SD-WAN Edge Offline? 3 Quick Fixes I Always Try First

1. Bad WAN Link Is the Most Common Cause

I've seen this happen a lot. Your SD-WAN edge device looks offline in the controller, but it's not really dead — it just lost its primary WAN connection. Maybe someone tripped over a cable, or the ISP had a short outage. The tricky part? The device might still show a link light on the port, but no traffic passes.

First thing I do: Check the WAN interface status on the device itself. SSH into the edge device and run:

show interface | include WAN
show ip interface brief

Look for the interface that connects to your internet router. If its status is down/down, the cable or the ISP router is the problem. If it's up/down, the physical link is fine but the IP config is wrong – maybe a DHCP lease expired or the static IP was changed.

Real fix: If it's down/down, reseat the cable on both ends. Try a different port on the ISP router. I've also seen ISP routers fail to hand out a DHCP lease after a power glitch – reboot the ISP router (not your SD-WAN box) and see if the edge comes online.

If you're using a cellular backup WAN link, check that too. On Viptela/SDWAN devices, run:

show cellular 0/0/0 status

If it says "no signal" or the SIM is not registered, you've got a cellular issue. Sometimes it's as simple as the SIM card needing to be reseated.

2. DNS Resolution Failure – Your Edge Can't Find the Controller

I tripped on this my first year. The edge device was physically connected to the internet – I could ping 8.8.8.8 from it – but it still showed offline. The problem? The controller's domain name wasn't resolving. The edge tries to reach the vManage/vSmart controller by its FQDN, and if DNS is broken, it can't.

Check this right after the WAN link: SSH into the edge and try:

ping controller.yourdomain.com
nslookup controller.yourdomain.com

If the ping to the IP works but the name doesn't resolve, you've got a DNS problem. If neither works, you're back to the WAN link issue above.

The fix: First, confirm the DNS server your edge is using. On Viptela/Cisco SD-WAN, look at the system config:

show running-config | include dns

If it's using a public DNS like 8.8.8.8 and that's blocked by your ISP (I've seen it happen), switch to your internal DNS or another public server like 1.1.1.1. Also, check that the DNS server can actually resolve the controller's hostname – I've seen admins forget to add the DNS record for a new controller after a migration.

One more thing: If you have multiple DNS servers, the edge might try the second one after the first fails. But if both are misconfigured, you're stuck. I always set two different providers (like 8.8.8.8 and 1.1.1.1) to avoid this.

3. Expired or Misconfigured Certificates

This one's sneaky because everything else looks fine – the WAN link is up, DNS works, you can even ping the controller IP – but the edge still says offline. The device can't authenticate with the controller because its certificate is expired or the root CA certificate isn't trusted.

How to spot it: SSH into the edge and run:

show certificate list
show certificate expiry

Look for certificates that are expired or expiring within 30 days. I've seen edge devices go offline exactly on the day the certificate expired – no warning unless you check.

The fix: If the certificate is expired, you need to regenerate it from the vManage/vSmart controller. On the controller side, go to Administration > Certificates and revoke the old one, then issue a new one. Then upload the new certificate to the edge device. On Viptela devices, you can use the CLI:

request certificate generate
request certificate install <certificate-string>

If the root CA certificate is missing or wrong (I've seen this after a controller upgrade), you'll need to re-import the CA chain. Check that the controller's root certificate is in the device's trust store. On Cisco SD-WAN 20.x and later, you can also try this from the controller GUI: Configuration > Devices > select the edge > Actions > Reboot – sometimes a reboot forces a certificate re-check.

Pro tip: Set up a monitoring alert for certificate expiry at least 30 days before. I use a simple cron job on the controller to check every Monday and email the team. Saves so much headache.

Quick-Reference Summary Table

I've seen these three causes cover roughly 9 out of 10 offline edge cases. Start with the WAN link – it's the easiest to spot and fix. DNS is next. Certificates are the most annoying because they look like a network problem but it's really an authentication issue.

If none of these work, you might need to check the device's provisioning status – sometimes the edge was never fully onboarded. But that's a whole different article.