Summer discount is ending soon!
Summer discount is ending soon!
Nine courses across the four vendors that actually ship SD-WAN — Cisco, Versa, Fortinet and Palo Alto — including both Cisco 300-415 tracks and Fortinet NSE 6. Every one is lab-based, built in EVE-NG or GNS3, and included in a single membership.
A traditional WAN is configured router by router: each site carries its own routing policy in its own CLI. SD-WAN moves that decision out of the box and into a controller. The edge routers build overlay tunnels over whatever transport exists — MPLS, broadband, LTE — and a controller tells them which traffic takes which path.
On Cisco Catalyst SD-WAN that split is formalised as four planes: the Validator (vBond) authenticates devices joining the fabric, the Manager (vManage) is where configuration and monitoring live, the Controller (vSmart) distributes routing and policy over OMP, and the WAN Edges forward the actual data. Everything hangs off a certificate model — which is why controller onboarding and certificates are where most first deployments stall, and why the courses here spend real time on them.
The other vendors reach the same outcome with different tooling: Versa builds around vDirector with multitenancy for serving several customers from one deployment, while Fortinet and Palo Alto add SD-WAN onto a firewall you may already run, so WAN policy and security policy sit on the same platform. The concepts transfer; the terminology and the failure modes do not.
| Traditional WAN | SD-WAN | |
|---|---|---|
| Bringing up a site | An engineer configures the router on site, per box | Zero-touch: the edge calls home and pulls its template |
| Where policy lives | In every device’s own config | Centrally, on the controller — pushed to the fabric |
| Transport | Whatever the circuit is, usually MPLS only | MPLS, broadband and LTE together, chosen per application |
| Visibility | Per-device CLI and SNMP | One view of every tunnel, with per-path loss and latency |
| Changing a policy | Touch each site that needs it | Change it once, the controller propagates it |
| Cost profile | Private circuits, long contracts | Cheaper transport where the SLA allows it |
The catch nobody puts on a slide: the controller becomes the thing you cannot lose, which is why controller HA and the certificate model take up so much of the training.
Each vendor has a dedicated learning track. Start with the one you use at work.
Controller-based fabric: vBond validates, vManage manages, vSmart distributes policy over OMP. The largest install base and the only vendor here with a mainstream exam (300-415).
View coursevDirector plus an analytics cluster, built around multitenancy — one deployment serving several customers. Common with service providers and managed-service teams.
View courseSD-WAN as a feature of FortiOS: SD-WAN rules with Performance SLA, ADVPN for dynamic spoke-to-spoke, FortiManager for scale. Natural choice if FortiGate is already your edge.
View courseSD-WAN layered onto PAN-OS firewalls, so the security policy and the WAN policy live on the same box. The lightest path if you already run PAN-OS.
View courseThese courses aren't sold one by one. A single OrhanErgun.net membership gives you access to all of them — Cisco, Versa, Fortinet, Palo Alto and the 300-415 exam courses — so you can switch vendors without paying again.
Every course is included in your membership — compare by vendor, level and what fits you.
Six-part theory and design series, then the Viptela fabric built from scratch in EVE-NG — controller onboarding, templates, policies. Ships with a lab workbook and topology files, and covers both the free and Pro versions of EVE-NG.
Head-end and WAN Edge controller deployment, device templates, protocol configuration inside service VPNs, then policies. Take this if you want the Viptela feature set specifically rather than an exam track.
The widest coverage of the nine: 192 lessons that start at SDN fundamentals, APIs and DevNet sandboxes before reaching SD-WAN, with GNS3 and EVE-NG setup included. Pick this if you want the theory chain built up from the ground.
The Catalyst-era rewrite: four planes and the current naming (SD-WAN Manager / Controller / Validator), certificate model, controller HA, TLOCs and branch redundancy, Multi-Region Fabric with OMP, configuration groups, app-aware routing and the security stack.
A short introduction to the Versa architecture and deployment model, with design videos and practice labs. Start here if Versa is new to you.
Builds a Versa deployment end to end: vDirector and analytics cluster, controller onboarding, site templates, branch staging, dual-edge branches with VRRP and OSPF, multitenancy for multiple customers, DIA, policies and QoS.
The compact FortiGate path: SD-WAN rules and Performance SLA, ECMP and policy routes for Direct Internet Access, site-to-site and ADVPN, managed through FortiManager.
Goes further than most vendor courses: ADVPN over both WAN (BGP) and MPLS (static) transports, then the design flaws that surface in MPLS tunnels and spoke-to-spoke traffic — and how BGP additional-path and next-hop-self on the route reflector fix them.
