What does the Cisco ENSDWI 300-415 exam cover?
The Cisco ENSDWI 300-415 exam covers SD-WAN architecture, SD-WAN edge router deployment, policies, security, quality of service, and management and operations of the Cisco SD-WAN solution. It is a concentration exam for the CCNP Enterprise certification and tests hands-on expertise with vManage, vSmart, and vBond controllers.
The Cisco Implementing Cisco SD-WAN Solutions (ENSDWI) 300-415 exam is a concentration exam within the CCNP Enterprise track. Passing ENSDWI combined with the core ENCOR 350-401 exam earns the CCNP Enterprise certification. The exam is also a qualifying exam for the CCIE Enterprise Infrastructure certification.
Cisco SD-WAN (formerly Viptela) has become the industry-leading software-defined WAN solution deployed by enterprises to replace expensive MPLS circuits with broadband, LTE, and cloud connectivity. Network engineers with SD-WAN expertise command premium salaries and are in high demand as enterprises migrate legacy WANs to SD-WAN architectures.
The ENSDWI exam costs $300 USD and takes 90 minutes to complete.
Exam Overview
| Detail | Information |
|---|---|
| Exam Code | 300-415 ENSDWI |
| Full Name | Implementing Cisco SD-WAN Solutions |
| Number of Questions | 55-65 |
| Time Limit | 90 minutes |
| Passing Score | Not published (approximately 825/1000) |
| Cost | $300 USD |
| Prerequisites | ENCOR 350-401 (for CCNP) |
| Validity | 3 years |
The exam covers five domains:
- Architecture (20%)
- Controller Deployment (20%)
- Router Deployment (20%)
- Policies (20%)
- Security and Quality of Service (10%)
- Management and Operations (10%)
"ENSDWI rewards candidates who have actually deployed SD-WAN in production. The exam scenarios describe real-world migration challenges: replacing MPLS with broadband, securing branch traffic, and optimizing application performance across hybrid WANs. Hands-on experience with vManage is far more valuable than memorizing configuration syntax." -- CCNP Enterprise certified network architect
SD-WAN Architecture
Cisco SD-WAN Components
The Cisco SD-WAN solution separates the WAN into four planes managed by dedicated controllers:
vManage: The centralized network management system (NMS) providing:
- Single-pane-of-glass dashboard for all SD-WAN devices
- Template-based configuration management
- Real-time monitoring and alerting
- Software upgrades and lifecycle management
- REST API for automation and integration
vSmart: The policy and control plane controller:
- Distributes routing and policy information to all vEdge routers
- Implements centralized data policies controlling traffic flow
- Manages OMP (Overlay Management Protocol) route distribution
- Provides scalability: one vSmart supports hundreds of vEdge routers
vBond: The orchestration plane controller:
- Authenticates all SD-WAN devices joining the overlay
- Facilitates NAT traversal for vEdge routers behind NAT devices
- Acts as the entry point for new devices joining the fabric
vEdge / cEdge routers: The data plane devices:
- vEdge: Viptela-branded hardware routers and virtual vEdge Cloud
- cEdge: Cisco IOS XE-based routers (ISR 1000, ISR 4000, ASR 1000, CSR 1000v) running SD-WAN software
┌─────────────┐
│ vManage │ (Management Plane)
│ 10.0.0.10 │
└──────┬──────┘
│
┌───────────┼───────────┐
│ │ │
┌────┴────┐ ┌────┴────┐ │
│ vSmart │ │ vSmart │ │ (Control Plane)
│ 10.0.1.1│ │ 10.0.1.2│ │
└────┬────┘ └────┬────┘ │
│ │ │
┌────┴────────────────────────┴────┐
│ Cisco SD-WAN Overlay │
│ (IPsec tunnels over any WAN) │
└────┬─────────┬──────────┬────────┘
┌────┴────┐ ┌──┴──────┐ ┌─┴───────┐
│ cEdge │ │ cEdge │ │ cEdge │ (Data Plane)
│Datacenter│ │ Branch 1│ │ Branch 2│
└─────────┘ └─────────┘ └─────────┘
OMP (Overlay Management Protocol)
OMP is the proprietary routing protocol that runs between vEdge/cEdge routers and vSmart controllers over TLS/DTLS:
| OMP Route Type | Description |
|---|---|
| OMP routes | Prefixes learned from the underlay and redistributed into the overlay |
| TLOC routes | Transport Location routes advertising WAN transport endpoints |
| Service routes | Routes for services (firewall, IPS) attached to the SD-WAN fabric |
TLOC (Transport Location): A three-tuple identifying a WAN transport endpoint:
- System IP: The router's unique identifier (like a router-id)
- Color: Logical label for the transport (mpls, biz-internet, lte, public-internet)
- Encapsulation: IPsec or GRE
Controller Deployment
vManage Deployment
vManage high availability options:
- Standalone: Single vManage for lab/small deployments
