Anatomy of an AI Agent for Cisco SD-WAN: 20+ Knowledge Assessment Questions & Answers

 Anatomy of an AI Agent for Cisco SD-WAN: Knowledge Assessment for Network Engineers

1. Introduction

AI agents are becoming increasingly relevant to network operations. For Cisco SD-WAN engineers, concepts such as planning, RAG, tool calling, ReAct, memory, context windows, Human-in-the-Loop, and multi-agent orchestration can be connected directly to real-world network troubleshooting.

Imagine receiving an alert:

"The SD-WAN tunnel between Branch-101 and the data center is experiencing intermittent packet loss."

A traditional troubleshooting process might involve checking the SD-WAN Manager, tunnel status, BFD sessions, control connections, application-aware routing, interface statistics, routing information, and device logs.

An AI agent could potentially coordinate these investigation steps using approved tools.

This assessment takes the concepts from the Anatomy of an Agent knowledge assessment and adapts them to Cisco SD-WAN scenarios. The original material focuses on concepts including Plan-and-Execute, System Prompt, RAG, Context Window, termination conditions, tool descriptions, ReAct Observation, memory, and Supervisor orchestration.
Try answering each question before checking the answer.

2. Question 1 – Plan-and-Execute in Cisco SD-WAN

An AI agent is asked to investigate why a branch application is experiencing poor performance over Cisco SD-WAN.

Before taking any action, the agent creates a troubleshooting roadmap:

1. Check device health
2. Check WAN interface status
3. Check control connections
4. Check BFD sessions
5. Check tunnel statistics
6. Check application-aware routing
7. Check packet loss and latency
8. Analyze the findings
9. Recommend remediation

What is the primary benefit of this approach?

A. It eliminates the need for SD-WAN Manager

B. It allows the agent to create an explicit roadmap before acting, making complex tasks more manageable

C. It guarantees that the network problem will be fixed

D. It removes the need for network engineers

Answer: B – It allows the agent to create an explicit roadmap before acting, making complex tasks more manageable.

This reflects the Plan-and-Execute concept from the source assessment, where separating planning from execution provides an explicit roadmap for complex tasks.

3. Question 2 – System Prompt for a Cisco SD-WAN Agent

You are building an AI agent for Cisco SD-WAN operations.

The agent should be able to investigate device health, routing, BFD, and tunnel status, but it must not make production configuration changes without authorization.

Which component should define these rules?

A. Context Window

B. RAG

C. System Prompt

D. Memory

Answer: C – System Prompt

The System Prompt defines the agent's identity, scope, and behavioral guidelines.

For example:

You are a Cisco SD-WAN troubleshooting assistant.

You may:
- Read operational information
- Analyze SD-WAN health
- Investigate connectivity problems
- Recommend remediation

You must:
- Follow approved procedures
- Request human approval before production changes
- Explain the evidence behind your recommendation

4. Question 3 – RAG for Cisco SD-WAN

A company wants its AI agent to use the organization's latest SD-WAN design documents, troubleshooting procedures, security standards, change-management policies, and approved runbooks.

Which capability would be most appropriate?

A. RAG

B. Context Window

C. Iteration Limit

D. Tool Description

Answer: A – RAG

RAG, or Retrieval-Augmented Generation, allows an agent to access current and organization-specific knowledge.

For a Cisco SD-WAN environment, a RAG knowledge base could contain:

• SD-WAN design documents
• WAN standards
• Troubleshooting runbooks
• Change procedures
• Security policies
• Branch deployment standards
• Previous incident reports
• Internal operational documentation

5. Question 4 – Context Window

An AI agent is troubleshooting a Cisco SD-WAN connectivity problem.

It needs to consider:

• Previous tool results
• BFD status
• Control connections
• Tunnel information
• Routing information
• Interface statistics
• Current conversation

What does the context window represent?

A. The physical memory available on an SD-WAN router

B. The time for which an SD-WAN tunnel remains active

C. The span of tokens the model can consider at one time when making decisions

D. The maximum number of SD-WAN sites supported

Answer: C – The span of tokens the model can consider at one time when making decisions.

This is the definition used in the source assessment.

For a network engineer, you can think of the context window as the information the AI can consider while making its current decision.

6. Question 5 – Agent Termination

An AI agent is troubleshooting an SD-WAN tunnel.

Which of the following is NOT a valid termination condition for the agent loop?

A. The requested troubleshooting task has been completed

B. The maximum iteration limit has been reached

C. The agent's confidence level drops below a configured threshold

D. The agent receives approval to continue

Answer: D – The agent receives approval to continue.

