---

name: sd-wan-engineer description: | Design, deploy, and operate SD-WAN—overlay WAN (hub-spoke, mesh, regional hubs), underlay overlay (MPLS, broadband, LTE/5G), path selection, application-aware routing, SASE, zero trust WAN, branch connectivity, orchestration templates, NGFW/SWG/ZTNA insertion, HA, and brownfield SD-WAN migration; vendor-agnostic (Viptela, VeloCloud, Prisma SD-WAN). This skill should be used when the user asks about SD-WAN, software-defined WAN, SDWAN engineer, overlay WAN, path selection, application-aware routing, hub-spoke SD-WAN, SASE, zero trust WAN, branch connectivity, underlay overlay, VeloCloud, Viptela, Prisma SD-WAN, WAN optimization, or brownfield SD-WAN migration—not carrier BGP/MPLS backbone-only (network-backbone-architect), cloud VPC design (cloud-architect, cloud-engineer), enterprise APIs (enterprise-integration-api-developer), endpoint security program only (information-security-engineer), or physical DC cabling (infrastructure-engineer).

SD-WAN (Software-Defined WAN) Engineer

When to Use

• Design overlay WAN topologies—hub-spoke, full mesh, regional hub, dynamic mesh
• Plan underlay diversity—MPLS, DIA broadband, LTE/5G, private line, and carrier handoff
• Define path selection, SLA classes, and application-aware routing policies
• Architect SASE integration—SWG, CASB, ZTNA, and cloud security service insertion
• Build orchestration models—device templates, feature templates, policy groups, RBAC
• Plan brownfield migration from MPLS/VPN hub-spoke or legacy WAN optimizers
• Specify branch CPE roles—active/active, TLOC extensions, service chaining, local breakout
• Troubleshoot overlay vs underlay—tunnels, BFD, NAT, MTU, and path stickiness
• Design multi-cloud and DC breakout—regional gateways, cloud on-ramps, and hairpin avoidance
• Produce runbooks, acceptance tests, and monitoring baselines for WAN operations

When NOT to Use

• Carrier core BGP/MPLS design, IX peering, or internet backbone routing only → network-backbone-architect
• Cloud landing zone, VPC design, and Well-Architected service selection → cloud-architect, enterprise-cloud-architect
• Provision cloud subnets, VPN to cloud, and managed LB without SD-WAN overlay focus → cloud-engineer
• Cloud IAM, CSPM, and org guardrails as primary deliverable → cloud-security-engineer
• Corporate security program, IdP, and endpoint controls without WAN architecture → information-security-engineer
• Terraform modules, CI/CD, and K8s delivery without SD-WAN design → infrastructure-engineer
• SLO programs, on-call, and production incident process as main task → site-reliability-engineer
• Application throughput, caching, and horizontal scale without WAN path design → high-concurrency-scalability
• REST/GraphQL and enterprise application integration → enterprise-integration-api-developer
• Physical rack, power, and cabling without SD-WAN edge role → infrastructure-engineer, field-services-engineer

Related skills

Need	Skill
Carrier backbone, BGP/MPLS core, DCI at scale	network-backbone-architect
Cloud reference architecture and hybrid connectivity	cloud-architect
Enterprise cloud governance and multi-BU programs	enterprise-cloud-architect
Implement cloud networking and managed connectivity	cloud-engineer
Cloud network security controls and posture	cloud-security-engineer
IaC, physical build, and platform delivery	infrastructure-engineer
Reliability engineering, SLOs, and production incidents	site-reliability-engineer
Application-scale concurrency and load distribution	high-concurrency-scalability
Corporate security program and tooling	information-security-engineer

Core Workflows

1. Scope, constraints, and success criteria

Clarify sites, traffic matrix, compliance, and migration constraints.

See references/sd_wan_engineer_scope.md.

2. Overlay topology and underlay

Select hub roles, mesh policy, and circuit mix per site class.

See references/overlay_topology_and_underlay.md.

3. Path selection, SLA, and application routing

Define business policies, SLA classes, and app identification.

See references/path_selection_sla_and_app_routing.md.

4. Security, SASE, and service insertion

Place NGFW, SWG, ZTNA, and local vs centralized breakout.

See references/security_sase_and_ztna_insertion.md.

5. Orchestration, templates, and day-two operations

Model controllers, templates, change workflow, and observability.

See references/orchestration_templates_and_operations.md.

6. Migration, HA, and troubleshooting

Plan cutover waves, HA modes, and overlay/underlay fault isolation.

See references/migration_ha_troubleshooting.md.

Outputs

• WAN context — site inventory, traffic matrix, critical apps, and compliance constraints
• Logical topology — overlay roles, hub map, regional gateways, and breakout points
• Underlay map — circuits per site, diversity, carrier handoff, and IP addressing plan
• Policy catalog — SLA classes, path selection rules, and application definitions
• Security architecture — service insertion, SASE integration, and segmentation zones
• Orchestration model — template hierarchy, RBAC, and promotion workflow
• Migration plan — waves, rollback triggers, parallel-run criteria, and acceptance tests
• Operations pack — dashboards, alarms, runbooks, and escalation matrix

Principles

• Treat underlay independence as a design goal—overlay must survive single-circuit loss where required
• Prefer explicit SLA classes over opaque “best path” defaults; document stickiness and failover timers
• Minimize hairpinning—local breakout for trusted SaaS and regional gateways for cloud on-ramps
• Design brownfield with parallel run and measurable cutover gates, not big-bang unless constrained
• Separate control plane (orchestrator) resilience from data plane (edge) HA in runbooks
• Use vendor concepts generically; validate against target platform docs before production config