SD-WAN: an encrypted overlay, run by controllers
Every mechanism has a step-by-step animation, the configuration explained line by line and the exam notes. Where a parameter changes the outcome, you get a simulator in which you change it yourself.
TL;DR
SD-WAN separates the control plane from the data plane: vManage configures, vBond authenticates and discovers the NAT, vSmart distributes the routes and policies through OMP, and the WAN Edges in the sites bring up IPsec tunnels over any transport (MPLS, Internet, LTE) and measure them with BFD. Each tunnel endpoint is a TLOC (system-ip + color + encapsulation); each OMP route carries a VPN label, so a single tunnel carries all the isolated segments. Centralized policies decide the topology (hub-and-spoke from vSmart) and the path per application (AAR by SLA), DIA takes the Internet out directly from the branch, and security comes from certificates, keys distributed through OMP and the firewall stack on the Edge. Most incidents are incompatible NATs, a wrong organization-name, a wrong clock or policies without a default-action.
How to read the notes: red = critical for the exam, green = theory, blue = numbers, yellow = pitfalls, cyan = vEdge ↔ IOS-XE SD-WAN differences and new vs old names. In the animations, the configuration lines used in the current step are highlighted automatically; the ← → arrows change the step when the animation is selected.
The analogy, in short
Think of a taxi fleet with a dispatch center: the registration desk checks a new driver's ID and gives him the dispatch number (vBond), the dispatch center knows where every car is and which roads are open (vSmart, OMP), the management office writes the rules (vManage), and the armored cars carry the passengers on the toll highway or through the city streets, depending on the traffic (Edge, IPsec, AAR).
The model holds up to §12. From §13 on (the integrations with OSPF, BGP, SD-Access, multicast), it breaks; see the full analogy and its limits in §16.