This SD-WAN training hub helps you choose the right course for your vendor, exam target, and current role. You can compare Cisco Catalyst SD-WAN, Fortinet Secure SD-WAN, Versa SD-WAN, and Palo Alto PAN-OS SD-WAN by architecture, lab depth, routing integration, policy model, and certification mapping.
All 7 SD-WAN courses, with about 119 hours of video training, are included in one OrhanErgun.net membership. You can start with a single vendor path or use the full catalogue to compare implementations before a migration; see the membership options.
SD-WAN changes the WAN from a collection of independently configured branch routers into a centrally controlled overlay. Traditional WAN operations usually focused on static routing, MPLS reachability, per-device QoS, and manual failover logic. SD-WAN keeps the underlay links, but moves path selection, segmentation, application policy, and operational visibility into a controller-driven system.
The important shift is not only MPLS replacement. A real SD-WAN design can use MPLS, broadband internet, LTE, 5G, or other transports at the same time, then steer traffic based on application identity, SLA measurements, route preference, policy, and security requirements. Voice, SaaS, internet-bound traffic, inter-branch traffic, and data-center traffic do not need to follow the same path.
This also changes troubleshooting. You still need routing skills, because OSPF, BGP, route redistribution, VPN segmentation, and underlay reachability remain part of the design. The new work is proving whether the controller state, overlay routes, tunnel health, SLA probes, templates, certificates, and centralized policy all agree with the intended forwarding behavior.
Vendors use different names for similar ideas. Cisco Catalyst SD-WAN uses vManage, vBond, vSmart, WAN Edge, TLOCs, OMP, templates, and centralized or localized policies. Fortinet builds Secure SD-WAN around FortiGate, FortiManager, SD-WAN zones, performance SLAs, ADVPN, IPsec, and BGP. Versa uses vDirector, vAnalytics, vController, templates, tenants, forwarding profiles, SLA monitoring, and path policies. Palo Alto integrates SD-WAN into PAN-OS and Panorama using plugins, device groups, templates, tags, zones, VPN clusters, BGP, traffic distribution profiles, security policy, and reporting.
| Design area | Traditional WAN approach | SD-WAN operational model |
|---|---|---|
| Transport | MPLS often carries most critical traffic; internet links are secondary or used mainly for breakout. | MPLS, broadband, and wireless links can all participate in forwarding decisions. |
| Control | Each branch is configured and changed device by device. | Controllers, templates, and centralized policy push intent to many sites. |
| Routing | OSPF, BGP, static routing, and redistribution define reachability directly on routers or firewalls. | Underlay routing still exists, but overlay routing, tunnel state, and policy affect final forwarding. |
| Application handling | Traffic normally follows route metrics, policy-based routing, or QoS marking. | Application-aware routing can use measured loss, latency, jitter, SLA class, cost, and business policy. |
| Segmentation | VRFs, VLANs, ACLs, and firewall policy are designed per site or per domain. | Service VPNs, zones, tenants, templates, and central policies make segmentation repeatable at scale. |
| Security | Security is often inserted through data centers or separate firewall service paths. | Security can be integrated at the branch through firewall policy, DIA, service insertion, IPS, URL filtering, SIG, or vendor-specific NGFW features. |
| Troubleshooting | You inspect routing tables, interface counters, ACLs, QoS queues, and tunnel status on each node. | You also inspect controller reachability, certificates, overlay routes, SLA probes, templates, policy order, and tunnel health. |
Start with the vendor you run in production or the platform you need to evaluate. If you are vendor-neutral, study one deep Cisco or Fortinet path first, then compare Versa and Palo Alto terminology against it.
Cisco
For engineers working with Cisco WAN Edge, vManage, vBond, vSmart, OMP, TLOCs, templates, DIA, AAR, QoS, and controller-based operations. Start with the new Cisco Catalyst SD-WAN deep dive if you want the broadest current Cisco path.
Start with this courseFortinet
For firewall and security engineers using FortiGate and FortiManager as the SD-WAN edge. Start with the NSE 6 SD-WAN course for FortiOS and FortiManager deployment, then move to NSE7 for advanced scenarios and troubleshooting.
Start with this courseVersa
For engineers evaluating or deploying Versa with vDirector, vAnalytics, vController, branch staging, OSPF, BGP, VRRP, DIA, SLA-based steering, NGFW features, QoS, and multi-tenant design.
Start with this coursePalo Alto
For security teams extending existing Palo Alto Networks firewalls into SD-WAN. The course focuses on Panorama, the SD-WAN plugin, templates, device groups, tags, zones, BGP, VPN clusters, DIA, reporting, and security policy.
Start with this courseUse the course cards below to compare vendor, instructor, duration, level, certification mapping, and lab focus before choosing your first SD-WAN track.
