Cisco Catalyst SD-WAN CLI lab 1 of 14
Controller bring-up and certificates
Take a factory vBond and vSmart, give them their system identity, trust an enterprise root CA and bring up the first control connection of the overlay.
Run this lab
It needs Lite: its 3 nodes are set to 3 vCPU and 3,072 MB in total. That fits the free demo too.
In your workspace: Shared, then Cisco Catalyst SD-WAN CLI guided labs, then 01 - Controller bring-up and certificates
- Level
- Intermediate
- Time
- About 60 minutes
- Nodes need
- 3 vCPU, 3,072 MB
- Smallest plan
- Lite
The scenario
Meridian Foods, a UK food retailer, is moving its branches onto Cisco Catalyst SD-WAN. Before any router can join, the controllers have to exist and trust each other. You have two factory-fresh controllers on the provider network and the company's enterprise certificate authority. By the end of this lab the vSmart holds a live control connection to the vBond: the first link of the overlay.
Cisco's current names and the names on these images differ, so you will see both: the vBond is the SD-WAN Validator, the vSmart is the SD-WAN Controller and the vManage is the SD-WAN Manager.
| Node | Role | System IP | Site ID | Transport, VPN 0 | Management, VPN 512 |
|---|---|---|---|---|---|
| vBond | Validator: first point of contact | 10.255.0.1 | 1000 | ge0/0 198.51.100.1/24 | eth0 10.254.0.1/24 |
| vSmart | Controller: runs OMP and holds policy | 10.255.0.2 | 1000 | eth0 198.51.100.2/24 | eth1 10.254.0.2/24 |
| CA | Enterprise certificate authority (Linux) | eth0 10.254.0.50/24 |
The organisation name on every device is MeridianFoods, spelled exactly like that. It is case-sensitive and it must match the certificates.
What this course leaves out. There is no SD-WAN Manager (vManage) in any of these labs. A virtual edge can't join the Manager's inventory without a signed device list from Cisco, which these labs don't have. So you won't see the Manager's GUI, dashboards, templates, Policy Builder or zero-touch onboarding. You work at the CLI of the controllers and edges, with a private lab CA and device lists typed by hand. In production the Manager would hand out the controller list and handle the certificate requests. Here you do both yourself.
What you’ll practise
- Configure system identity and VPN 0 on the controllers
- Install an enterprise root certificate and enrol each controller with a CSR
- Authorise the vSmart on the vBond and read the control connection
The tasks
- Start the lab and log in
- Give the vBond its identity
- Give the vSmart its identity
- Trust the enterprise root
- Enrol each controller
- Authorise the vSmart
- Read the first control connection
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- vBond
ge0/0to INET (network) - vSmart
eth0to INET (network) - vBond
eth0to MGMT (network) - vSmart
eth1to MGMT (network) - CA
eth0to MGMT (network)
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| vBond | Cisco vBond | vtbond-20.12.2 | 1 vCPU, 1,024 MB |
| vSmart | Cisco vSmart | vtsmart-20.12.2 | 1 vCPU, 1,024 MB |
| CA | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Cisco Catalyst SD-WAN CLI guided labs.Open
01 - Controller bring-up and certificatesand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Cisco Catalyst SD-WAN CLI labs
All Cisco Catalyst SD-WAN CLI labs
Related labs in other courses
CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.