I’ll be honest and say I’ve never seen Cisco’s SD-WAN product in prod to really see packet captures from it. I can speak for Velocloud and say that they use IPsec! There is a proprietary control protocol that tags the packets but the data tunneling is handled by IPsec.
I agree with you. Critical infrastructure and DoD ripped fortigates off their network years ago. Most run a mix of Palo and Firepower.
all good in the hood. if I had a £ for every time I mis-read something. 
Nah, they boot off an SSD.
Well that is really interesting info. I have to admit that I assumed they had similar technology to us as I do know they are a per-packet routing solution, but I am more than happy to put my hand up and say I’m wrong about Velo. Again I assumed.
Genuinely, if you are ever interested in a chat about the technology, let me know. Always fun to shoot the breeze with a fellow techie on these things.