Arista Guides
Design and field notes on Arista's SD-WAN (formerly VeloCloud) and its campus and branch stack: CloudVision, AGNI, 710P switches and Wi-Fi 7 access points.
SD-WAN (VeloCloud)
Arista SD-WAN, formerly VMware VeloCloud: components and gateways, spoke and hub topologies, Enhanced HA wiring, dual-DIA underlay, and routing-protocol integration.
-
Arista VeloCloud Edge HA Part 1: How Failover Actually Works, and CVE-2026-86106
On 9 September 2026 Arista disclosed four VeloCloud Edge and Gateway CVEs in one batch. This one, CVE-2026-86106, lives entirely inside the HA peer channel between two Edges, so Part 1 goes deep on how that channel actually works before explaining the bug in it.
-
VeloCloud SDWAN and Partner Gateways Part 1: MPLS-Only Site Architecture
A deep dive into how VeloCloud SDWAN connects MPLS-only branch sites via Partner Gateways — covering the NNI, underlay BGP peering, and why MPLS-only edges present a unique onboarding challenge.
-
Arista (VMware) SDWAN Deep Dive — Part 1: Components, Gateways, and the Three Planes
First post in a five-part deep dive on Arista (VMware) SDWAN. We start with the components — Edges, Cloud Gateways, Partner Gateways, Orchestrator, Controller — and the three planes that bind them. Sets up a UK ISP scenario that the rest of the series will pick apart.
-
Arista VeloCloud Edge HA Part 2: CVE-2026-86107, CVE-2026-86108, CVE-2026-86109, and the Fix
The other three VeloCloud Edge and Gateway CVEs from Arista's 9 September 2026 batch: a VCMP tunnel crash, an OS command injection in the management workflow, and a signature-validation gap in the update mechanism. All three share their fixed releases with Part 1's HA bypass.
-
VeloCloud SDWAN and Partner Gateways Part 2: Onboarding an MPLS-Only Edge
A step-by-step walkthrough of how an MPLS-only VeloCloud Edge activates using a temporary internet path injected into the MPLS VRF, what changes once the VCMP tunnels are up, and how the production routing state differs from the onboarding state.
-
Arista (VMware) SDWAN Deep Dive — Part 2: Routing — Overlay, Underlay, BGP, and the Gateway as Route Reflector
Part 2 of five. How prefixes get into the overlay, how the Gateway redistributes them, the three Cloud VPN modes, BGP at the Edge and the Partner Gateway, and the route-selection logic that decides which underlay a flow ends up on.
-
VeloCloud SDWAN and Partner Gateways Part 3: Taming the Default Route at the NNI
Why a 0/0 leaking from the MPLS underlay into a VeloCloud Partner Gateway is dangerous, how to filter it at the NNI, and the VeloCloud best practice approach to default route handling — with BGP policy examples.
-
Arista (VMware) SDWAN Deep Dive — Part 3: The Data Plane — VCMP, DMPO, and Per-Flow Steering
Part 3 of five. Wire-level look at VCMP encapsulation, the DMPO measurement loop, Business Policy and per-flow steering, and the on-path remediation (FEC, duplication, jitter buffer) that lets the overlay tolerate underlays that misbehave.
-
Arista (VMware) SDWAN Deep Dive — Part 4: Topology Walkthroughs — MPLS-only meets Internet-only Across Continents
Part 4 of five. The GlobalCo packet-flow walkthroughs — Newcastle to HQ, Bristol to HQ, Chicago to a UK Cloud Gateway (why it fails), and the headline: MPLS-only Chicago talking to Internet-only Shanghai via a Partner Gateway, hop by hop.
-
Arista (VMware) SDWAN Deep Dive — Part 5: Best Practice, Failure Modes, and a Design Checklist
Part 5 of five. Gateway design rules, Partner Gateway sizing, segmentation, security service insertion, MTU, the failure modes that catch teams the first time, and a one-page design checklist for an Arista (VMware) SDWAN rollout.
-
Read-Only to Operator: CVE-2026-114625 and the Third Exploited VeloCloud Orchestrator Bug Since July
Arista's SA 0199 discloses CVE-2026-114625, an actively exploited SQL injection in on-prem VeloCloud Orchestrator that lets the lowest tenant role act as a superuser operator. Fixes exist for 5.2, 6.1 and 6.4. It is the third exploited VCO bug in under three months.
-
Certificate Required, Credentials Not: CVE-2026-93952 and the Second VeloCloud Orchestrator 10.0 of the Summer
Arista's SA 0183 discloses CVE-2026-93952, an actively exploited CVSS 10.0 flaw in on-prem VeloCloud Orchestrator that only bites when Edges authenticate with certificates. Fixes exist for 5.2 and 6.4, not yet 6.1 or 7.0, and July's patched builds are still exposed.
-
SDWAN Control Plane Showdown: Three Philosophies for Solving the Same Problem
Fortinet collapses control onto the data-plane device. Arista/VeloCloud collocates it on a multi-tenant Gateway. Cisco/Viptela decouples it fully into vSmart and OMP. Three architectures covered on this site, lined up side by side, right before the Cisco series picks up the third one.
