The ‘Topology’ action in a Centralized Data Policy is specifically designed to control traffic steering in the overlay. Setting it to ‘Hub-and-Spoke’ ensures that all traffic from spokes (branches) is forced to traverse a hub (data center) before going to another spoke, meeting the requirement for centralized inspection.

OMP uses DTLS/TLS for control plane connections. If BFD is up, the underlying IP connectivity is fine. An ‘auth-fail’ state for OMP specifically points to an authentication failure, which is most commonly caused by a certificate problem on the vEdge, such as an invalid or mismatched certificate.

vManage Device Templates, composed of reusable Feature Templates (e.g., for VPN, Cisco Umbrella), are the primary mechanism for scalable, consistent configuration deployment. A change to a Feature Template can be pushed to hundreds of devices attached to the corresponding Device Template simultaneously.

You first place the guest interface in a separate Service VPN (e.g., VPN 10) from the corporate data (VPN 1). Then, you create a Localized Data Policy on the branch router that matches traffic from that Service VPN and steers it to a local TLOC (the branch’s own internet connection) for direct internet access, where the Umbrella connector can filter it.

Many modern SaaS applications use TLS/SSL. To classify these encrypted flows, Cisco SD-WAN’s Advanced Application Recognition can inspect the Server Name Indication (SNI) field in the TLS handshake. Creating a custom application definition based on the SNI (e.g., *.salesforce.com) is the standard method to identify and apply policy to such encrypted traffic.

The ‘controller-group’ (or ‘controller-group-list’) is configured in the System Feature Template on the WAN Edge device. It lists vSmart controllers in order of preference. The device will try to establish DTLS connections to controllers in the first group; if all are unreachable, it will proceed to controllers in the next group, enabling the described regional affinity and inter-regional failover.

For real-time applications like voice media, jitter is a critical performance metric. Cisco’s AAR logic uses a composite score based on loss, latency, and jitter. Given equal loss and similar latency, the path with drastically lower jitter (15ms vs 45ms) will have a much better quality score and will be preferred by AAR to carry the voice traffic.

The data plane (BFD) can come up quickly between branch and backup hub. However, for the branch to know it can send traffic to the backup hub, the vSmart controllers must first receive the backup hub’s new active TLOC routes and re-advertise them via OMP to all branches. Until this OMP convergence happens, branches lack the necessary routing information for new flows, even though the underlying tunnel is up.

The standard design is to use a single physical interface connected to the ISP modem/CPE. On the router, you create two logical subinterfaces or VLANs on this port. One obtains the public IP for the SD-WAN TLOC (e.g., via DHCP), and the other uses a different public IP (or a separate DHCP pool) for the DIA traffic. This provides logical separation and distinct source IPs on a single physical link.

The ‘Topology’ action in a Centralized Data Policy is specifically designed to control traffic steering in the overlay. Setting it to ‘Hub-and-Spoke’ ensures that all traffic from spokes (branches) is forced to traverse a hub (data center) before going to another spoke, meeting the requirement for centralized inspection.0