Approval to continue means the agent can proceed; it does not itself represent a termination condition.

The source assessment makes the same distinction.

7. Question 6 – Detecting an Agent Loop

An AI agent is troubleshooting an SD-WAN tunnel.

The activity trace shows:

Iteration 3
Action: Check BFD session
Observation: Request timed out

Iteration 4
Action: Check BFD session
Observation: Request timed out

Iteration 5
Action: Check BFD session
Observation: Request timed out

What problem is the agent demonstrating?

A. Successful termination

B. A loop

C. Human-in-the-Loop

D. RAG failure

Answer: B – A loop

The agent is repeatedly performing the same action without making progress.

Mechanisms such as:

• Iteration limits
• Action-history tracking
• Repeated-action detection
• Fallback strategies

can help prevent an agent from getting stuck.

The source assessment uses a similar repeated-action trace to test this concept.

8. Question 7 – Tool Description

An AI agent has access to the following Cisco SD-WAN tools:

get_device_health
get_bfd_status
get_tunnel_statistics
get_route_information

Why is the description field in a tool schema important?

A. It determines how fast the tool executes

B. It helps the LLM determine when to use the tool

C. It changes the SD-WAN device configuration

D. It automatically increases WAN bandwidth

Answer: B – It helps the LLM determine when to use the tool.

The source assessment specifically identifies the tool description as helping the LLM decide when to use one tool versus another.

For example:

get_bfd_status:
Retrieve the operational state, packet loss,
latency, and session status of SD-WAN BFD sessions.

A clear description makes tool selection easier for the agent.

9. Question 8 – Selecting the Correct SD-WAN Tool

An engineer asks:

"Show me the current BFD session status between Branch-101 and the data center."

Which tool would be most appropriate?

A. get_route_information

B. get_bfd_status

C. change_sdwan_policy

D. send_email

Answer: B – get_bfd_status

The agent should select the tool whose purpose most closely matches the requested operation.

10. Question 9 – Tool Categories

Match each SD-WAN agent activity with the appropriate tool category.

SD-WAN Activity	Tool Category
Retrieve tunnel statistics	Retrieval
Apply an approved SD-WAN policy change	Execution
Request engineer approval	Communication
Extract structured information from raw device logs	Perception

Answer:

• Retrieve tunnel statistics → Retrieval
• Apply an approved policy change → Execution
• Request engineer approval → Communication
• Extract structured information from raw logs → Perception

These categories follow the tool-category structure used in the source assessment.

11. Question 10 – Perception Tool

An AI agent receives thousands of unstructured Cisco SD-WAN device log messages.

It needs to extract:

Device
Interface
Timestamp
Event
Severity
Error condition

Which tool category would be most appropriate?

A. Retrieval

B. Execution

C. Communication

D. Perception

Answer: D – Perception

Perception is appropriate when the agent needs to interpret unstructured information and extract useful structured information.

The source assessment uses extraction of structured data from unstructured syslog as the example for Perception.

12. Question 11 – ReAct Observation

An AI agent troubleshooting Cisco SD-WAN follows this pattern:

Thought
   ↓
Action
   ↓
Observation

The agent calls an SD-WAN monitoring API to retrieve BFD statistics.

What is the purpose of the Observation step?

A. Generate the final answer immediately

B. Receive and process the result of the tool call

C. Restart the SD-WAN device

D. Delete the previous action

Answer: B – Receive and process the result of the tool call

The source assessment defines Observation in ReAct as receiving and processing the result of a tool call.

Example:

Thought:
I need to determine whether packet loss is affecting the tunnel.

Action:
get_bfd_status()

Observation:
BFD session is up, but packet loss is 8%.

The observation provides new information that can influence the next decision.

13. Question 12 – SD-WAN Agent Memory

An AI agent has already checked:

Device health
WAN interface
Control connection
BFD
Tunnel status
Routing table

The agent should avoid repeating the same checks unnecessarily.

Which capability helps retain information about previous actions and results?

A. Memory

B. BFD

C. OMP

D. IPsec

Answer: A – Memory

Memory can help the agent maintain relevant information about its previous investigation.

For a network engineer, think of it as the agent maintaining a troubleshooting history.

14. Question 13 – Short-Term Investigation Context

During an SD-WAN troubleshooting session, the agent has established:

Branch-101 WAN interface → Up
Control connection → Up
BFD → Up
Packet loss → 8%

The agent needs this information when deciding what to investigate next.

Which capability is most directly related to maintaining the current investigation information?

A. Working context / short-term memory

B. OMP

C. IPsec

D. Application-aware routing

Answer: A – Working context / short-term memory

The agent needs the current investigation context so it can make decisions based on what it has already discovered.

