vBond Orchestrator Behavior in Cisco SD-WAN

300-415 By islever Editorial Last updated

Describe Cisco Catalyst SD-WAN architecture and components Describe Cisco Catalyst SD-WAN Edge platforms and capabilities

Short answer

A The vBond orchestrator builds permanent DTLS control plane connections with vSmart controllers to facilitate device authentication and network orchestration.

Question

What is the behavior of vBond orchestrator?
  1. It builds permanent connections with vSmart controllers. Correct Answer
  2. It builds permanent connections with WAN Edge routers.
  3. It updates vSmart of WAN Edge routers behind NAT devices using OMP.
  4. It maintains vSmart and WAN Edge routers secure connectivity state.

Key Takeaways

The main trap is confusing the temporary nature of vBond-edge router connections with the permanent nature of vBond-vSmart controller connections.

The vBond orchestrator maintains permanent DTLS connections with vSmart controllers to authenticate and orchestrate SD-WAN edge devices. Learn why this persistent link is critical for network setup.

Common mistake: Many candidates choose B, thinking vBond maintains permanent links to edge routers. In reality, these connections are only temporary, used for initial authentication and NAT traversal before the edge router connects directly to vSmart.

Expert Analysis

The vBond orchestrator in Cisco SD-WAN architecture serves as the initial point of contact for all devices joining the overlay network. Its primary function is to authenticate and authorize devices, but critically, it also establishes persistent control plane connections with the vSmart controllers (now known as Enterprise Controllers). According to Cisco documentation, each vBond maintains a permanent DTLS tunnel with every vSmart controller in its domain. This persistent connection allows vBond to inform vSmart about new edge routers joining the network, facilitating the handshake process.

Option A correctly identifies this behavior: vBond builds permanent connections with vSmart controllers. These connections are essential for the orchestration process, ensuring that vSmart controllers are aware of the topology changes and can manage routing policies effectively.

Option B is incorrect because vBond's connections with WAN Edge routers are temporary. Once vBond authenticates an edge router and provides it with the necessary information to connect to vSmart, the direct link between vBond and the edge router is no longer needed for ongoing operations. The edge router then establishes OMP sessions directly with vSmart.

Option C is incorrect because vBond does not use OMP to update vSmart about NAT traversal. While vBond assists in NAT traversal by providing public IP addresses to behind-NAT devices, the actual exchange of reachability information via OMP occurs between the edge routers and vSmart controllers. OMP is the protocol used for route distribution, not for vBond-to-vSmart communication.

Option D is partially descriptive but less precise than A. While vBond helps establish secure connectivity, the specific mechanism involving permanent connections is with vSmart controllers, making A the most accurate and technically specific answer regarding the 'behavior' defined in Cisco's architectural model.

Exam Strategy

When analyzing SD-WAN component interactions, always distinguish between temporary and persistent connections. Remember that vBond acts as a gatekeeper: it has permanent links to controllers (vSmart) for management coordination but only temporary links to edge devices for initial onboarding. Focus on the 'who talks to whom permanently' aspect when answering architecture questions.

Frequently Asked Questions

Why does vBond need permanent connections to vSmart?

Permanent DTLS connections allow vBond to instantly notify vSmart controllers when new edge routers join the network, enabling immediate policy enforcement and route redistribution.

Are vBond connections to edge routers permanent?

No. Connections between vBond and edge routers are temporary. They are used only for initial authentication, certificate validation, and NAT traversal assistance before the edge router establishes OMP sessions with vSmart.

More 300-415 FAQ →

Community Votes

A
79%
D
14%
C
7%

79% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 29 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 29

