How Does vManage Interact with Cisco SD-WAN Devices in the Fabric?
What is used by vManage to interact with Cisco SD-WAN devices in the fabric?
Community Votes
77% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests your understanding of API directionality in SDN/SD-WAN: southbound = controller-to-device, northbound = controller-to-application.
vManage uses southbound APIs to communicate with and manage Cisco SD-WAN devices (vEdges, cEdges, vSmart) within the fabric, while northbound APIs are reserved for integration with external applications and orchestration systems.
Many candidates choose 'northbound API' because vManage itself is often described as the 'northbound' management plane relative to vSmart, confusing the perspective of the API direction.
Community Discussion (14 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Understanding Southbound vs. Northbound APIs in Cisco SD-WAN
In the Cisco SD-WAN architecture, vManage is the centralized management and orchestration platform. To communicate with the actual network devices in the fabric—such as vEdge routers, cEdge routers, and vSmart controllers—vManage relies on southbound APIs.
Why the Answer is D (Southbound API)
A southbound API is the interface through which a controller or management plane communicates downward to the underlying network devices it manages. In Cisco SD-WAN, vManage uses southbound APIs (often based on NETCONF, RESTCONF, or proprietary protocols over DTLS/TLS tunnels) to push configurations, retrieve telemetry, and enforce policies on the fabric devices. As community member hugoplur correctly notes, southbound APIs are used to "enforce policies, configure settings, and manage the overall network."
Why the Other Options Are Incorrect
- A (IPsec): While IPsec (specifically DTLS or IPsec tunnels) is used as the transport for control and data plane communication between SD-WAN components, it is not the API mechanism itself. IPsec secures the channel; it is not the API.
- B (Northbound API): This is the most common trap. A northbound API allows vManage to communicate upward to external applications, orchestration platforms, or third-party systems (e.g., ServiceNow, custom dashboards). It is not used to talk to the fabric devices themselves. Community members MrG and cwauch clearly distinguish: "Southbound APIs interact with fabric devices. Northbound APIs interact with applications."
- C (RESTCONF): RESTCONF is a specific protocol that can be used as a southbound API mechanism, but the question asks for the general concept. Moreover, vManage's primary southbound communication with vEdges/cEdges historically uses proprietary protocols and NETCONF, not exclusively RESTCONF. RESTCONF is more commonly associated with northbound or device-level management, making it a less accurate answer than the broader "southbound API."
Key Takeaway
Always think of the SDN controller as the reference point:
- Southbound = Controller → Devices (vManage → vEdge/cEdge/vSmart)
- Northbound = Controller → Applications/External Systems (vManage → ServiceNow, Python scripts, etc.)
Official Reference
Exam Strategy
When you see 'API direction' questions in SDN/SD-WAN exams, always anchor your thinking to the controller: southbound means 'down to devices,' northbound means 'up to apps.' Eliminate transport-layer answers like IPsec immediately.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →