Anatomy of an AI Agent for Cisco SD-WAN: Knowledge Assessment for Network Engineers
1. Introduction
AI agents are becoming increasingly relevant to network operations. For Cisco SD-WAN engineers, concepts such as planning, RAG, tool calling, ReAct, memory, context windows, Human-in-the-Loop, and multi-agent orchestration can be connected directly to real-world network troubleshooting.
Imagine receiving an alert:
"The SD-WAN tunnel between Branch-101 and the data center is experiencing intermittent packet loss."
A traditional troubleshooting process might involve checking the SD-WAN Manager, tunnel status, BFD sessions, control connections, application-aware routing, interface statistics, routing information, and device logs.
An AI agent could potentially coordinate these investigation steps using approved tools.
This assessment takes the concepts from the Anatomy of an Agent knowledge assessment and adapts them to Cisco SD-WAN scenarios. The original material focuses on concepts including Plan-and-Execute, System Prompt, RAG, Context Window, termination conditions, tool descriptions, ReAct Observation, memory, and Supervisor orchestration.
Try answering each question before checking the answer.
2. Question 1 – Plan-and-Execute in Cisco SD-WAN
An AI agent is asked to investigate why a branch application is experiencing poor performance over Cisco SD-WAN.
Before taking any action, the agent creates a troubleshooting roadmap:
1. Check device health
2. Check WAN interface status
3. Check control connections
4. Check BFD sessions
5. Check tunnel statistics
6. Check application-aware routing
7. Check packet loss and latency
8. Analyze the findings
9. Recommend remediationWhat is the primary benefit of this approach?
A. It eliminates the need for SD-WAN Manager
B. It allows the agent to create an explicit roadmap before acting, making complex tasks more manageable
C. It guarantees that the network problem will be fixed
D. It removes the need for network engineers
Answer: B – It allows the agent to create an explicit roadmap before acting, making complex tasks more manageable.
This reflects the Plan-and-Execute concept from the source assessment, where separating planning from execution provides an explicit roadmap for complex tasks.
3. Question 2 – System Prompt for a Cisco SD-WAN Agent
You are building an AI agent for Cisco SD-WAN operations.
The agent should be able to investigate device health, routing, BFD, and tunnel status, but it must not make production configuration changes without authorization.
Which component should define these rules?
A. Context Window
B. RAG
C. System Prompt
D. Memory
Answer: C – System Prompt
The System Prompt defines the agent's identity, scope, and behavioral guidelines.
For example:
You are a Cisco SD-WAN troubleshooting assistant.
You may:
- Read operational information
- Analyze SD-WAN health
- Investigate connectivity problems
- Recommend remediation
You must:
- Follow approved procedures
- Request human approval before production changes
- Explain the evidence behind your recommendation4. Question 3 – RAG for Cisco SD-WAN
A company wants its AI agent to use the organization's latest SD-WAN design documents, troubleshooting procedures, security standards, change-management policies, and approved runbooks.
Which capability would be most appropriate?
A. RAG
B. Context Window
C. Iteration Limit
D. Tool Description
Answer: A – RAG
RAG, or Retrieval-Augmented Generation, allows an agent to access current and organization-specific knowledge.
For a Cisco SD-WAN environment, a RAG knowledge base could contain:
- SD-WAN design documents
- WAN standards
- Troubleshooting runbooks
- Change procedures
- Security policies
- Branch deployment standards
- Previous incident reports
- Internal operational documentation
5. Question 4 – Context Window
An AI agent is troubleshooting a Cisco SD-WAN connectivity problem.
It needs to consider:
- Previous tool results
- BFD status
- Control connections
- Tunnel information
- Routing information
- Interface statistics
- Current conversation
What does the context window represent?
A. The physical memory available on an SD-WAN router
B. The time for which an SD-WAN tunnel remains active
C. The span of tokens the model can consider at one time when making decisions
D. The maximum number of SD-WAN sites supported
Answer: C – The span of tokens the model can consider at one time when making decisions.
This is the definition used in the source assessment.
For a network engineer, you can think of the context window as the information the AI can consider while making its current decision.
6. Question 5 – Agent Termination
An AI agent is troubleshooting an SD-WAN tunnel.
Which of the following is NOT a valid termination condition for the agent loop?
A. The requested troubleshooting task has been completed
B. The maximum iteration limit has been reached
C. The agent's confidence level drops below a configured threshold
D. The agent receives approval to continue
Answer: D – The agent receives approval to continue.
Approval to continue means the agent can proceed; it does not itself represent a termination condition.
The source assessment makes the same distinction.