-
A Brief History of SDWAN Controllers: Viptela, VeloCloud, CloudGenix, and Why Cisco Runs Two SDWAN Stacks
Three startups solved SDWAN's control-plane problem within a year of each other. Two got bought by exactly the company you'd expect; one brand didn't survive. The acquisition history of Viptela, VeloCloud, and CloudGenix — and why Cisco still runs two unrelated SDWAN stacks today.
-
From DSCP to Deep Packet Inspection: Why SDWAN Application-Aware Routing Killed Traditional QoS
A deep technical comparison of legacy QoS (DSCP/CoS, static priority queues, box-by-box CLI) against SDWAN Application-Aware Routing — plus a vendor-by-vendor breakdown of how Cisco Catalyst SDWAN, Fortinet, Juniper Mist (128T), and VeloCloud actually identify and steer application traffic.
-
Advanced tcpdump Recipes for the Enterprise Engineer: The Packet Never Lies
Bitwise BPF masking, enterprise recipes for asymmetric routing and retransmission hunting, a safe SSH-to-Wireshark live-streaming setup that won't loop your own session, and a cross-vendor capture map spanning Debian, Cisco IOS, FortiOS, Junos, and VeloCloud.
-
Designing an Arista SDWAN Spoke with Enhanced HA, Dual DIA, and OSPF
Building a resilient Arista (formerly VeloCloud) SDWAN spoke: two Edges in Enhanced HA, two DIA circuits wired the optimal way, a multi-VLAN LAN, OSPF for route exchange, and the caveats that bite in practice.
SD-Branch (CloudVision, AGNI and the 710P)
Arista campus and branch: 710P-16P switches, Wi-Fi 7 access points, CloudVision and AGNI, from onboarding through RadSec and 802.1X/MAB policy to day-two operations.
-
Arista SD-Branch Part 1: The Product Map for CloudVision, AGNI and the 710P
A map of Arista's campus and branch stack: EOS switches, Wi-Fi 7 access points, CloudVision, CV-CUE and AGNI. What each piece does, where VeloCloud fits, and how this series is sourced.
-
Arista SD-Branch Part 2: The 710P-16P Switch, PoE Budget and Port Layout
What the Arista 710P-16P gives you: port mix, PoE standards and budget, uplinks, forwarding numbers and EOS requirements, plus how to size it against Wi-Fi 7 access points.
-
Arista SD-Branch Part 3: Onboarding Switches to CloudVision with ZTP and TerminAttr
How a 710P gets into CloudVision: token onboarding, TerminAttr streaming, ZTP, and the first-run gotchas around AAA. Documented from Arista's CloudVision guides, not run.
-
Arista SD-Branch Part 4: CloudVision Studios, Port Profiles and Change Control
How CloudVision builds campus configuration: the Studios, the workspace and change-control workflow, and port profiles for data, voice and guest. With the EOS config each profile generates.
-
Arista SD-Branch Part 5: Wi-Fi 7 Access Points and CV-CUE Wireless Management
Arista's Wi-Fi 7 access point range, what separates the models, and how CV-CUE manages SSIDs, roles and wireless security. Documented from Arista specs and Test Drive guides.
-
Arista SD-Branch Part 6: AGNI Explained, Networks, Segments and Role Profiles
The AGNI object model in plain terms: access devices, networks, segments, role profiles and clients. Plus onboarding, PKI, UPSK, guest access, integrations and licensing, from Arista's datasheet.
-
Arista SD-Branch Part 7: Configuring RadSec Between EOS Switches and AGNI
The certificate and SSL profile work needed to bring up RadSec from an Arista switch to AGNI, done by hand and then through the eos_agni_radsec Ansible role, with a review of what the role does and does not do.
-
Arista SD-Branch Part 8: Wired 802.1X and MAB Policy with AGNI on EOS
The wired access policy end to end: EOS 802.1X and MAC-based authentication config, an EAP-TLS network with MAC fallback in AGNI, and the commands to verify a session from the switch and the platform.
-
Arista SD-Branch Part 9: Wireless EAP-TLS, UPSK and Guest Portal Policy with AGNI
Wireless access policy with AGNI and CV-CUE: RadSec for access points, an EAP-TLS SSID, UPSK for IoT, and a captive-portal guest SSID with VXLAN tunnelling. Documented from Arista's published lab material.
-
Arista SD-Branch Part 10: Day-Two Operations, Upgrades and Automation
Running the Arista branch after go-live: Smart System Upgrade, observability and endpoint troubleshooting in CloudVision, compliance checks, and the APIs and AVD options for automation.
-
Arista SD-Branch Part 11: Arista vs Fortinet, Cisco and Juniper for the Branch
A closing comparison of Arista CloudVision and AGNI against Fortinet, Cisco and Juniper branch stacks, with the trade-offs, a design checklist, and where the Arista approach fits.
Other Arista Posts
-
Five Minutes and an Empty Port Part 10: The Closing Checklist and a Vendor Comparison
Closing the series: a practical checklist pulling Parts 7 through 9 together, and a straight comparison of how Cisco, Fortinet, Juniper, and Arista actually implement each control.