What is vEdge?

Understanding vEdge

vEdge is the edge router in the Cisco SD-WAN (Viptela) solution that connects a site, such as a branch, data center, or campus, into the SD-WAN overlay fabric. Available as a physical appliance or a virtual machine, it provides routing, secure connectivity, and policy enforcement at the network edge, forwarding traffic across encrypted tunnels according to centrally defined intent.

In the SD-WAN architecture, vEdge devices form the data plane and work alongside controller components: vManage (management/orchestration), vSmart (control plane and policy distribution), and vBond (orchestration and initial onboarding). A vEdge authenticates and registers through vBond, receives policy and routing information from vSmart over a secure control channel (OMP), and then builds encrypted IPsec data-plane tunnels to other edge routers across any transport, including MPLS, broadband, or LTE.

This matters for security because the vEdge is where trust and encryption are enforced at each site. All site-to-site traffic in the fabric rides over IPsec tunnels with centrally managed keys, so data crossing untrusted internet transports stays confidential and authenticated. Centralized policy from vSmart lets organizations enforce consistent segmentation, firewall rules, and service insertion across hundreds of sites, and zero-touch onboarding via mutual authentication reduces the risk of rogue devices joining the overlay. Note that vEdge is the original Viptela hardware line; Cisco also offers IOS XE SD-WAN (cEdge) routers in the same fabric.

For example, a company connecting 200 branches gives each branch a vEdge router with two uplinks, an MPLS circuit and a commodity internet line. Each vEdge authenticates to the fabric through vBond, pulls segmentation and application-aware routing policy from vSmart, and establishes encrypted IPsec tunnels to peer sites. Sensitive payroll traffic is steered over the private MPLS path while general internet traffic uses the broadband link, and all inter-site traffic remains encrypted and policy-controlled regardless of the underlying transport.