7. Question 6 – Detecting an Agent Loop
An AI agent is troubleshooting an SD-WAN tunnel.
The activity trace shows:
Iteration 3
Action: Check BFD session
Observation: Request timed out
Iteration 4
Action: Check BFD session
Observation: Request timed out
Iteration 5
Action: Check BFD session
Observation: Request timed outWhat problem is the agent demonstrating?
A. Successful termination
B. A loop
C. Human-in-the-Loop
D. RAG failure
Answer: B – A loop
The agent is repeatedly performing the same action without making progress.
Mechanisms such as:
- Iteration limits
- Action-history tracking
- Repeated-action detection
- Fallback strategies
can help prevent an agent from getting stuck.
The source assessment uses a similar repeated-action trace to test this concept.
8. Question 7 – Tool Description
An AI agent has access to the following Cisco SD-WAN tools:
get_device_health
get_bfd_status
get_tunnel_statistics
get_route_informationWhy is the description field in a tool schema important?
A. It determines how fast the tool executes
B. It helps the LLM determine when to use the tool
C. It changes the SD-WAN device configuration
D. It automatically increases WAN bandwidth
Answer: B – It helps the LLM determine when to use the tool.
The source assessment specifically identifies the tool description as helping the LLM decide when to use one tool versus another.
For example:
get_bfd_status:
Retrieve the operational state, packet loss,
latency, and session status of SD-WAN BFD sessions.A clear description makes tool selection easier for the agent.
9. Question 8 – Selecting the Correct SD-WAN Tool
An engineer asks:
"Show me the current BFD session status between Branch-101 and the data center."
Which tool would be most appropriate?
A. get_route_information
B. get_bfd_status
C. change_sdwan_policy
D. send_email
Answer: B – get_bfd_status
The agent should select the tool whose purpose most closely matches the requested operation.
10. Question 9 – Tool Categories
Match each SD-WAN agent activity with the appropriate tool category.
| SD-WAN Activity | Tool Category |
|---|---|
| Retrieve tunnel statistics | Retrieval |
| Apply an approved SD-WAN policy change | Execution |
| Request engineer approval | Communication |
| Extract structured information from raw device logs | Perception |
Answer:
- Retrieve tunnel statistics → Retrieval
- Apply an approved policy change → Execution
- Request engineer approval → Communication
- Extract structured information from raw logs → Perception
These categories follow the tool-category structure used in the source assessment.
11. Question 10 – Perception Tool
An AI agent receives thousands of unstructured Cisco SD-WAN device log messages.
It needs to extract:
Device
Interface
Timestamp
Event
Severity
Error conditionWhich tool category would be most appropriate?
A. Retrieval
B. Execution
C. Communication
D. Perception
Answer: D – Perception
Perception is appropriate when the agent needs to interpret unstructured information and extract useful structured information.
The source assessment uses extraction of structured data from unstructured syslog as the example for Perception.
12. Question 11 – ReAct Observation
An AI agent troubleshooting Cisco SD-WAN follows this pattern:
Thought
↓
Action
↓
ObservationThe agent calls an SD-WAN monitoring API to retrieve BFD statistics.
What is the purpose of the Observation step?
A. Generate the final answer immediately
B. Receive and process the result of the tool call
C. Restart the SD-WAN device
D. Delete the previous action
Answer: B – Receive and process the result of the tool call
The source assessment defines Observation in ReAct as receiving and processing the result of a tool call.
Example:
Thought:
I need to determine whether packet loss is affecting the tunnel.
Action:
get_bfd_status()
Observation:
BFD session is up, but packet loss is 8%.The observation provides new information that can influence the next decision.
13. Question 12 – SD-WAN Agent Memory
An AI agent has already checked:
Device health
WAN interface
Control connection
BFD
Tunnel status
Routing tableThe agent should avoid repeating the same checks unnecessarily.
Which capability helps retain information about previous actions and results?
A. Memory
B. BFD
C. OMP
D. IPsec
Answer: A – Memory
Memory can help the agent maintain relevant information about its previous investigation.
For a network engineer, think of it as the agent maintaining a troubleshooting history.
14. Question 13 – Short-Term Investigation Context
During an SD-WAN troubleshooting session, the agent has established:
Branch-101 WAN interface → Up
Control connection → Up
BFD → Up
Packet loss → 8%The agent needs this information when deciding what to investigate next.
Which capability is most directly related to maintaining the current investigation information?
A. Working context / short-term memory
B. OMP
C. IPsec
D. Application-aware routing
Answer: A – Working context / short-term memory
The agent needs the current investigation context so it can make decisions based on what it has already discovered.