For engineers who want Cisco Viptela and Catalyst SD-WAN from fundamentals through hands-on EVE-NG labs. You build controllers, onboard vEdge and cEdge, configure templates, OMP, TLOCs, policies, NAT, DIA, QoS and Cloud OnRamp for SaaS.
For engineers starting with Versa architecture and deployment. You build vDirector, vAnalytics and vController, stage branches, integrate OSPF and BGP, examine MP-BGP control-plane behavior, configure DIA, SLA steering and NGFW features.
For Cisco engineers who want the newest deep Catalyst SD-WAN path. You cover controllers, certificates, HA, ZTP, templates, TLOCs, Multi-Region Fabric, OMP, OSPF, BGP, policies, DIA, AAR, QoS and security integrations.
For learners preparing for Implementing Cisco SD-WAN Solutions 300-415 inside the CCNP Enterprise track. You get SDN foundations, GNS3 and EVE-NG setup, controllers, certificates, vEdge and cEdge onboarding, templates, OMP, TLOCs and policy.
For FortiGate and FortiManager engineers building Secure SD-WAN across branches. You configure ADVPN, IPsec, BGP, route-reflector fixes, SD-WAN overlay zones, rules, load balancing and performance SLAs for the NSE 6 SD-WAN path.
For engineers who need a wider Versa build including tenants, routing and QoS. You configure vDirector, templates, branch staging, VRRP, OSPF, BGP, multi-tenancy, DIA, forwarding profiles, Forward Error Correction, SLA monitoring and shaping.
For security teams adding SD-WAN to PAN-OS firewalls. You configure Panorama, the SD-WAN plugin, templates, device groups, tags, zones, interface profiles, traffic distribution, BGP, VPN clusters, security policy, DIA and reporting.
SD-WAN Underlay vs Overlay
The underlay is the physical network that provides connectivity using Internet, MPLS, or 4G/5G links.
The overlay is the logical network built on top of the underlay, using secure tunnels to connect different sites.
SD-WAN uses the overlay to intelligently select paths based on application requirements, network performance, and business policies.
You do not need to choose between vendors before joining. The SD-WAN catalogue is useful both for exam preparation and for engineers comparing architectures before a design, migration, or proof of concept.
Pick the course that matches your production platform and immediate objective. The fastest path is usually foundation in one vendor, then advanced policy, routing integration, and troubleshooting.
If you run Cisco Catalyst SD-WAN and want the newest deep path
→ Cisco Catalyst SD-WAN Deep-Dive -ENSDWI 300-415
Take this first when you need controller deployment, certificate models, vManage, vBond, vSmart, WAN Edge onboarding, TLOC extension, Multi-Region Fabric, OMP, OSPF, BGP, templates, policy, DIA, AAR, QoS, and security integrations in one Cisco-focused path.
If you want Cisco SD-WAN from fundamentals through classic Viptela labs
→ Cisco SD-WAN Training By Navid Yahyapour
Choose this course when you want a structured Cisco Viptela and IOS-XE SD-WAN path with EVE-NG labs, controller onboarding, vEdge and cEdge onboarding, feature and device templates, OMP, TLOCs, centralized policies, NAT, DIA, Cloud OnRamp for SaaS, QoS, service insertion, and 300-415 ENSDWI relevance.
If your main target is CCNP Enterprise SD-WAN exam preparation
→ Implementing Cisco SD-WAN Solutions v1.0 (300-415)
Use this course when your priority is the 300-415 ENSDWI exam path inside CCNP Enterprise. It includes Cisco certification context, GNS3 and EVE-NG setup, controllers, certificates, Smart Account and WAN Edge onboarding, vEdge and cEdge templates, OMP, TLOCs, application-aware routing, control policy and data policy.
If you operate FortiGate and FortiManager SD-WAN at branch scale
→ Fortinet NSE 6 – SD-WAN
Start here for FortiOS 7.6.3 and FortiManager 7.6.3 labs covering hub-and-spoke underlay, SD-WAN zones, ADVPN over internet and MPLS, BGP, route-reflector behavior, ADD-PATH, next-hop-self-rr, overlay zones, manual, best-quality and lowest-cost rules, load balancing, and performance SLA modes.
If you are evaluating Versa against Cisco or Fortinet
→ Versa SD-WAN Fundamentals Course
Start with the Fundamentals course when you want Versa architecture and deployment with vDirector, vAnalytics, vController, branch staging, OSPF and BGP on transport and LAN sides, MP-BGP control-plane examination, redistribution, DIA, SLA-based steering, application steering templates, and NGFW configuration.
