Which protocol does Cisco SD-WAN uso to protect control plane communication?

In the Cisco SD-WAN architecture, control plane connections between WAN Edge devices and vSmart controllers are secured using Datagram Transport Layer Security (DTLS) tunnels. DTLS, which is based on TLS, provides communication privacy for datagram protocols like UDP. This ensures the integrity, confidentiality, and authenticity of the Overlay Management Protocol (OMP) messages that are exchanged over the control plane. While TLS can also be used, DTLS is the default and primary protocol for establishing these secure control connections.

A. IPsec is used to secure the data plane tunnels between WAN Edge devices, not the control plane connections to the vSmart controller.
C. STUN (Session Traversal Utilities for NAT) is a protocol used for NAT traversal to discover public IP addresses, not for securing control plane communications.
D. OMP (Overlay Management Protocol) is the control plane protocol that is being protected by DTLS; it does not provide the encryption itself.

1. Cisco Systems

Inc. (2020). Cisco SD-WAN Overlay Network Security. Cisco SD-WAN Security Configuration Guide

Cisco IOS XE Release 17.x. Section: "Control Plane Security". "By default

all control plane traffic between vSmart controllers and WAN Edge routers takes place over DTLS connections."

2. Cisco Systems

Inc. (2023). SD-WAN Design Guide. Section: "Control Plane"

Subsection: "Control Plane Connectivity". "The connections use Datagram Transport Layer Security (DTLS) to secure the transport of the OMP control traffic between the WAN Edge routers and the vSmart controllers."