  1. A_Wolf 👍 4
    A is correct. The connection between the vSMART controller(s) and the vBOND via DTLS is the only persistent connection (always there) OMP runs between the edge router and the Cisco vSmart Controller and carries only control information (routing) vBond does not use OMP!
  2. Roier 👍 3 Answered A
    A is correct The DTLS connections with Cisco vSmart Controllers are permanent so that the vBond controller can inform the Cisco vSmart Controllers as edge routers join the network. The DTLS connections with edge routers are temporary; once the Cisco vBond Orchestrator has matched a edge router with a Cisco vSmart Controller, there is no need for the Cisco vBond Orchestrator and the edge router to communicate with each other. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html
  3. adeon 👍 3 Answered A
    Correct is A
  4. Eliasmiranda 👍 2
    A. Is correct. The major components of the Cisco vBond Orchestrator are: Control plane connection: Each Cisco vBond Orchestrator has a persistent control plane connection in the form of a DTLS tunnel with each Cisco vSmart Controller in its domain. In addition, the Cisco vBond Orchestrator uses DTLS connections to communicate with edge routers when they come online, to authenticate the router, and to facilitate the router's ability to join the network. Basic authentication of an edge router is done using certificates and RSA cryptography. NAT traversal: The Cisco vBond Orchestrator facilitates the initial orchestration between edge routers and Cisco vSmart Controllers when one or both of them are behind NAT devices. Standard peer-to-peer techniques are used to facilitate this orchestration. Load balancing: In a domain with multiple Cisco vSmart Controllers, the Cisco vBond Orchestrator automatically performs load balancing of edge routers across the Cisco vSmart Controllers when routers come online. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html#c_Components_of_the_Viptela_SEN_9290.xml
  5. InjaYeGame 👍 2
    I support A as correct. see below: "The DTLS connections with edge routers are temporary; once the Cisco vBond Orchestrator has matched a edge router with a Cisco vSmart Controller, there is no need for the Cisco vBond Orchestrator and the edge router to communicate with each other. The Cisco vBond Orchestrator shares only the information that is required for control plane connectivity, and it instructs the proper edge routers and Cisco vSmart Controllers to initiate secure connectivity with each other. The Cisco vBond Orchestrator maintains no state."
Show 24 more comments
  1. RickyDG 👍 2
    OMP runs between the Cisco vSmart Controller and the edge routers and carries only control plane information. The Cisco vSmart Controller processes the routes and advertises reachability information learned from these routes to other edge routers in the overlay network.
  2. DP 👍 2
    I think the right answer is A. Control plane connection: Each Cisco vBond Orchestrator has a persistent control plane connection in the form of a DTLS tunnel with each Cisco vSmart Controller in its domain.
  3. ccie_race 👍 2
    A seems correct because vBond maintains permanent connections with vSmart. vBond doesn't use OMP.
  4. nazars 👍 2
    D is correct Vbond make secure connectivity between Vedge and vsmart
  5. nbvolz 👍 2
    We know which one is right, but which one would be on the exam..
  6. Mohamedvibes 👍 2 Answered A
    vbond does not use OMP
  7. RickyDG 👍 2
    A seems to be correct
  8. MasiEB 👍 1 Answered A
    Control plane connection: Each Cisco SD-WAN Validator has a persistent control plane connection in the form of a DTLS tunnel with each Cisco Catalyst SD-WAN Controller in its domain. In addition, the Cisco SD-WAN Validator uses DTLS connections to communicate with edge routers when they come online, to authenticate the router, and to facilitate the router's ability to join the network. Basic authentication of an edge router is done using certificates and RSA cryptography. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html#%23c_Primary_SEN_Components_9291.xml
  9. mikidvd51 👍 1 Answered C
    Also C could be correct. (google AI) 1. The WAN Edge router's real IP address and port are contained in a message. 2. The vBond controller receives the message and sends a notification to the WAN Edge router that it's behind a NAT. 3. The WAN Edge router updates its OMP TLOC route with the information and sends it to the vSmart controller. 4. The vSmart controller re-advertises the information across the overlay fabric. All WAN Edge routers in the fabric can use the correct IP and port values to establish communication.
  10. aliciim 👍 1 Answered D
    Cisco vBond Orchestrator—The Cisco vBond Orchestrator automatically orchestrates connectivity between edge routers and Cisco vSmart Controllers. If any edge router or Cisco vSmart Controller is behind a NAT, the Cisco vBond Orchestrator also serves as an initial NAT-traversal orchestrator. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html
  11. she_ccie 👍 1
    Control plane connection: Each Cisco vBond Orchestrator has a persistent control plane connection in the form of a DTLS tunnel with each Cisco vSmart Controller in its domain. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/optimization-ha/vedge/network-optimization-high-availability-book/high-availability.html
  12. rubendrios 👍 1
    To provide redundancy for the Cisco SD-WAN Validator, you can create multiple Cisco SD-WAN Validator entities in the network and point all edge routers to those Cisco SD-WAN Validators. Each Cisco SD-WAN Validator maintains a permanent DTLS connection with each Cisco Catalyst SD-WAN Controller in the network
  13. st1981 👍 1 Answered A
    A: Control plane connection: Each Cisco vBond Orchestrator has a persistent control plane connection in the form of a DTLS tunnel with each Cisco vSmart Controller in its domain. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html
  14. shak5khan786 👍 1 Answered A
    Permanent Connections to vSmart: It maintains permanent control connections (typically via DTLS or TLS) with vSmart controllers, keeping track of the control plane state
  15. shadi_rizeq 👍 1 Answered D
    I think D is the correct answer, vBond establishes secure connections with all via IPSec, not only vSmart, but also vManage, WAN Edges, so Answer D is correct.
  16. Speirsington 👍 1
    I don't believe it uses OMP but it's the closest answer https://www.thenetworkdna.com/2021/03/cisco-viptela-sdwan-vbond-as.html
  17. Xhizors 👍 1
    A is correct - https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/sdwan-xe-gs-book/system-overview.html
  18. Tayeglow 👍 1
    I believe it is D. It maintains vSmart and WAN Edge routers secure connectivity state.
  19. AonDuine 👍 1 Answered A
    I believe A is right. The question is regarding vBond's behavior not purpose.
  20. phi5 👍 1 Answered A
    A is the correct answer, C is incorrect because vBond do not use OMP
  21. khanda 👍 1 Answered A
    Correct answer is A, C is incorrect because of the use of OMP.
  22. wcorrea 👍 1 Answered A
    A is the correct answer
  23. gerardo31280 👍 1
    vbond use OMP??
  24. siang 👍 1 Answered A
    A is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is Required for On-Premises vBond via PnP Connect?

S-grade

WAN Edge Registration with Enterprise CA Certificates

S-grade

Which Component Creates a Feature Profile in Cisco SD-WAN UX 2.0?

S-grade

Impacts of Losing vManage Connectivity to Cisco SD-WAN Fabric

S-grade

Practice All 300-415 Questions

Access 120 questions with complete answers and detailed explanations.

View Full 300-415 Practice Test →

← Back to 300-415 Study Guide