- Cluster: 3-node cluster for production (odd number prevents split-brain)
- vManage cluster uses Elasticsearch for distributed data storage
- Application server cluster load-balances management sessions
- Statistics server cluster distributes telemetry collection
Certificate management:
# Bootstrap process for vManage:
1. Deploy vManage VM or physical appliance
2. Configure management IP, hostname, organization name
3. Generate CSR and obtain certificate from Symantec (Cisco's SD-WAN CA)
4. Install root CA certificate and signed certificate
5. Add vBond IP to vManage configuration
vBond Deployment
vBond requirements:
- Must be reachable from all vEdge/cEdge routers (public IP or port-forwarded)
- Acts as STUN server for NAT traversal
- Can run on dedicated appliance or vEdge/cEdge router
# vBond configuration (on vEdge):
system
vbond <vbond-ip> local ! 'local' means this router IS the vBond
Router Deployment
Zero-Touch Provisioning (ZTP)
Cisco SD-WAN supports zero-touch provisioning for branch routers:
- Router boots and contacts
ztp.viptela.com(Cisco-hosted ZTP service) - ZTP service redirects router to the enterprise vBond address
- Router authenticates with vBond using serial number and chassis number
- vBond validates against the authorized device list in vManage
- Router receives configuration template from vManage
- Router establishes OMP sessions with vSmart controllers
Device onboarding via vManage:
- Upload Plug and Play (PnP) device file or enter serial/chassis manually
- Attach device template before or after device comes online
- Monitor onboarding progress in vManage dashboard
Configuration Templates
vManage uses a template-based configuration system:
Feature templates: Configure individual features (BGP, OSPF, VPN interfaces, QoS, security)
Device templates: Combine feature templates into a complete device configuration
Device Template: Branch-ISR-4331
├── Feature Template: System Settings
├── Feature Template: VPN 0 (Transport VPN)
│ ├── Interface: GigabitEthernet0/0/0 (MPLS)
│ └── Interface: GigabitEthernet0/0/1 (Internet)
├── Feature Template: VPN 512 (Management VPN)
│ └── Interface: GigabitEthernet0 (OOB Management)
└── Feature Template: VPN 10 (Service VPN)
└── Interface: GigabitEthernet0/0/2 (LAN)
Template variables: Device-specific values filled in per device:
| Variable | Example Value |
|---|---|
{{system_ip}} |
10.0.100.1 |
{{site_id}} |
100 |
{{hostname}} |
branch-01-rtr |
{{vpn10_interface_ip}} |
192.168.10.1/24 |
SD-WAN Policies
Policy Types
Cisco SD-WAN policies control both the control plane (routing) and data plane (traffic forwarding):
Control policies (applied on vSmart, affect OMP route distribution):
- Topology policies: Control which sites can communicate (hub-and-spoke, partial mesh)
- VPN membership policies: Control which VPNs exist at which sites
Data policies (applied on vEdge/cEdge, affect packet forwarding):
- Application-aware routing (AAR): Route applications based on WAN link quality
- Traffic engineering: Forward traffic to specific TLOCs or service chains
- QoS policies: Queue and schedule traffic on WAN interfaces
- Access control lists: Permit or deny traffic flows
Application-Aware Routing
AAR is the most tested policy type on ENSDWI. It measures WAN link quality using SLA metrics and routes applications accordingly:
# AAR policy components:
1. SLA Classes: Define acceptable performance thresholds
- Latency: < 100ms
- Jitter: < 50ms
- Packet loss: < 1%
2. App-route policies: Map applications to SLA classes
- Match: app-list VOICE-APPS
- Action: sla-class VOICE-SLA preferred-color mpls
3. Fallback: If no link meets SLA, use best available or drop
SLA class configuration example:
policy
sla-class VOICE-SLA
latency 100
jitter 50
loss 1
!
app-route-policy BRANCH-AAR
vpn-list ALL-VPNS
sequence 10
match
app-list VOICE-APPS
!
action
sla-class VOICE-SLA
preferred-color mpls
!
!
!
!
!
!
Centralized vs. Localized Policies
| Policy Type | Location | Applied On | Use Case |
|---|---|---|---|
| Centralized control | vSmart | OMP route updates | Topology control, VPN membership |
| Centralized data | vSmart (pushed to vEdge) | Data plane | AAR, traffic engineering |
| Localized control | vEdge/cEdge | Local routing table | Route redistribution, BGP policies |
| Localized data | vEdge/cEdge | Data plane | ACLs, QoS, traffic shaping |
Security and QoS
SD-WAN Security Features
IPsec tunnel encryption: All SD-WAN overlay tunnels use AES-256-GCM encryption by default. Every cEdge/vEdge router has a unique key pair and certificate.
