Refer to the exhibit. Cisco SD-WAN is deployed with controllers hosted in a data center. All branches have WAN Edge devices with dual connections to the data center, one via internet and the other…

Updating the system IP on vManage and resending it to controllers is not a solution for control connection failures on specific circuits; system IP is typically stable and critical.

Control connection failures, particularly on a specific underlay circuit like MPLS, strongly suggest that the WAN Edge devices cannot establish IP reachability to the vSmart controllers over that particular transport. This points to issues in the underlay routing configuration (e.g., OSPF, EIGRP, static routes) preventing the establishment of the DTLS/TLS control plane tunnels.

TLOC colors are used for distinguishing transport types and are configured per interface, not typically 'matched on controllers'; mismatches would cause data plane issues rather than control plane reachability failure for a few specific branches.

While certificates are crucial for DTLS connections, if the issue is only with some branches on a specific circuit, it's less likely a wholesale certificate problem (which would affect all branches or all circuits) and more likely a reachability issue.