If you need a broader Versa build path including tenants and QoS
→ Versa SD-WAN Zero to Hero Course
Choose Zero to Hero when the Versa requirement includes site templates, double-edge branch templates, VRRP, OSPF, BGP, multi-tenancy, topologies, selective DIA, forwarding profiles, Forward Error Correction, SLA monitoring, path policies, Class of Service, shaping, and forwarding policy.
If your SD-WAN edge is a Palo Alto firewall
→ Palo Alto SD-WAN with PAN-OS Firewalls
Use this course when your team manages PAN-OS firewalls and Panorama. It covers the SD-WAN plugin, templates, device groups, tags, zones, interface profiles, traffic distribution profiles, BGP, VPN clusters, security policy, DIA, and reporting without forcing you into a router-centric SD-WAN model.
Learning SD-WAN involves understanding its architecture, routing, security, traffic policies, and troubleshooting. A structured learning path helps network engineers build both theoretical knowledge and practical skills.
Understand what SD-WAN is, how it works, its benefits, and how it differs from traditional WAN and MPLS networks.
Learn about SD-WAN controllers, orchestrators, edge devices, control and data planes, and the differences between underlay and overlay networks.
Explore BGP, Internet and MPLS connectivity, overlay tunnels, high availability, and dynamic path selection.
Understand application-aware routing, QoS, SLA monitoring, traffic policies, and intelligent path steering.
Learn about encryption, network segmentation, firewall integration, secure Internet access, and Zero Trust concepts.
Develop skills in monitoring, troubleshooting routing and tunnel issues, identifying performance problems, and improving network reliability.
Practice SD-WAN deployment, routing, traffic policies, link failover, security, and troubleshooting through real-world lab scenarios.
After learning the fundamentals, explore vendor-specific solutions such as Cisco SD-WAN, Fortinet, Versa, and Palo Alto SD-WAN.
Hands-on training and certifications, such as Cisco 300-415 ENSDWI, can help you develop the skills needed to design, deploy, and manage enterprise SD-WAN networks.
These certification references appear in the supplied course data. Use them when your study plan is tied to an exam blueprint rather than only to a production deployment.
300-415 ENSDWI
The Cisco Catalyst SD-WAN deep-dive course maps to ENSDWI 300-415 topics such as Cisco SD-WAN architecture, controller roles, certificate authentication, WAN Edge onboarding, OMP, TLOCs, templates, policies, DIA, AAR, QoS, security integrations, and operations.
Prepare for 300-415NSE 6 SD-WAN
The Fortinet NSE 6 course explicitly prepares candidates for the NSE 6 SD-WAN Enterprise Administrator exam with FortiOS 7.6.3 and FortiManager 7.6.3 labs across ADVPN, BGP, overlay zones, SD-WAN rules, load balancing, and performance SLAs.
Prepare for NSE 6NSE 7 SD-WAN
The NSE7 course is for engineers responsible for Fortinet SD-WAN deployment and network operation. It focuses on use cases, ECMP, policy routing, SD-WAN rule strategies, performance SLAs, IPsec, ADVPN, FortiManager, CLI operation, monitoring and troubleshooting.
The instructors below are included because their names appear in the course catalogue. Their focus is described only from the SD-WAN courses they teach here.
Teaches the Cisco SD-WAN Training course and the Versa SD-WAN Fundamentals course. His SD-WAN courses focus on controller onboarding, templates, OMP, TLOCs, centralized policy, Cisco Viptela labs, Versa control nodes, branch staging, OSPF, BGP, redistribution, DIA and SLA-based steering.
View main courseTeaches the Cisco Catalyst SD-WAN Deep-Dive, Fortinet NSE 6 – SD-WAN, and Palo Alto SD-WAN with PAN-OS Firewalls. His courses focus on multi-vendor SD-WAN implementation, controller or manager deployment, branch onboarding, routing, policy, security integrations, FortiManager, Panorama and operational validation.
View main courseTeaches Implementing Cisco SD-WAN Solutions v1.0 (300-415). The course focus is Cisco certification preparation, SDN foundations, GNS3 and EVE-NG lab setup, Cisco SD-WAN controllers, certificates, vEdge and cEdge onboarding, templates, OMP, TLOCs and SD-WAN policies.
View main courseTeaches the Versa SD-WAN Zero to Hero Course. The course focus is Versa deployment from topology and headend setup through site templates, branch staging, OSPF, BGP, VRRP, multi-tenancy, DIA, path policies, Forward Error Correction, SLA monitoring and QoS.
View main courseStart with the platform you are most likely to deploy. If that is Cisco, choose Cisco Catalyst SD-WAN Deep-Dive -ENSDWI 300-415 for the broadest current Cisco path, or Cisco SD-WAN Training By Navid Yahyapour if you want a classic Cisco Viptela lab progression.