15. Question 14 – Supervisor Architecture
A large enterprise wants to create an AI-powered network operations platform containing specialized agents:
SD-WAN Troubleshooting Agent
Security Agent
Performance Agent
Incident Management AgentEach agent has specialized tools and domain knowledge.
The organization wants a central agent to coordinate these specialized workers and maintain accountability for the overall task.
Which orchestration pattern is most appropriate?
A. Peer-to-peer
B. Hierarchical routing only
C. Supervisor
D. Single agent
Answer: C – Supervisor
A Supervisor architecture uses a central agent to coordinate specialized worker agents.
The source assessment similarly identifies Supervisor as appropriate when multiple specialized functions need coordination and a clear point of accountability.
16. Question 15 – Human-in-the-Loop for SD-WAN
An AI agent determines that an SD-WAN centralized policy needs to be modified.
The change could affect traffic forwarding for hundreds of branch sites.
What should the agent ideally do before making the production change?
A. Apply the change immediately
B. Restart all WAN routers
C. Request appropriate human approval
D. Delete the existing policy
Answer: C – Request appropriate human approval
A safer workflow is:
Investigate
↓
Analyze
↓
Recommend
↓
Human Approval
↓
Execute
↓
VerifyThis is especially important for centralized SD-WAN policies because a single policy change can potentially affect many sites.
17. Question 16 – SD-WAN Agent Safety
An AI agent identifies a possible routing problem and recommends changing a production SD-WAN policy.
Which approach is safest?
A. Give the agent unrestricted administrator access
B. Allow the agent to make any change automatically
C. Use controlled permissions and require approval for high-impact changes
D. Disable logging so the agent can operate faster
Answer: C – Use controlled permissions and require approval for high-impact changes.
The agent should have only the permissions necessary for its assigned role.
18. Question 17 – Agent Cannot Access SD-WAN Data
An AI agent is investigating a branch connectivity issue, but its monitoring API repeatedly returns a timeout.
What should the agent ideally do?
A. Continue calling the same API indefinitely
B. Invent the missing data
C. Use an approved fallback or escalate to a human
D. Modify the SD-WAN policy automatically
Answer: C – Use an approved fallback or escalate to a human
A well-designed agent needs a defined failure-handling strategy.
For example:
API Failure
↓
Retry within limit
↓
Try approved alternative source
↓
If still unavailable
↓
Escalate19. Question 18 – SD-WAN Tunnel Investigation
An engineer reports:
"Branch-101 is experiencing poor application performance."
The AI agent discovers:
WAN interface → Up
Control connection → Up
BFD → Up
Tunnel → Up
Packet loss → 8%
Latency → Significantly higher than baselineWhat should the agent do next?
A. Immediately reboot the SD-WAN router
B. Investigate the WAN path and available transport characteristics
C. Delete the SD-WAN policy
D. Replace the branch router
Answer: B – Investigate the WAN path and available transport characteristics
The observations indicate that basic connectivity is available, but path quality may be affecting application performance.
The agent should continue its investigation rather than immediately changing configuration.
20. Question 19 – RAG vs Live SD-WAN Data
An SD-WAN engineer asks:
"What is our organization's approved process for changing a centralized SD-WAN policy?"
Which source would be most appropriate?
A. Generic model knowledge only
B. Organization-specific knowledge retrieved through RAG
C. Random internet content
D. Current BFD statistics
Answer: B – Organization-specific knowledge retrieved through RAG
This is an important distinction:
RAG
↓
Organizational knowledge
SD-WAN APIs / Monitoring
↓
Current operational stateA capable agent could use both.
21. Question 20 – Complete AI Agent Workflow
Which sequence best represents a well-designed AI agent investigating a Cisco SD-WAN incident?
A.
Change → Guess → StopB.
Goal → Plan → Tool → Observe → Analyze → Next Action → Verify → StopC.
Login → Change → LogoutD.
Prompt → Modify Policy → Restart DeviceAnswer: B – Goal → Plan → Tool → Observe → Analyze → Next Action → Verify → Stop
This sequence combines the major concepts covered by the original Anatomy of an Agent assessment.
22. Bonus Question – Think Like a SD-WAN Engineer
An AI agent reports:
"I am 98% confident that the centralized SD-WAN policy is causing the application problem."
Should the network engineer automatically deploy the proposed change?
A. Yes, because the confidence is 98%
B. Yes, because AI systems do not make networking mistakes
C. No. Validate the evidence and follow the organization's change-control process
D. No, because AI can never troubleshoot SD-WAN
Answer: C – Validate the evidence and follow the organization's change-control process.
