Architecture

The fabric splits cleanly into four roles, each owning one plane.

Component	Plane	Key protocols / interfaces	Notes
SD-WAN Manager	Management	REST API, HTTPS	Single pane for configuration, monitoring and automation. UX 1.0 feature templates, UX 2.0 configuration groups.
SD-WAN Controller	Control	OMP, DTLS/TLS	Distributes routes, TLOCs, service and policy information; never carries data traffic.
SD-WAN Validator	Orchestration	DTLS, STUN-like NAT discovery	Authenticates every device joining the fabric and facilitates NAT traversal between edges.
WAN Edge routers	Data	IPsec, BFD, OMP	Build the tunnel mesh, run BFD liveliness and SLA probes, enforce local policy.

Deployment models

• On-premises — the customer hosts Manager, Controller and Validator in their own data centre.
• Cisco-hosted control components — Cisco operates and upgrades the control plane; the customer keeps the edges.
• Cisco SD-WAN Cloud — SaaS delivery consumed through a Cisco API gateway, with tenancy and access handled by Cisco.