What is the purpose of a VPN in Cisco SD-WAN, and how are data-plane tunnels established?

• A. VPNs segment traffic; data-plane tunnels (IPsec) carry traffic between edges; tunnels established based on overlay policies and OMP routing information
• B. VPNs provide remote login only
• C. VPNs implement routing protocols
• D. VPNs encrypt management traffic only

Answer: (A)

In Cisco SD-WAN, a VPN is the way to logically segment traffic and apply per‑traffic policies across the fabric. It creates isolated data paths so different applications or sites can be treated differently, while still sharing the same physical underlay.

The data-plane tunnels are IPsec tunnels that carry the actual user traffic between WAN edges. These tunnels are not created randomly; they are established based on the overlay policies you configure and the reachability/policy information exchanged via the Overlay Management Protocol (OMP). OMP distributes which edges can reach which VPNs and what paths and policies apply, so the correct endpoints become tunnel peers and traffic is steered over the chosen tunnels with the desired encryption and QoS.

So the VPN’s purpose is traffic segmentation and policy application, while the data-plane tunnels provide encrypted, routed paths between edges to carry that traffic. It’s not limited to remote login, it doesn’t implement routing protocols by itself, and it isn’t solely about encrypting management traffic.