They are not equivalent products. Cisco Catalyst SD-WAN Manager is the centralized system for managing the SD-WAN fabric; Cisco Catalyst SD-WAN Cloud is a Cisco-hosted operating model for SD-WAN control components. The practical choice is about who runs that infrastructure, how much deployment control and integration you need, and which security controls apply at each layer. Cisco describes Manager and the wider SD-WAN architecture in its Catalyst SD-WAN Solution Overview.
What each name refers to
Manager provides centralized dashboards and tools to provision and configure devices, manage licenses, upgrade software, and monitor and troubleshoot the fabric. Controllers are separate components: they manage the overlay control plane and distribute routing and policy information.
Cloud describes where and by whom control components are operated, rather than an alternative name for Manager. Depending on the selected model, Manager and the other control components may be hosted and operated by Cisco, hosted in the customer’s environment and operated by the customer, or hosted in the customer’s public-cloud account and still operated by the customer.
Who operates the control components?
Cisco’s solution overview distinguishes Cisco-hosted operation from self-managed deployment. Cisco says that for its cloud-hosted model it builds, operates, and monitors the control components, so customer administrators can focus mainly on configuration and policy. With self-managed deployment, the customer takes responsibility for installing and maintaining those components, as well as their operations, monitoring, capacity, and scaling.
Recommended Free Tools
#1 Best Overall
Self-managed deployment can be on-premises in the customer’s data center or hosted in the customer’s public-cloud environment, such as AWS or Azure. The hosting location alone does not make a deployment Cisco-managed: the customer remains responsible for operating self-managed components.
How Cisco Cloud, Cloud-Pro, and Cloud-MSP differ
Cisco’s CloudOps fabric-type documentation, updated September 28, 2026, describes these Cisco-hosted options:
Rank #2
| Option | Hosting and operations | Documented choices and constraints |
|---|---|---|
| Cloud | Cisco hosts and manages the control components. | Uses long-lived recommended software releases. Standard Cloud has the identity, device, topology, and integration constraints described below. |
| Cloud-Pro | Cisco-hosted control components. | Offers options including an isolated/private instance, specified software versions, selection of AWS or Azure and an available region, and control over the software upgrade schedule. BYOIdP is available for Cloud-Pro. |
| Cloud-MSP | Manager, Validator, and Controller hosting is dedicated to an MSP’s multitenant environment. | Cisco’s guide says Cloud-MSP can be hosted only on AWS. |
| Self-managed | The customer operates the control components, whether on-premises or in its public-cloud environment. | The customer takes on installation and ongoing operational and maintenance responsibility. |
Standard Cloud’s documented differences from traditional customer-managed deployments include support for Cisco IOS XE SD-WAN edge devices rather than legacy Viptela OS vEdge devices; Cisco CCO as the identity provider; no current Multi-Region Fabric support; and no direct integration in the current SaaS model with customer-managed AAA, TACACS, or Syslog services. Cisco also limits specific controller-location selection for standard Cloud and directs customers needing certain features toward a Cloud-Pro dedicated fabric. These details are from Cisco’s getting-started guide; verify the current service documentation against the intended fabric before procurement or compliance decisions.
Cloud architecture and the documented device threshold
For a cloud-based control-component subscription serving a fabric with fewer than 1,500 devices, Cisco documents a default public-cloud architecture of one SD-WAN Manager, two Validators, and two Controllers. One Manager, one Validator, and one Controller are placed in a primary region; the additional Validator and Controller are in a secondary or backup region. This is a documented default for that stated scale, not a performance benchmark or a universal design for every fabric size or service configuration. Cisco’s CloudOps architecture page was updated September 28, 2026.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What security protections apply—and at which layer?
SD-WAN fabric communications
Cisco’s Catalyst SD-WAN security guide for Releases 26.x and later, updated April 24, 2026, describes authentication, encryption, and integrity protections. It identifies DTLS/TLS for control-plane communications, IPsec tunnels for data-plane traffic, and IKEv2 for IPsec connections to external devices. These describe protections for fabric communications; by themselves, they do not establish that Cisco-hosted or self-managed control components are more secure.
Cisco-hosted cloud environment
Cisco’s CloudOps Security FAQs, updated September 28, 2026, describe AWS network-level DDoS protections and security groups, WAF and application-level DDoS protections, protection of data in transit and at rest, security monitoring, role-based access control, and ACLs. These are Cisco’s descriptions of its cloud environments, not independent assurance or a guarantee about every customer’s configuration.
Rank #4
The same FAQ says SSO is supported in all models except SD-WAN Cloud, formerly CDCS. It describes a custom VPC option with private interfaces and access using TACACS, RADIUS, or AAA when SSO is not used. Treat that as a separate access-control consideration from the identity-provider distinction: Cisco’s getting-started guide identifies CCO for standard Cloud and BYOIdP availability for Cloud-Pro.
Security Cloud Control integration
Security Cloud Control (SCC) is a related security-policy management platform, not another name for SD-WAN Manager. Cisco says the integration supports centralized security policy and object configuration, plus monitoring and analysis of security events. The cited integration guide lists IOS XE Catalyst SD-WAN Release 17.18.1a and Secure Router version 20.12 or later as minimum requirements. Once Manager is onboarded to SCC, Cisco says the relevant policy, object, and profile management must be performed through SCC. Confirm release support and integration restrictions for the target environment.
How to choose between the operating models
- Decide who should operate the control plane. Choose Cisco-hosted operation if reducing customer responsibility for control-component infrastructure is the priority. Choose self-managed deployment if your organization intends to install and operate those components itself.
- List deployment choices you cannot compromise on. If you need an isolated/private instance, specified software version, a chosen upgrade schedule, or selection among available AWS or Azure regions, assess Cloud-Pro’s documented options.
- Check identity and operations integrations. Validate the required identity provider and any dependency on customer-managed AAA, TACACS, or Syslog. Standard Cloud’s documented limits may be decisive; Cloud-Pro lists BYOIdP capability.
- Confirm edge platforms and topology. Verify whether the fabric uses IOS XE SD-WAN or legacy vEdge devices, and whether Multi-Region Fabric is required.
- Separate security requirements by layer. Identify requirements for fabric traffic protection, cloud infrastructure, administrator access, and SCC policy workflows. Verify the specific release, service configuration, contract, and available location.
- Validate assurance and residency evidence. Confirm requirements against the exact service, contract, and location. Cloud-Pro offers a choice among available regions, and Cisco’s fabric-type documentation lists commercial certification options; do not assume an option or certification applies to every fabric or service scope.
Cisco’s product and CloudOps materials describe the features and operating models, but they do not establish an independent comparative security test, breach-rate comparison, performance benchmark, or cost advantage for Manager versus Cloud. There is no evidence-based universal winner: the fit depends on the operational responsibility, control, integration, location, and security requirements of the specific deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