Security zones and firewall:
# Zone-based firewall on cEdge:
security
zones
zone TRUST
vpn 10
!
zone UNTRUST
vpn 0
!
!
zone-pairs
zone-pair TRUST-TO-UNTRUST source TRUST destination UNTRUST
match-action pass
!
zone-pair UNTRUST-TO-TRUST source UNTRUST destination TRUST
match-action drop
!
!
!
Cloud Security Integration:
- Cisco Umbrella: DNS-layer security for branch internet traffic
- Cisco Secure Internet Gateway (SIG): Cloud-hosted firewall for direct internet access
- Zscaler / Netskope: Third-party SSE integration via IPsec or GRE
Quality of Service
SD-WAN QoS operates at the WAN interface egress:
Scheduling queues: Typically 8 queues per interface (0 = highest priority)
policy
qos-map BRANCH-QOS
queue 0 priority-queue
queue 1 bandwidth-remaining-percent 30 ! Voice
queue 2 bandwidth-remaining-percent 20 ! Video
queue 3 bandwidth-remaining-percent 30 ! Data
queue 4 bandwidth-remaining-percent 20 ! Best-effort
!
!
DSCP remarking: Preserve or remark DSCP markings at branch WAN edge.
Management and Operations
vManage Monitoring
Dashboard widgets:
- WAN Edge health (reachability, certificate status)
- Control plane status (vSmart connections, OMP sessions)
- Transport health (tunnel status, SLA compliance)
- Application experience scores
Troubleshooting commands:
# On cEdge router:
show sdwan control connections # vSmart and vBond sessions
show sdwan omp routes # OMP routes in routing table
show sdwan omp tlocs # TLOC advertisements
show sdwan bfd sessions # BFD tunnel liveness
show sdwan app-route stats # AAR SLA statistics
show sdwan policy from-vsmart # Policies pushed from vSmart
# Useful vManage API calls:
GET /dataservice/device/omp/routes?deviceId=<uuid>
GET /dataservice/device/tunnels/statistics?deviceId=<uuid>
Software Upgrades
vManage software upgrade workflow:
- Upload new software image to vManage repository
- Create upgrade task targeting device group or individual devices
- vManage pushes image to devices (activate with single-click or scheduled)
- Devices install and reboot; vManage monitors upgrade status
- Rollback automatically if device fails to re-establish control connections
Upgrade best practices:
- Upgrade vBond and vSmart before vEdge/cEdge devices
- Upgrade in waves (test group → staging → production)
- Maintain N-1 version compatibility between controllers and routers
Frequently Asked Questions
What is the difference between vEdge and cEdge routers? vEdge routers are the original Viptela hardware devices (vEdge 100, 1000, 2000, 5000) and the virtual vEdge Cloud. cEdge routers are Cisco IOS XE-based devices (ISR 1000/4000, ASR 1000, Catalyst 8000, CSR 1000v) running the SD-WAN software stack. Cisco has standardized on cEdge going forward and vEdge hardware has reached end-of-life. Most enterprise deployments today use cEdge ISR or Catalyst 8000 series routers.
What is the difference between ENSDWI and ENSDWF? ENSDWI (300-415) focuses on implementing Cisco's proprietary SD-WAN solution using vManage, vSmart, and vBond controllers. ENSDWF (300-430) focuses on automating and programming Cisco Enterprise networks more broadly using Python, REST APIs, and network automation tools. Both are concentration exams for CCNP Enterprise — you choose one or the other based on your specialization.
How important is hands-on lab practice for ENSDWI? Hands-on practice is essential. The exam scenarios describe operational challenges requiring you to understand which vManage screen, CLI command, or policy configuration resolves a given problem. Cisco's dCloud SD-WAN lab and the Cisco DevNet SD-WAN sandbox provide free hands-on environments. Candidates who have deployed or managed SD-WAN in production score significantly higher than those studying from documentation alone.
References
- Cisco Systems. (2025). Implementing Cisco SD-WAN Solutions (ENSDWI) Exam Topics. https://learningnetwork.cisco.com/s/ensdwi-exam-topics
- Cisco Systems. (2025). Cisco SD-WAN Design Guide. https://www.cisco.com/c/en/us/solutions/enterprise-networks/sd-wan/
- Cisco Systems. (2025). Cisco SD-WAN Configuration Guide. https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/
- Navarro, M., & Mancuso, B. (2022). Cisco Software-Defined Wide Area Networks. Cisco Press.
- Cisco DevNet. (2025). SD-WAN Programmability. https://developer.cisco.com/sdwan/
- Cisco dCloud. (2025). Cisco SD-WAN Lab Demos. https://dcloud.cisco.com/