15. Question 14 – Supervisor Architecture

A large enterprise wants to create an AI-powered network operations platform containing specialized agents:

SD-WAN Troubleshooting Agent
Security Agent
Performance Agent
Incident Management Agent

Each agent has specialized tools and domain knowledge.

The organization wants a central agent to coordinate these specialized workers and maintain accountability for the overall task.

Which orchestration pattern is most appropriate?

A. Peer-to-peer

B. Hierarchical routing only

C. Supervisor

D. Single agent

Answer: C – Supervisor

A Supervisor architecture uses a central agent to coordinate specialized worker agents.

The source assessment similarly identifies Supervisor as appropriate when multiple specialized functions need coordination and a clear point of accountability.

16. Question 15 – Human-in-the-Loop for SD-WAN

An AI agent determines that an SD-WAN centralized policy needs to be modified.

The change could affect traffic forwarding for hundreds of branch sites.

What should the agent ideally do before making the production change?

A. Apply the change immediately

B. Restart all WAN routers

C. Request appropriate human approval

D. Delete the existing policy

Answer: C – Request appropriate human approval

A safer workflow is:

Investigate
    ↓
Analyze
    ↓
Recommend
    ↓
Human Approval
    ↓
Execute
    ↓
Verify

This is especially important for centralized SD-WAN policies because a single policy change can potentially affect many sites.

17. Question 16 – SD-WAN Agent Safety

An AI agent identifies a possible routing problem and recommends changing a production SD-WAN policy.

Which approach is safest?

A. Give the agent unrestricted administrator access

B. Allow the agent to make any change automatically

C. Use controlled permissions and require approval for high-impact changes

D. Disable logging so the agent can operate faster

Answer: C – Use controlled permissions and require approval for high-impact changes.

The agent should have only the permissions necessary for its assigned role.

18. Question 17 – Agent Cannot Access SD-WAN Data

An AI agent is investigating a branch connectivity issue, but its monitoring API repeatedly returns a timeout.

What should the agent ideally do?

A. Continue calling the same API indefinitely

B. Invent the missing data

C. Use an approved fallback or escalate to a human

D. Modify the SD-WAN policy automatically

Answer: C – Use an approved fallback or escalate to a human

A well-designed agent needs a defined failure-handling strategy.

For example:

API Failure
    ↓
Retry within limit
    ↓
Try approved alternative source
    ↓
If still unavailable
    ↓
Escalate

19. Question 18 – SD-WAN Tunnel Investigation

An engineer reports:

"Branch-101 is experiencing poor application performance."

The AI agent discovers:

WAN interface → Up
Control connection → Up
BFD → Up
Tunnel → Up
Packet loss → 8%
Latency → Significantly higher than baseline

What should the agent do next?

A. Immediately reboot the SD-WAN router

B. Investigate the WAN path and available transport characteristics

C. Delete the SD-WAN policy

D. Replace the branch router

Answer: B – Investigate the WAN path and available transport characteristics

The observations indicate that basic connectivity is available, but path quality may be affecting application performance.

The agent should continue its investigation rather than immediately changing configuration.

20. Question 19 – RAG vs Live SD-WAN Data

An SD-WAN engineer asks:

"What is our organization's approved process for changing a centralized SD-WAN policy?"

Which source would be most appropriate?

A. Generic model knowledge only

B. Organization-specific knowledge retrieved through RAG

C. Random internet content

D. Current BFD statistics

Answer: B – Organization-specific knowledge retrieved through RAG

This is an important distinction:

RAG
 ↓
Organizational knowledge

SD-WAN APIs / Monitoring
 ↓
Current operational state

A capable agent could use both.

21. Question 20 – Complete AI Agent Workflow

Which sequence best represents a well-designed AI agent investigating a Cisco SD-WAN incident?

A.

Change → Guess → Stop

B.

Goal → Plan → Tool → Observe → Analyze → Next Action → Verify → Stop

C.

Login → Change → Logout

D.

Prompt → Modify Policy → Restart Device

Answer: B – Goal → Plan → Tool → Observe → Analyze → Next Action → Verify → Stop

This sequence combines the major concepts covered by the original Anatomy of an Agent assessment.

22. Bonus Question – Think Like a SD-WAN Engineer

An AI agent reports:

"I am 98% confident that the centralized SD-WAN policy is causing the application problem."

Should the network engineer automatically deploy the proposed change?

A. Yes, because the confidence is 98%

B. Yes, because AI systems do not make networking mistakes

C. No. Validate the evidence and follow the organization's change-control process

D. No, because AI can never troubleshoot SD-WAN

Answer: C – Validate the evidence and follow the organization's change-control process.

