CloudLabBox
Try the free demo

Cisco Catalyst SD-WAN CLI practice labs

14 guided labs that build a working Cisco SD-WAN overlay from the command line: controller bring-up and certificates, edge onboarding, OMP and TLOCs, control and data policy, segmentation, application-aware routing, direct internet access, QoS, an IOS XE edge, troubleshooting and a three-site capstone.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 11 of the 14 labs also run in the free demo.

Guided labs
14
Follows
CLI topics of Cisco ENSDWI 300-415. The Manager topics aren't covered
Runs every lab
Standard
Devices
vEdge, Alpine Linux, vBond, vSmart, EVE-NG GUI server, IOSv, Alpine WAN emulator and ISRv

Who these labs are for

For engineers who want to understand how Cisco SD-WAN really works under the GUI, and anyone preparing for the CLI topics of ENSDWI.

These labs don’t use SD-WAN Manager (vManage), so there’s no GUI, templates, Policy Builder or zero-touch onboarding, and you’ll need Manager practice elsewhere for the full exam. Every pane says so.

The 14 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

Cisco Catalyst SD-WAN CLI course 14 labs

Shared folderCisco Catalyst SD-WAN CLI guided labs

Controllers, onboarding, policy and QoS from the CLI, then troubleshooting and a three-site capstone.

  1. 01Controller bring-up and certificates

    Take a factory vBond and vSmart, give them their system identity, trust an enterprise root CA and bring up the first control connection of the overlay.

    1× vBond, 1× vSmart, 1× EVE-NG GUI server

    3 vCPU, 3,072 MBFits LiteRuns in the free demo

  2. 02WAN edge onboarding

    Add two vEdge routers to a running control plane: enrol them, authorise them on the vBond and vSmart, and pass traffic through the first IPsec tunnel.

    2× vEdge, 1× Alpine Linux, 1× vBond, 1× vSmart, 1× EVE-NG GUI server

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  3. 03OMP and TLOCs

    Add a second transport to a formed overlay, read how OMP advertises TLOCs and routes, and steer traffic with TLOC preference.

    2× Alpine Linux, 2× vEdge, 1× vBond, 1× vSmart

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  4. 04Service-side routing and VRRP

    Connect the overlay to site LANs: VRRP on a dual-edge site, OSPF to a core router, eBGP to a third-party router, and the redistribution that joins them to OMP.

    3× vEdge, 2× IOSv, 1× Alpine Linux, 1× vBond, 1× vSmart

    8 vCPU, 6,656 MBFits Standard

  5. 05Control policy - hub and spoke

    Turn the default full mesh into hub and spoke with a centralised control policy on the vSmart, and prove that spoke-to-spoke traffic now goes through the data centre.

    3× Alpine Linux, 3× vEdge, 1× vBond, 1× vSmart

    8 vCPU, 6,656 MBFits Standard

  6. 06Data policy and traffic engineering

    Write a centralised data policy on the vSmart that sends one application over MPLS, drops another and counts both, then read the proof on the WAN edge.

    2× Alpine Linux, 2× vEdge, 1× vBond, 1× vSmart

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  7. 07Segmentation and extranet VPNs

    Keep corporate and supplier networks apart in one overlay with VPNs, then open one narrow path between them with an extranet control policy.

    2× Alpine Linux, 2× vEdge, 1× vBond, 1× vSmart

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  8. 08Application-aware routing

    Measure each tunnel with BFD, define an SLA class, and watch traffic leave the preferred MPLS path when a WAN emulator breaks its latency target.

    2× vEdge, 1× Alpine Linux, 1× Alpine WAN emulator, 1× vBond, 1× vSmart

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  9. 09Direct internet access

    Let a branch reach the internet directly through its own circuit: NAT on the transport interface and a service-VPN route that points at VPN 0.

    2× vEdge, 1× Alpine Linux, 1× vBond, 1× vSmart, 1× EVE-NG GUI server

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  10. 10QoS on the WAN edge

    Classify and mark traffic at the LAN edge, schedule it with a low-latency queue and two weighted queues, and shape the WAN port to the contracted rate.

    2× Alpine Linux, 2× vEdge, 1× vBond, 1× vSmart

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  11. 11Troubleshoot control connections

    The new branches never joined the overlay. Find four faults with the control-connection history and its error codes, and fix each one.

    2× vEdge, 1× Alpine Linux, 1× vBond, 1× vSmart, 1× EVE-NG GUI server

    6 vCPU, 5,632 MBFits LiteRuns in the free demo

  12. 12Troubleshoot tunnels and policy

    Control connections are up but the sites cannot talk. Work up from BFD to OMP to policy and fix three faults: mismatched encapsulation, a control policy that hides a route, and a data policy that drops by default.

    2× Alpine Linux, 2× vEdge, 1× vBond, 1× vSmart

    6 vCPU, 5,120 MBFits LiteRuns in the free demo

  13. 13Onboarding an IOS XE WAN edge

    Bring an IOS XE router in controller mode into the same overlay as a vEdge: config-transaction, the Tunnel interface, activation, certificates, and the show sdwan commands.

    1× ISRv, 1× vBond, 1× vEdge, 1× vSmart, 1× EVE-NG GUI server

    5 vCPU, 7,936 MBFits LiteRuns in the free demo

  14. 14Capstone - a three-site rollout

    Finish a three-site rollout on your own: hub and spoke between branches, application-aware routing to the data centre, direct internet at one branch and QoS at the other.

    3× Alpine Linux, 3× vEdge, 1× vBond, 1× vSmart, 1× EVE-NG GUI server

    9 vCPU, 7,680 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Cisco Catalyst SD-WAN CLI practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Cisco vEdgevtedge-20.12.21 vCPU, 1,024 MB1328
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB1221
Cisco vBondvtbond-20.12.21 vCPU, 1,024 MB1414
Cisco vSmartvtsmart-20.12.21 vCPU, 1,024 MB1414
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB; 1 vCPU, 768 MB66
Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB12
Alpine WAN emulatorclbalpinewanem-alpine-wanem-3-20-31 vCPU, 512 MB11
Cisco ISRvisrv-ucmk9.16.12.5-sdwan1 vCPU, 4,096 MB11

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco Catalyst SD-WAN CLI guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Cisco Catalyst SD-WAN CLI labs

Are these Cisco Catalyst SD-WAN CLI labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 11 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 11 of the 14. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone - a three-site rollout”, needs 9 vCPU and 7,680 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Cisco?

No. CloudLabBox wrote them to follow the topics of the CLI topics of Cisco’s ENSDWI 300-415 (v1.2). The SD-WAN Manager topics aren’t covered, so this isn’t full exam preparation. They aren’t training material from Cisco, and CloudLabBox is independent of Cisco.

Does this include SD-WAN Manager (vManage)?

No. On our images vManage can’t enrol virtual edges without a signed Cisco device list, so the labs run vBond, vSmart and vEdge from the CLI, with a private lab CA and hand-typed device lists. That means no GUI, dashboards, templates, Policy Builder, device list sync, zero-touch onboarding or software upgrades.

Which plan do I need?

11 of the 14 labs fit Lite. Labs 04, 05 and 14 need Standard.

What else isn’t covered?

Cloud OnRamp, the enterprise firewall, IPS, URL filtering, SIG, AppQoE, multicast and service insertion aren’t built in any lab.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 11 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Cisco. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.