Sign in Subscribe
CCNP-ENCOR

Understanding Cisco Catalyst SD-WAN Control and Data Planes

Explains the separation and interaction between control and data planes in Cisco Catalyst SD-WAN architecture. Covers vSmart controller functions, WAN Edge data plane operations, and how these components work together for policy enforcement and traffic optimization.

Jay Whale

• 4 min read
Understanding Cisco Catalyst SD-WAN Control and Data Planes

Cisco Catalyst SD-WAN separates network intelligence into distinct control and data planes, creating a scalable architecture that centralizes policy management while distributing packet forwarding. Understanding how these planes interact and their individual responsibilities is fundamental to designing, implementing, and troubleshooting enterprise SD-WAN deployments.

SD-WAN Architecture Overview

The Catalyst SD-WAN architecture follows a controller-based model where the control plane maintains network state and policy information, while the data plane handles actual packet forwarding. This separation enables centralized management of distributed edge devices while maintaining high-performance packet processing at each site.

The architecture consists of four primary components: vManage (management plane), vSmart (control plane), vBond (orchestration plane), and WAN Edge routers (data plane). Each serves specific functions in maintaining network operations and policy enforcement.

Control Plane Elements

The control plane in Catalyst SD-WAN encompasses both the vSmart controllers and the control plane functions within WAN Edge devices. The vSmart controller acts as the central brain, maintaining routing tables, enforcing policies, and distributing network state information.

vSmart Controller Functions

The vSmart controller maintains the Overlay Management Protocol (OMP) sessions with all WAN Edge devices. OMP serves as the control protocol, similar to BGP in traditional networks, but optimized for SD-WAN operations. It advertises routes, services, and policies across the fabric.

vSmart# show omp peers
                         PEER            DOMAIN    SITE      STATE                    UPTIME
2.2.2.2                  1            100       up                       0:02:13:45
3.3.3.3                  1            200       up                       0:02:13:42
4.4.4.4                  1            300       up                       0:01:45:23

Control plane elements include route redistribution, policy application points, and service chaining decisions. The vSmart controller processes all routing information and applies centralized policies before redistributing approved routes to appropriate WAN Edge devices.

Policy Distribution

Centralized policies flow from vManage to vSmart controllers, which then distribute them to WAN Edge devices. These policies include data policies (traffic engineering), control policies (routing influence), and security policies (firewall rules, application-aware routing).

vSmart# show omp summary
                                      OPER      ADMIN
PREFIX_UP_THRESH                      75000     75000
PREFIX_DOWN_THRESH                    65000     65000
ROUTES_RECEIVED                       1245      
ROUTES_INSTALLED                      1245      
ROUTES_SENT                           890

Data Plane Functions

The data plane resides primarily within WAN Edge routers, where actual packet forwarding occurs. Data plane functions include packet encapsulation, tunnel establishment, and real-time traffic steering based on policies received from the control plane.

Tunnel Management

WAN Edge devices establish IPSec tunnels between sites based on control plane directives. The data plane maintains tunnel state information and performs encapsulation/decapsulation operations. Each tunnel carries performance metrics that influence routing decisions.

vEdge# show bfd sessions
                                      SOURCE TLOC      REMOTE TLOC       COLOR    STATE  
100.1.1.1                             12346    200.2.2.2                12346    biz-internet  up     
100.1.1.1                             12346    200.2.2.2                12347    mpls          up     
100.1.1.1                             12366    300.3.3.3                12346    biz-internet  up

The data plane continuously monitors tunnel quality using Bidirectional Forwarding Detection (BFD) sessions. These measurements feed back to the control plane for path selection and policy enforcement decisions.

Traffic Engineering

Data plane functions include Deep Packet Inspection (DPI) for application identification and Quality of Service (QoS) enforcement. The forwarding engine applies policies in real-time, making per-packet decisions based on application type, destination, and current network conditions.

vEdge# show app-route sla-class
                  REMOTE                       REMOTE     MEAN     MEAN      PACKET
SLA CLASS NAME    SYSTEM IP   REMOTE COLOR    SITE ID    LATENCY  LOSS      AVAILABILITY
BusinessCritical  2.2.2.2     biz-internet    200        45       0.000000  99.990000
BusinessCritical  2.2.2.2     mpls           200        15       0.000000  100.000000

Control-Data Plane Interactions

The interaction between control and data planes creates dynamic network behavior. When the data plane detects path degradation through BFD or performance monitoring, it reports this information to the control plane via OMP. The control plane then recalculates optimal paths and distributes updated routing information.

Application-aware routing exemplifies this interaction. The data plane identifies application flows and measures their performance characteristics. This telemetry data influences control plane decisions about which paths best serve specific applications, creating a feedback loop that optimizes network performance continuously.

Policy Enforcement Points

Policy enforcement occurs at multiple points in the architecture. Control policies affect route advertisement and path selection, while data policies control actual packet forwarding. Security policies can be enforced at both planes - control plane policies determine which routes are acceptable, while data plane policies perform real-time threat detection and mitigation.

vEdge# show policy data-policy-filter
DATA POLICY FILTER
Ingress ACL: ZONE_BASED_FW_dp0bond1_Ingress_ACL_ipv4
Egress ACL:  ZONE_BASED_FW_dp0bond1_Egress_ACL_ipv4

Troubleshooting Considerations

Understanding the control-data plane separation is crucial for effective troubleshooting. Control plane issues typically manifest as routing problems or policy application failures, while data plane issues appear as forwarding problems or performance degradation.

Common control plane troubleshooting involves verifying OMP sessions, checking policy distribution, and validating route advertisements. Data plane troubleshooting focuses on tunnel states, BFD sessions, and packet forwarding statistics.

What's Next

With a solid understanding of control and data plane architecture, the next logical step is exploring the specific components in detail, starting with vManage's role in orchestrating the entire SD-WAN fabric and its integration with policy management workflows.

CCNP ENCOR study resources