If your background is firewall-heavy, Fortinet or Palo Alto may be a better first vendor. Choose Fortinet NSE 6 – SD-WAN for FortiGate and FortiManager labs, or Palo Alto SD-WAN with PAN-OS Firewalls if your edge is PAN-OS managed by Panorama.
The Cisco courses overlap on controllers, WAN Edge onboarding, templates, OMP, TLOCs, policies and 300-415 ENSDWI relevance, but they serve different study styles. Cisco Catalyst SD-WAN Deep-Dive -ENSDWI 300-415 is the newer and broader Catalyst SD-WAN path, with controller HA, OpenSSL and Windows Root CA certificate methods, ZTP, configuration groups, Multi-Region Fabric, security integrations, APPQoE and cloud integrations.
Cisco SD-WAN Training By Navid Yahyapour is a strong Cisco Viptela lab course from fundamentals through policies, NAT, TLOC extension, DIA, Cloud OnRamp for SaaS, QoS and service insertion. Implementing Cisco SD-WAN Solutions v1.0 (300-415) is useful when you want the CCNP Enterprise 300-415 exam path with added SDN, GNS3, EVE-NG, certification and lab setup context.
Take Fortinet NSE 6 – SD-WAN first if you need the FortiOS and FortiManager deployment path: base topology, interfaces, default routes, SD-WAN zones, ADVPN over internet and MPLS, BGP, route-reflector behavior, SD-WAN rules, load balancing and performance SLA modes. It explicitly prepares for the NSE 6 SD-WAN Enterprise Administrator exam.
Take Fortinet NSE7 SD-WAN after that or after real FortiGate experience. It is more operational and troubleshooting-oriented, with ECMP, policy routing, firewall sessions, rule lookup, CLI, monitoring, IPsec, ADVPN and multiple deployment scenarios.
Start with Versa SD-WAN Fundamentals Course if you want a direct architecture and deployment path. It covers vDirector, vAnalytics, vController, branch staging, OSPF and BGP integration, LAN-to-overlay redistribution, MP-BGP control-plane examination, DIA, SLA-based steering, application steering templates and NGFW configuration.
Choose Versa SD-WAN Zero to Hero Course when you need more work on topology, headend configuration, site templates, double-edge branches, VRRP, OSPF, BGP, multi-tenancy, selective DIA, path policies, Forward Error Correction, SLA monitoring and QoS. The two Versa courses are complementary rather than identical.
Palo Alto SD-WAN with PAN-OS Firewalls is best treated as a firewall-centered SD-WAN operations course. It uses PAN-OS firewalls and Panorama, then adds the SD-WAN plugin, templates, device groups, tags, zones, SD-WAN interface profiles, traffic distribution profiles, BGP, VPN clusters, security policy, DIA and reporting.
It is a good fit if your organization already uses Palo Alto Networks firewalls and wants SD-WAN without replacing the security edge with a separate router-centric platform.
You should understand basic routing before taking the deeper SD-WAN courses. The course data repeatedly includes OSPF, BGP, redistribution, overlay routing, service VPNs, route reflectors, BGP multipath, ADD-PATH, next-hop-self, TLOCs, OMP and policy-based traffic manipulation.
You do not need to be a routing specialist before starting, but SD-WAN troubleshooting becomes difficult if you cannot separate underlay reachability, overlay control-plane state, and policy-driven forwarding. Cisco, Fortinet and Versa courses all include routing integration labs.
The catalogue includes labs using EVE-NG, GNS3, FortiManager, FortiGate, Panorama, PAN-OS firewalls, Cisco SD-WAN controllers and Versa components. Some courses include lab topology files or course files, and several lessons show virtual lab setup such as EVE-NG Community or Pro, GNS3, VMware integration, image upload and topology import.
For Cisco Catalyst SD-WAN Deep-Dive, the course notes explicitly state that students are responsible for obtaining their own Cisco SD-WAN software images, licenses and virtualization or lab infrastructure. Review the individual course page before starting so you know which images, licenses or virtual appliances are required.
One OrhanErgun.net membership includes all 8 SD-WAN courses listed on this hub, with about 119 hours of video training across Cisco, Fortinet, Versa and Palo Alto. You can use it as a single-vendor implementation path, a certification study path, or a multi-vendor comparison before a migration or proof of concept.
The course cards are rendered from the catalogue, and the membership details are available at /pricing. The SD-WAN courses include vendor-specific labs for controllers, templates, branch onboarding, IPsec and ADVPN, BGP and OSPF integration, policy, DIA, QoS, performance SLAs, security features, reporting and troubleshooting.
Choose the vendor you operate today, or use the full catalogue to compare Cisco, Fortinet, Versa and Palo Alto SD-WAN designs before a migration or proof of concept. One membership includes every SD-WAN course listed on this hub.
Start your membership