AI confidence should not replace engineering judgment.
For production changes, the engineer should review:
- Evidence
- Impact
- Scope
- Proposed change
- Rollback plan
- Change window
- Approval requirements
23. Quick Answer Key
| Question | Answer |
| Q1 | B |
| Q2 | C |
| Q3 | A |
| Q4 | C |
| Q5 | D |
| Q6 | B |
| Q7 | B |
| Q8 | B |
| Q9 | Matching |
| Q10 | D |
| Q11 | B |
| Q12 | A |
| Q13 | A |
| Q14 | C |
| Q15 | C |
| Q16 | C |
| Q17 | C |
| Q18 | B |
| Q19 | B |
| Q20 | B |
| Bonus | C |
24. Cisco SD-WAN Concepts That an AI Agent Could Potentially Investigate
For a Cisco SD-WAN engineer, an AI agent could potentially be given controlled access to information related to:
- SD-WAN Manager health
- WAN Edge devices
- Control connections
- BFD sessions
- OMP information
- IPsec tunnels
- Routing information
- Transport interfaces
- Application-aware routing
- SLA information
- Packet loss
- Latency
- Jitter
- Device alarms
- Interface statistics
- Centralized policies
- Localized policies
- Configuration templates
- Device logs
This is where your existing networking knowledge becomes valuable.
You already know what these objects mean. The AI-agent layer adds a mechanism for collecting, correlating, and reasoning over that information.
25. Example: AI Agent Troubleshooting a Cisco SD-WAN Application
Consider this real-world scenario:
"Users at Branch-101 report that the ERP application is slow."
A traditional troubleshooting process might look like:
Check Branch Router
↓
Check Interface
↓
Check BFD
↓
Check Tunnel
↓
Check Routing
↓
Check Application-Aware Routing
↓
Check Loss / Latency / Jitter
↓
Check LogsAn AI agent could potentially coordinate the same workflow.
Step 1 – Understand the Objective
The objective is not simply:
"Check the router."
The actual objective is:
"Determine why the ERP application is experiencing degraded performance."
Step 2 – Create a Plan
Application
↓
Path
↓
Transport
↓
Tunnel
↓
Routing
↓
DeviceStep 3 – Call Tools
The agent retrieves operational information.
Step 4 – Observe
Suppose it discovers:
BFD → Up
Tunnel → Up
Packet Loss → High
Latency → HighStep 5 – Reason
The agent determines that connectivity exists but path quality is degraded.
Step 6 – Retrieve Organizational Knowledge
RAG provides the company's approved troubleshooting procedure.
Step 7 – Recommend
The agent presents the evidence and recommended next step.
Step 8 – Human Approval
If a policy modification is required, the engineer reviews and approves it.
Step 9 – Execute
Only the authorized action is performed.
Step 10 – Verify
The agent checks whether application performance has improved.
Step 11 – Terminate
The investigation ends when the defined success condition is met.
26. Why This Is Different From Traditional SD-WAN Automation
Traditional automation usually follows predefined logic.
For example:
IF BFD DOWN
THEN
Raise AlertAn AI agent can potentially work with a broader goal:
"Investigate why this application is performing poorly."
It may determine that it needs to examine multiple sources before reaching a conclusion.
The distinction can be summarized as:
Traditional Automation
↓
Predefined Workflow
↓
Known Conditions
↓
Known Actionsversus:
AI Agent
↓
Goal
↓
Plan
↓
Select Tools
↓
Observe
↓
Reason
↓
Adapt
↓
VerifyThe second model is particularly interesting for troubleshooting scenarios where the exact sequence is not known in advance.
27. What Should a Cisco SD-WAN Agent NOT Do?
An AI agent operating in a production SD-WAN environment should not have unrestricted authority.
It should not:
- Change centralized policies without authorization
- Modify routing policies without validation
- Restart production devices automatically
- Disable security controls
- Ignore change-management procedures
- Continue executing actions indefinitely
- Assume that its diagnosis is always correct
- Hide failed actions
- Invent missing operational data
A safer approach is:
Investigate → Analyze → Recommend → Approve → Execute → Verify
rather than:
Investigate → Change
28. Start With Read-Only SD-WAN Automation
If you are a network engineer beginning your AI journey, start small.
A practical progression could be:
Phase 1
Read-only SD-WAN information
↓
AI-generated analysis
Phase 2
Read-only information
↓
AI diagnosis
↓
Human validates
Phase 3
AI recommendation
↓
Human approval
↓
Controlled execution
Phase 4
Limited autonomous operations
↓
Strict guardrails
↓
Continuous monitoringThis allows the organization to build confidence gradually.
