Which service VPN must be reachable from all WAN Edge devices and the controllers?

VPN0 is the transport VPN in Cisco SD-WAN and is critical because it carries all control plane traffic, including OMP, BFD, and IPsec key exchange, as well as management communication between controllers (vManage, vSmart, vBond) and WAN Edge devices. Therefore, it must be universally reachable by all WAN Edge devices and controllers for the SD-WAN fabric to establish and operate correctly.

VPN10 is a service VPN used for user or data traffic, and its reachability is subject to specific network design and policies, not a universal requirement for the SD-WAN control plane.

VPN15 is another example of a service VPN for customer data traffic; its reachability is policy-driven and not inherently required for core controller-to-WAN-Edge communication.

VPN512 is the out-of-band management VPN, used for device management, but it does not carry the core control plane traffic that VPN0 does for the SD-WAN overlay functionality.