SD-WAN on PAN-OS firewalls: the concepts, then a lab build with slides and topology files. The shortest path here if Palo Alto is already your firewall platform.
Pick by the situation you are actually in.
If… You are sitting the 300-415 exam in the next few months
→ Catalyst SD-WAN Deep-Dive — current naming, Multi-Region Fabric, configuration groups.
If… You have never touched a controller-based fabric
→ Cisco SD-WAN Training — theory series first, then build the fabric in EVE-NG.
If… You need SD-WAN on firewalls you already run
→ Fortinet SD-WAN for FortiGate, or Palo Alto SD-WAN for PAN-OS.
If… You serve multiple customers from one platform
→ Versa Zero to Hero — multitenancy, dual-edge branches, DIA and QoS.
If… You want the deepest theory chain, exam aside
→ The 192-lesson 300-415 course — starts at SDN, APIs and DevNet before SD-WAN.
If… You already know Cisco SD-WAN and want the Viptela feature set
→ Cisco SD-WAN Viptela Course — head-end deployment, templates, policies.
Versa and Palo Alto courses on this page are platform training rather than exam prep — they are here because the deployments differ, not because there is an exam attached.
The CCNP Enterprise concentration exam for Cisco SD-WAN. Two courses on this page cover it: the Catalyst deep-dive follows the current generation, the 192-lesson course builds the theory from SDN upward.
View courseFortinet Secure SD-WAN on FortiGate. The course goes past exam topics into ADVPN over WAN and MPLS transports and the design flaws each one exposes.
View courseSD-WAN on this platform is taught by four instructors, each on the platform they work with.
Cisco SD-WAN theory-and-design series and the EVE-NG lab track, plus Versa Fundamentals.
See a courseThe Viptela feature deep-dive and the Versa Zero-to-Hero build, including multitenancy.
See a courseThe Catalyst 300-415 deep-dive and the whole Fortinet and Palo Alto SD-WAN track.
See a courseThe 192-lesson 300-415 course that starts from SDN fundamentals, APIs and DevNet.
See a courseThese are the topologies from the courses on this page — not stock diagrams. Every one runs in EVE-NG or GNS3 on your own machine, and the topology files ship with the course. Click any of them to open the full-size version.
Setup is part of the courses — EVE-NG in both the free and Pro versions, and a GNS3 build in the 192-lesson course.
The topologies above are downloadable, and the Cisco track ships a workbook so you can repeat the build on your own machine.
You onboard the controllers, handle certificates, push templates, then apply policy — the order a real deployment happens in.
They target different starting points. Sikandar Shaik’s course is the longest at 192 lessons and builds up from SDN fundamentals, APIs and DevNet sandboxes before reaching SD-WAN, with GNS3 and EVE-NG setup included. Mohsin Mushtaq’s Catalyst deep-dive is the current-generation rewrite: it uses the new naming (SD-WAN Manager, Controller, Validator), and covers Multi-Region Fabric, configuration groups and the security stack integration. If you are sitting the exam soon, take the Catalyst version; if you want the full theory chain, start with the 192-lesson course.
No, and treating it like BGP is a common source of confusion. OMP runs between the WAN Edge routers and the vSmart controller over the control connections, and it carries SD-WAN-specific information: TLOC routes (transport locators), service routes and the policies vSmart distributes. Unlike BGP, the controller can rewrite what it advertises to each edge, which is how centralised policy works. The Catalyst deep-dive covers OMP together with Multi-Region Fabric.
In practice, usually not. Most enterprises end up hybrid: broadband or LTE carries what it can, MPLS keeps the traffic that needs a service-level guarantee, and SD-WAN policy decides which goes where. That is why the courses here spend time on transport-specific design — the Fortinet NSE 6 course, for example, works through ADVPN over a WAN transport with BGP and over an MPLS transport with static routes, because the two behave differently.
The most useful answer is: the one your employer runs. If that is not a factor, Cisco has the largest install base and the clearest certification path, so it is the most transferable starting point. The core ideas — overlay tunnels, centralised policy, application-aware path selection — carry across vendors; what changes is the tooling and the terminology.
Yes. The labs here are built in EVE-NG and GNS3, and the courses include the setup steps for both, plus topology files and a workbook for the Cisco track. You will need a machine with enough RAM to run the controllers and a handful of edges.
No. A single OrhanErgun.net membership unlocks every SD-WAN course on this page — all four vendors and both 300-415 courses — so you can move between vendors without paying per course.
Get every SD-WAN course — across all four vendors — with a single membership.
Start your membership