29. Where Can AI Agents Help Cisco SD-WAN Engineers?
Potential use cases include:
SD-WAN Tunnel Troubleshooting
"Why is the tunnel between Branch-101 and the data center experiencing packet loss?"
BFD Investigation
"Identify branches with unstable BFD sessions."
Application-Aware Routing
"Why is the application using the MPLS path instead of the preferred transport?"
WAN Performance
"Find sites where latency and jitter have exceeded the defined threshold."
Device Health
"Identify unhealthy SD-WAN Edge devices."
Policy Analysis
"Explain which policy is influencing this traffic path."
Incident Investigation
"Investigate this branch outage and provide a timeline."
Change Validation
"Review this proposed SD-WAN policy change and identify potential impact."
These are examples of how AI agents could potentially reduce repetitive investigation tasks.
30. Related Articles From Netterrene
AI Learning
Generative AI Fundamentals Explained for Beginners
A good starting point if you are new to Generative AI and want to understand the fundamental concepts before learning Agentic AI.
Read:
https://netterrene.blogspot.com/2026/06/generative-ai-fundamentals-for-beginners.html
Agentic AI for Network Engineers
Agentic AI for Network Engineers: What It Actually Means for BGP, ACI, and Your NOC
This is the natural next article after understanding the anatomy of an agent. It connects Agentic AI with practical network operations.
Read:
https://netterrene.blogspot.com/2026/07/agentic-ai-for-network-engineers-guide.html
Cisco ACI + AI
Anatomy of an AI Agent for Cisco ACI: Knowledge Assessment for Network Engineers
If you work with both ACI and SD-WAN, compare how the same AI-agent concepts can be applied to different networking domains.
Read:
https://netterrene.blogspot.com/
Cisco ACI Fundamentals
Cisco ACI Explained: Concepts, Learning Prerequisites, Benefits, and Limitations
Useful for strengthening your ACI fundamentals while exploring AI-based networking.
Read:
https://netterrene.blogspot.com/
Cisco ACI MoQuery
Cisco ACI MoQuery Commands
MoQuery is particularly interesting from an AI-agent perspective because operational information can potentially become input for an intelligent troubleshooting workflow.
Read:
https://netterrene.blogspot.com/
31. Recommended Learning Path for Network Engineers
If you are learning AI while continuing your networking career, you can follow this sequence:
Step 1 → Cisco SD-WAN fundamentals
Step 2 → Generative AI fundamentals
Step 3 → Understand AI agents
Step 4 → Learn Plan-and-Execute
Step 5 → Learn RAG
Step 6 → Learn tool calling
Step 7 → Learn ReAct
Step 8 → Understand memory and context
Step 9 → Learn Human-in-the-Loop
Step 10 → Apply these concepts to SD-WAN troubleshooting
Step 11 → Start with read-only automation
Step 12 → Gradually introduce controlled execution
This approach lets a network engineer build AI skills without losing the advantage of existing networking knowledge.
32. Final Takeaway
The Anatomy of an Agent becomes much easier to understand when you map the concepts to a Cisco SD-WAN troubleshooting problem.
Plan-and-Execute → SD-WAN troubleshooting roadmap
System Prompt → Agent behavior and operational boundaries
RAG → SD-WAN documentation and internal runbooks
Tool Calling → SD-WAN Manager/API/monitoring tools
ReAct → Think → Act → Observe
Memory → Troubleshooting history
Context Window → Current investigation information
Perception → Extracting information from device logs
Supervisor → Coordinating specialized network agents
Human-in-the-Loop → Production policy approval
Termination → Knowing when the investigation should stop
The important lesson for network engineers is that Agentic AI does not replace networking fundamentals.
Instead, your understanding of SD-WAN architecture, WAN Edge devices, control connections, BFD, OMP, tunnels, routing, application-aware routing, policies, and troubleshooting methodology can become the foundation for intelligent network operations.
The future network engineer will not simply operate the network.
They will increasingly learn how to build, supervise, and safely govern intelligent systems that operate alongside the network.
33. Final Challenge
How many questions did you answer correctly before checking the answers?
18–22 correct: Excellent — you understand both networking and the AI-agent concepts.
14–17 correct: Very good — review RAG, ReAct, memory, and tool calling.
10–13 correct: Good starting point — revisit the fundamentals of AI agents.
Below 10: Don't worry. Start with Generative AI fundamentals and work through the questions again.
The goal is not simply to score well.
The real goal is to understand how Agentic AI concepts can be translated into practical Cisco SD-WAN engineering workflows.
