A fire district designs Cisco SD-WAN so transport underlays stay separate from departmental overlay routing. Which model correctly separates those planes?

In Cisco SD-WAN, VPN 0 is the transport VPN: underlay attachments, TLOCs, and control connections toward the controllers live there so Edges can form the fabric over MPLS, Internet, or LTE colors. Civic departmental prefixes for the fire district belong in one or more service VPNs, which keep overlay routing segmented from the transport table. That plane separation is what lets Fire Ops, EMS, and admin routes move as overlay traffic without being mixed into underlay reachability or controller discovery paths.

Placing civic department prefixes in VPN 0 and treating service VPNs as management-only inverts the model and contaminates transport with departmental routing. Collapsing underlay and overlay into one global table on every Edge erases the VRF-like isolation SD-WAN is built around. Advertising departmental routes only through the vBond orchestrator control channel misunderstands vBond’s onboarding and orchestration role—it is not the data-plane VPN for civic prefixes.

Exam caveat: VPN 0 may carry limited management or controller-facing functions depending on design, but customer or departmental overlay routes are still expected in service VPNs; do not equate “management convenience” with putting production civic prefixes in transport.

Operational check: on a firehouse Edge, confirm WAN interfaces and TLOCs sit in VPN 0, verify departmental LAN handoffs and OMP routes in the intended service VPN IDs, and prove that underlay failure symptoms differ from service-VPN routing loss before changing templates.