controller

Edge1 and Edge2 should form a direct
overlay tunnel once both register

Task 1: Configure System Parameters on Edge1

Configure the system-ip, site-id, and organization-name identifying Edge1 within the SD-WAN fabric.

Task 2: Configure a TLOC (Transport Locator) on Edge1

Configure the WAN-facing interface as a TLOC, associating it with a color identifying this transport.

Task 3: Repeat Configuration on Edge2

Configure Edge2 with its own system-ip, site-id, and TLOC.

Task 4: Verify Control Connections to the Controller

Confirm both edges establish a control connection (typically DTLS/TLS) to the controller.

Task 5: Verify a Direct Data Plane Tunnel Forms Between Edges

Confirm an IPsec/BFD tunnel establishes directly between Edge1 and Edge2 without manual tunnel configuration on either device.

Solution and Verification

Edge1(config)# system
Edge1(config-system)# system-ip 10.255.1.1
Edge1(config-system)# site-id 100
Edge1(config-system)# organization-name LAB-ORG

Edge1(config)# sdwan
Edge1(config-sdwan)# interface GigabitEthernet0/1
Edge1(config-interface-GigabitEthernet0/1)# tunnel-interface
Edge1(config-tunnel-interface)# color biz-internet
Edge1(config-tunnel-interface)# encapsulation ipsec

-- Unlike the manual "tunnel source/
-- destination" commands used in earlier
-- GRE and DMVPN labs, a TLOC only
-- describes THIS edge's transport
-- attachment -- the controller handles
-- matching it against remote TLOCs

Edge2(config)# system
Edge2(config-system)# system-ip 10.255.2.1
Edge2(config-system)# site-id 200
Edge2(config-system)# organization-name LAB-ORG

Edge2(config)# sdwan
Edge2(config-sdwan)# interface GigabitEthernet0/1
Edge2(config-interface-GigabitEthernet0/1)# tunnel-interface
Edge2(config-tunnel-interface)# color biz-internet
Edge2(config-tunnel-interface)# encapsulation ipsec

Edge1# show sdwan control connections

PEER    PEER    SITE    DOMAIN  PEER
TYPE    SYSTEM-IP  ID    ID      STATE
vsmart  1.1.1.1    0     1       up
-- Confirms Edge1 has a control connection
-- established to the controller, exchanging
-- OMP (Overlay Management Protocol) routes
-- and policy

Edge1# show sdwan bfd sessions

SYSTEM IP     SITE ID   STATE   SOURCE TLOC    REMOTE TLOC
10.255.2.1    200       up      biz-internet   biz-internet
-- A BFD session, and beneath it an IPsec
-- tunnel, formed directly between Edge1 and
-- Edge2 once both registered with the
-- controller and the controller distributed
-- each edge's TLOC and reachability
-- information to the other -- neither
-- edge required a manually configured
-- tunnel destination pointing at the other

Key Takeaway

SD-WAN's fundamental shift from the manually configured DMVPN overlays covered earlier in this series is the controller-mediated establishment of data plane tunnels: each edge only describes its own local transport attachment (the TLOC), and the controller's OMP-distributed information is what allows two edges that were never directly told about each other to still form a tunnel automatically — replacing per-device manual peering configuration with centralized, controller-driven overlay formation.