AI confidence should not replace engineering judgment.

For production changes, the engineer should review:

• Evidence
• Impact
• Scope
• Proposed change
• Rollback plan
• Change window
• Approval requirements

23. Quick Answer Key

Question	Answer
Q1	B
Q2	C
Q3	A
Q4	C
Q5	D
Q6	B
Q7	B
Q8	B
Q9	Matching
Q10	D
Q11	B
Q12	A
Q13	A
Q14	C
Q15	C
Q16	C
Q17	C
Q18	B
Q19	B
Q20	B
Bonus	C

24. Cisco SD-WAN Concepts That an AI Agent Could Potentially Investigate

For a Cisco SD-WAN engineer, an AI agent could potentially be given controlled access to information related to:

• SD-WAN Manager health
• WAN Edge devices
• Control connections
• BFD sessions
• OMP information
• IPsec tunnels
• Routing information
• Transport interfaces
• Application-aware routing
• SLA information
• Packet loss
• Latency
• Jitter
• Device alarms
• Interface statistics
• Centralized policies
• Localized policies
• Configuration templates
• Device logs

This is where your existing networking knowledge becomes valuable.

You already know what these objects mean. The AI-agent layer adds a mechanism for collecting, correlating, and reasoning over that information.

25. Example: AI Agent Troubleshooting a Cisco SD-WAN Application

Consider this real-world scenario:

"Users at Branch-101 report that the ERP application is slow."

A traditional troubleshooting process might look like:

Check Branch Router
       ↓
Check Interface
       ↓
Check BFD
       ↓
Check Tunnel
       ↓
Check Routing
       ↓
Check Application-Aware Routing
       ↓
Check Loss / Latency / Jitter
       ↓
Check Logs

An AI agent could potentially coordinate the same workflow.

Step 1 – Understand the Objective

The objective is not simply:

"Check the router."

The actual objective is:

"Determine why the ERP application is experiencing degraded performance."

Step 2 – Create a Plan

Application
   ↓
Path
   ↓
Transport
   ↓
Tunnel
   ↓
Routing
   ↓
Device

Step 3 – Call Tools

The agent retrieves operational information.

Step 4 – Observe

Suppose it discovers:

BFD → Up
Tunnel → Up
Packet Loss → High
Latency → High

Step 5 – Reason

The agent determines that connectivity exists but path quality is degraded.

Step 6 – Retrieve Organizational Knowledge

RAG provides the company's approved troubleshooting procedure.

Step 7 – Recommend

The agent presents the evidence and recommended next step.

Step 8 – Human Approval

If a policy modification is required, the engineer reviews and approves it.

Step 9 – Execute

Only the authorized action is performed.

Step 10 – Verify

The agent checks whether application performance has improved.

Step 11 – Terminate

The investigation ends when the defined success condition is met.

26. Why This Is Different From Traditional SD-WAN Automation

Traditional automation usually follows predefined logic.

For example:

IF BFD DOWN
THEN
Raise Alert

An AI agent can potentially work with a broader goal:

"Investigate why this application is performing poorly."

It may determine that it needs to examine multiple sources before reaching a conclusion.

The distinction can be summarized as:

Traditional Automation
        ↓
Predefined Workflow
        ↓
Known Conditions
        ↓
Known Actions

versus:

AI Agent
        ↓
Goal
        ↓
Plan
        ↓
Select Tools
        ↓
Observe
        ↓
Reason
        ↓
Adapt
        ↓
Verify

The second model is particularly interesting for troubleshooting scenarios where the exact sequence is not known in advance.

27. What Should a Cisco SD-WAN Agent NOT Do?

An AI agent operating in a production SD-WAN environment should not have unrestricted authority.

It should not:

• Change centralized policies without authorization
• Modify routing policies without validation
• Restart production devices automatically
• Disable security controls
• Ignore change-management procedures
• Continue executing actions indefinitely
• Assume that its diagnosis is always correct
• Hide failed actions
• Invent missing operational data

A safer approach is:

Investigate → Analyze → Recommend → Approve → Execute → Verify

rather than:

Investigate → Change

28. Start With Read-Only SD-WAN Automation

If you are a network engineer beginning your AI journey, start small.

A practical progression could be:

Phase 1
Read-only SD-WAN information
        ↓
AI-generated analysis

Phase 2
Read-only information
        ↓
AI diagnosis
        ↓
Human validates

Phase 3
AI recommendation
        ↓
Human approval
        ↓
Controlled execution

Phase 4
Limited autonomous operations
        ↓
Strict guardrails
        ↓
Continuous monitoring

This allows the organization to build confidence gradually.

