SD-WAN vs SD-Access: What's the Difference? (CCNP ENCOR 350-401)
Both have "SD" in the name, both are Cisco fabrics, and both get provisioned from a controller - so candidates blur them constantly. But they solve opposite problems. SD-Access is a campus/LAN fabric: it segments users and devices inside a site. SD-WAN is a wide-area overlay: it connects separate sites over any transport. One works inside the building, the other works between buildings. Hold that single distinction and the controllers, planes, and components all fall into place.
Test yourself on real ENCOR architecture questions
Take a full-length CCNP ENCOR 350-401 practice exam free - SD-WAN, SD-Access, automation, and more, with an Explanation and an Exam Tip on every item and a personalized Exam Coach when you finish. The code auto-applies after sign-up.
CCNP-EXAM-FULL
Start the free exam
Already have an account? Log in to start
In This Guide
The one-line distinction
SD-Access: the campus fabric
SD-Access is Cisco's intent-based fabric for the campus LAN - the wired and wireless network inside a site. Its job is to automate segmentation and apply policy based on who or what is connecting (an employee, a contractor, an IP camera), independent of IP subnet.
- Controller: Catalyst Center (formerly DNA Center).
- Control plane: LISP (endpoint-to-location mapping).
- Data plane: VXLAN (encapsulation across the routed underlay).
- Policy: Cisco TrustSec Scalable Group Tags (SGTs).
- Solves: automated micro/macro-segmentation, unified wired+wireless, host mobility.
If you want the internals of the LISP control plane and the VXLAN data plane, that's covered in depth in LISP vs VXLAN in SD-Access.
SD-WAN: the wide-area overlay
Cisco Catalyst SD-WAN (formerly Viptela) is an overlay that connects sites - branches, headquarters, data centers, and cloud - across whatever transports you have: MPLS, broadband internet, and LTE/5G. Instead of buying expensive MPLS everywhere, you build encrypted tunnels over any link and let a central policy decide how each application is routed.
- Controllers/planes: vManage, vSmart, vBond (below).
- Control plane protocol: OMP (Overlay Management Protocol).
- Data plane: IPsec tunnels over the transports, between the WAN edge routers.
- Solves: transport independence, application-aware routing, centralized policy, zero-touch provisioning, direct/secure cloud access.
The four SD-WAN components (know these cold)
SD-WAN is the ENCOR topic most likely to test you on named components. Each maps to a plane:
| Component | Plane | What it does |
|---|---|---|
| vManage | Management | Single dashboard (GUI/API) to configure, monitor, and troubleshoot the whole fabric |
| vSmart | Control | Brain of the overlay - distributes routes, TLOCs, and policy to the edges via OMP |
| vBond | Orchestration | Authenticates and onboards devices, introduces them to vSmart/vManage, handles NAT traversal |
| cEdge / vEdge | Data | WAN edge routers at each site that build the IPsec tunnels and forward traffic (cEdge = IOS-XE, vEdge = Viptela OS) |
SD-WAN vs SD-Access side by side
| SD-Access | SD-WAN | |
|---|---|---|
| Scope | Campus / LAN (inside a site) | WAN (between sites) |
| Problem solved | Segmentation & identity-based policy | Connect & optimize sites over any transport |
| Controller | Catalyst Center (DNA Center) | vManage (+ vSmart, vBond) |
| Control plane | LISP | OMP (via vSmart) |
| Data plane | VXLAN | IPsec tunnels |
| Policy | TrustSec SGT | Centralized, application-aware (vSmart) |
| Edge device | Fabric edge switch | cEdge / vEdge router |
Exam traps
- Matching the controller to the fabric. Catalyst Center = SD-Access. vManage = SD-WAN. Swapping them is the most common miss.
- Control plane confusion. SD-Access control plane = LISP. SD-WAN control plane = OMP (on vSmart). LISP is not an SD-WAN protocol.
- Which devices carry traffic. In SD-WAN only the cEdge/vEdge routers are in the data path; vManage/vSmart/vBond are controllers and never forward user traffic.
- vBond's job. It is orchestration - authentication, onboarding, and NAT traversal - not routing. Routing decisions are vSmart's.
- They are complementary, not either/or. A real enterprise runs SD-Access in the campus and SD-WAN across the WAN; they can integrate. The exam still expects you to identify each correctly on its own.
SD-WAN is heavier on v1.2 - be ready for it
Take a free CCNP ENCOR practice exam and see whether the SD-WAN component and policy questions are actually solid. You get a concept-level breakdown of exactly where your points leak.
CCNP-EXAM-FULL
Start the free exam
New v1.2 blueprint? See exactly what changed in 2026 →
CCNP ENCOR SD-WAN / SD-Access Practice Questions
Five questions in the ENCOR style, each with a full explanation.
Ready for More?
Fabric scope locked in. Here's what to reinforce next:
Frequently Asked Questions
What is the difference between SD-WAN and SD-Access?
SD-Access is the campus/LAN fabric - it segments and applies policy to users and devices within a site, managed by Catalyst Center using LISP, VXLAN, and TrustSec. SD-WAN is the wide-area overlay - it connects geographically separate sites over any transport (MPLS, internet, LTE) with application-aware routing, managed by vManage/vSmart/vBond. Inside a site vs between sites.
What are the four SD-WAN components?
vManage (management - the GUI/API dashboard), vSmart (control - distributes routes and policy via OMP), vBond (orchestration - authenticates/onboards devices and handles NAT traversal), and the cEdge/vEdge WAN edge routers (data - build the IPsec tunnels that carry traffic).
What is OMP in SD-WAN?
OMP (Overlay Management Protocol) is the routing protocol of the SD-WAN overlay. It runs between vSmart and the edge routers, advertising routes, TLOCs (transport locators), and policy - conceptually like BGP, but purpose-built for the overlay.
Can SD-WAN and SD-Access work together?
Yes. Enterprises commonly run SD-Access inside each campus and SD-WAN between sites, and the two can integrate so segmentation (such as TrustSec group tags) is preserved across the WAN. For ENCOR, first make sure you can tell them apart: different scope, controllers, and planes.