Lab Objective
Configure two SD-WAN edge routers with system and TLOC parameters, verify each establishes a control connection to a controller, and confirm a data plane BFD/IPsec tunnel forms directly between the two edges over the overlay.
Lab Purpose
The DMVPN labs covered earlier in this series required manually configuring NHRP, tunnel interfaces, and routing protocols on every device individually. SD-WAN centralizes this: edge routers register with a controller, which then distributes policy and connectivity information, allowing overlay tunnels to form largely automatically rather than through hop-by-hop manual configuration.
Lab Topology
Edge1 (Site 100) ---- WAN ---- Controller (vSmart-equivalent)
Edge2 (Site 200) ---- WAN ---- Controller
Edge1 and Edge2 should form a direct
overlay tunnel once both registerTask 1: Configure System Parameters on Edge1
Configure the system-ip, site-id, and organization-name identifying Edge1 within the SD-WAN fabric.
Task 2: Configure a TLOC (Transport Locator) on Edge1
Configure the WAN-facing interface as a TLOC, associating it with a color identifying this transport.
Task 3: Repeat Configuration on Edge2
Configure Edge2 with its own system-ip, site-id, and TLOC.
Task 4: Verify Control Connections to the Controller
Confirm both edges establish a control connection (typically DTLS/TLS) to the controller.
Task 5: Verify a Direct Data Plane Tunnel Forms Between Edges
Confirm an IPsec/BFD tunnel establishes directly between Edge1 and Edge2 without manual tunnel configuration on either device.
Solution and Verification
Edge1(config)# system
Edge1(config-system)# system-ip 10.255.1.1
Edge1(config-system)# site-id 100
Edge1(config-system)# organization-name LAB-ORGEdge1(config)# sdwan
Edge1(config-sdwan)# interface GigabitEthernet0/1
Edge1(config-interface-GigabitEthernet0/1)# tunnel-interface
Edge1(config-tunnel-interface)# color biz-internet
Edge1(config-tunnel-interface)# encapsulation ipsec
-- Unlike the manual "tunnel source/
-- destination" commands used in earlier
-- GRE and DMVPN labs, a TLOC only
-- describes THIS edge's transport
-- attachment -- the controller handles
-- matching it against remote TLOCsEdge2(config)# system
Edge2(config-system)# system-ip 10.255.2.1
Edge2(config-system)# site-id 200
Edge2(config-system)# organization-name LAB-ORG
Edge2(config)# sdwan
Edge2(config-sdwan)# interface GigabitEthernet0/1
Edge2(config-interface-GigabitEthernet0/1)# tunnel-interface
Edge2(config-tunnel-interface)# color biz-internet
Edge2(config-tunnel-interface)# encapsulation ipsecEdge1# show sdwan control connections
PEER PEER SITE DOMAIN PEER
TYPE SYSTEM-IP ID ID STATE
vsmart 1.1.1.1 0 1 up
-- Confirms Edge1 has a control connection
-- established to the controller, exchanging
-- OMP (Overlay Management Protocol) routes
-- and policyEdge1# show sdwan bfd sessions
SYSTEM IP SITE ID STATE SOURCE TLOC REMOTE TLOC
10.255.2.1 200 up biz-internet biz-internet
-- A BFD session, and beneath it an IPsec
-- tunnel, formed directly between Edge1 and
-- Edge2 once both registered with the
-- controller and the controller distributed
-- each edge's TLOC and reachability
-- information to the other -- neither
-- edge required a manually configured
-- tunnel destination pointing at the otherKey Takeaway
SD-WAN's fundamental shift from the manually configured DMVPN overlays covered earlier in this series is the controller-mediated establishment of data plane tunnels: each edge only describes its own local transport attachment (the TLOC), and the controller's OMP-distributed information is what allows two edges that were never directly told about each other to still form a tunnel automatically — replacing per-device manual peering configuration with centralized, controller-driven overlay formation.