29. Where Can AI Agents Help Cisco SD-WAN Engineers?

Potential use cases include:

SD-WAN Tunnel Troubleshooting

"Why is the tunnel between Branch-101 and the data center experiencing packet loss?"

BFD Investigation

"Identify branches with unstable BFD sessions."

Application-Aware Routing

"Why is the application using the MPLS path instead of the preferred transport?"

WAN Performance

"Find sites where latency and jitter have exceeded the defined threshold."

Device Health

"Identify unhealthy SD-WAN Edge devices."

Policy Analysis

"Explain which policy is influencing this traffic path."

Incident Investigation

"Investigate this branch outage and provide a timeline."

Change Validation

"Review this proposed SD-WAN policy change and identify potential impact."

These are examples of how AI agents could potentially reduce repetitive investigation tasks.

30. Related Articles From Netterrene

AI Learning

Generative AI Fundamentals Explained for Beginners

A good starting point if you are new to Generative AI and want to understand the fundamental concepts before learning Agentic AI.

Read:
https://netterrene.blogspot.com/2026/06/generative-ai-fundamentals-for-beginners.html

Agentic AI for Network Engineers

Agentic AI for Network Engineers: What It Actually Means for BGP, ACI, and Your NOC

This is the natural next article after understanding the anatomy of an agent. It connects Agentic AI with practical network operations.

Read:
https://netterrene.blogspot.com/2026/07/agentic-ai-for-network-engineers-guide.html

Cisco ACI + AI

Anatomy of an AI Agent for Cisco ACI: Knowledge Assessment for Network Engineers

If you work with both ACI and SD-WAN, compare how the same AI-agent concepts can be applied to different networking domains.

Read:
https://netterrene.blogspot.com/

Cisco ACI Fundamentals

Cisco ACI Explained: Concepts, Learning Prerequisites, Benefits, and Limitations

Useful for strengthening your ACI fundamentals while exploring AI-based networking.

Read:
https://netterrene.blogspot.com/

Cisco ACI MoQuery

Cisco ACI MoQuery Commands

MoQuery is particularly interesting from an AI-agent perspective because operational information can potentially become input for an intelligent troubleshooting workflow.

Read:
https://netterrene.blogspot.com/

31. Recommended Learning Path for Network Engineers

If you are learning AI while continuing your networking career, you can follow this sequence:

Step 1 → Cisco SD-WAN fundamentals

Step 2 → Generative AI fundamentals

Step 3 → Understand AI agents

Step 4 → Learn Plan-and-Execute

Step 5 → Learn RAG

Step 6 → Learn tool calling

Step 7 → Learn ReAct

Step 8 → Understand memory and context

Step 9 → Learn Human-in-the-Loop

Step 10 → Apply these concepts to SD-WAN troubleshooting

Step 11 → Start with read-only automation

Step 12 → Gradually introduce controlled execution

This approach lets a network engineer build AI skills without losing the advantage of existing networking knowledge.

32. Final Takeaway

The Anatomy of an Agent becomes much easier to understand when you map the concepts to a Cisco SD-WAN troubleshooting problem.

Plan-and-Execute → SD-WAN troubleshooting roadmap

System Prompt → Agent behavior and operational boundaries

RAG → SD-WAN documentation and internal runbooks

Tool Calling → SD-WAN Manager/API/monitoring tools

ReAct → Think → Act → Observe

Memory → Troubleshooting history

Context Window → Current investigation information

Perception → Extracting information from device logs

Supervisor → Coordinating specialized network agents

Human-in-the-Loop → Production policy approval

Termination → Knowing when the investigation should stop

The important lesson for network engineers is that Agentic AI does not replace networking fundamentals.

Instead, your understanding of SD-WAN architecture, WAN Edge devices, control connections, BFD, OMP, tunnels, routing, application-aware routing, policies, and troubleshooting methodology can become the foundation for intelligent network operations.

The future network engineer will not simply operate the network.

They will increasingly learn how to build, supervise, and safely govern intelligent systems that operate alongside the network.

33. Final Challenge

How many questions did you answer correctly before checking the answers?

18–22 correct: Excellent — you understand both networking and the AI-agent concepts.

14–17 correct: Very good — review RAG, ReAct, memory, and tool calling.

10–13 correct: Good starting point — revisit the fundamentals of AI agents.

Below 10: Don't worry. Start with Generative AI fundamentals and work through the questions again.

The goal is not simply to score well.

The real goal is to understand how Agentic AI concepts can be translated into practical Cisco SD-WAN engineering workflows.